26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 83:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4aa,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample 87252d3c1de3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 87252d3c1de3…. Malware family: Crifi.Generic. Threat score 100/100. 12/25 AV engines flagged this file. 25 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3"],"about":{"@type":"SoftwareApplication","name":"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f.exe","applicationCategory":["peexe","executable"],"identifier":"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":12,"total":25},"behavioralIndicators":{"malicious":25,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T25c4,Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolder"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBeep"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")28:T5d8,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" called "FindResourceA" with parameter "654408" - (UID: 00000000-00005928) "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" called "FindResourceA" with parameter "15405768" - (UID: 00000000-00005928) "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" called "FindResourceA" with parameter "15405776" - (UID: 00000000-00005928) "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" called "FindResourceA" with parameter "15405804" - (UID: 00000000-00005928) "we4pZ94.exe" called "FindResourceA" with parameter "18486092" - (UID: 00000000-00006096) "we4pZ94.exe" called "FindResourceA" with parameter "2227448" - (UID: 00000000-00006096) "we4pZ94.exe" called "FindResourceA" with parameter "18485960" - (UID: 00000000-00006096) "we4pZ94.exe" called "FindResourceA" with parameter "18485968" - (UID: 00000000-00006096) "we4pZ94.exe" called "FindResourceA" with parameter "18485996" - (UID: 00000000-00006096) "vz2Kg11.exe" called "FindResourceA" with parameter "10031948" - (UID: 00000000-00004184) "vz2Kg11.exe" called "FindResourceA" with parameter "1834072" - (UID: 00000000-00004184) "vz2Kg11.exe" called "FindResourceA" with parameter "10031816" - (UID: 00000000-00004184) "vz2Kg11.exe" called "FindResourceA" with parameter "10031824" - (UID: 00000000-00004184) "vz2Kg11.exe" called "FindResourceA" with parameter "10031852" - (UID: 00000000-00004184)29:T5bb,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15452240'}" (UID: 00000000-00005928) "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15452272'}" (UID: 00000000-00005928) "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '15452256'}" (UID: 00000000-00005928) "we4pZ94.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18532320'}" (UID: 00000000-00006096) "we4pZ94.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18532432'}" (UID: 00000000-00006096) "we4pZ94.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18532464'}" (UID: 00000000-00006096) "we4pZ94.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18532448'}" (UID: 00000000-00006096) "vz2Kg11.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10078176'}" (UID: 00000000-00004184) "vz2Kg11.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10078288'}" (UID: 00000000-00004184) "vz2Kg11.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10078320'}" (UID: 00000000-00004184) "vz2Kg11.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10078304'}" (UID: 00000000-00004184)2a:T4e9,Found reference to API "SetupDiGetClassDevsA" (Indicator: "SetupDiGetClassDevs"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "SetupDiEnumDeviceInfo" (Indicator: "SetupDiEnumDeviceInfo"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "SetupDiGetClassDevsA" (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "SetupDiEnumDeviceInfo" (Indicator: "SetupDiEnumDeviceInfo"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "SetupDiGetClassDevsA" (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp") Found reference to API "SetupDiEnumDeviceInfo" (Indicator: "SetupDiEnumDeviceInfo"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp")2b:T638,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002748.00000000.81128.00300000.00000004.mdmp, 00000000-00002748.00000001.83050.00300000.00000004.mdmp, 00000000-00002748.00000002.84972.00300000.00000004.mdmp, 00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002748.00000000.81128.00300000.00000004.mdmp, 00000000-00002748.00000001.83050.00300000.00000004.mdmp, 00000000-00002748.00000002.84972.00300000.00000004.mdmp, 00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp")2c:T4ff,"1sL92vc6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}") "1sL92vc6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PROPERTYBAG") "1sL92vc6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1") "1sL92vc6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\KNOWNFOLDERS") "1sL92vc6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "1sL92vc6.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "1sL92vc6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS") "1sL92vc6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}") "1sL92vc6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}")2d:T131e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-15-00EB1F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-15-00EB1F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-16-00EB44B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-16-00EB44B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-22-00EB681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-22-00EB681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-26-00EB24E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-26-00EB24E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-29-00EB52B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-29-00EB52B6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005928-24069-31-00EB2390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005928-24069-31-00EB2390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-33-00EB2F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-33-00EB2F1D Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005928-24069-36-00EB3BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005928-24069-36-00EB3BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-37-00EB3FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-37-00EB3FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-40-00EB2267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-40-00EB2267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-41-00EB6495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-41-00EB6495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-42-00EB202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00005928-24069-42-00EB202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-42-00EB202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-43-00EB1AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-43-00EB1AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-44-00EB2AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-44-00EB2AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-52-00EB4EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-52-00EB4EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-57-00EB6298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-57-00EB6298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-59-00EB621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-59-00EB621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-60-00EB597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-60-00EB597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-62-00EB55A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-62-00EB55A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-63-00EB5467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-63-00EB5467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-65-00EB53A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-65-00EB53A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-66-00EB2630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-66-00EB2630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-71-00EB2CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-71-00EB2CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-72-00EB18A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-72-00EB18A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005928-24069-73-00EB17EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005928-24069-73-00EB17EE2e:Te759,Found XOR loop in file "Cz3Js38.exe" at offset 190485; code bytes = 30d0 Found XOR loop in file "Cz3Js38.exe" at offset 337804; code bytes = 30d0 Found XOR loop in file "Cz3Js38.exe" at offset 580854; code bytes = 30d0 Found XOR loop in file "Cz3Js38.exe" at offset 759211; code bytes = 30d0 Found XOR loop in file "Cz3Js38.exe" at offset 815958; code bytes = 30d0 Found XOR loop in file "Cz3Js38.exe" at offset 930909; code bytes = 30d0 Found XOR loop in file "Cz3Js38.exe" at offset 964702; code bytes = 30d0 Found XOR loop in file "Cz3Js38.exe" at offset 983164; code bytes = 30d0 Found XOR loop in file "Cz3Js38.exe" at offset 1005145; code bytes = 30d0 Found XOR loop in file "Cz3Js38.exe" at offset 1042331; code bytes = 30d0 Found XOR loop in file "Cz3Js38.exe" at offset 1046361; code bytes = 30d0 Found XOR loop in file "Cz3Js38.exe" at offset 1126022; code bytes = 30d0 Found XOR loop in file "Cz3Js38.exe" at offset 1190021; code bytes = 30d0 Found XOR loop in file "Cz3Js38.exe" at offset 1251907; code bytes = 30d0 Found XOR loop in file "Cz3Js38.exe" at offset 1268215; code bytes = 30d0 Found XOR loop in file "Cz3Js38.exe" at offset 1309268; code bytes = 30d0 Found XOR loop in file "Cz3Js38.exe" at offset 1363886; code bytes = 30d0 Found XOR loop in file "Cz3Js38.exe" at offset 1397249; code bytes = 30d0 Found XOR loop in file "Cz3Js38.exe" at offset 1409032; code bytes = 30d0 Found XOR loop in file "Cz3Js38.exe" at offset 1528641; code bytes = 30d0 Found XOR loop in file "Cz3Js38.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 171324; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 179098; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 203852; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 357910; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 511626; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 519959; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 540126; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 567033; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 741898; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 764075; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 870886; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 891916; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 944976; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 965556; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 983362; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 998459; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 1032517; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 1042111; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 1118405; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 1162733; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 1185987; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 1187073; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 1193830; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 1264147; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 1266679; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 1343925; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 1344965; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 1366288; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 1389120; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 1513461; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 1533405; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 1611562; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 1644473; code bytes = 33c1 Found XOR loop in file "Cz3Js38.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 196847; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 291819; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 396503; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 492923; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 556114; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 556398; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 660107; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 669456; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 684572; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 806377; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 858488; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 962638; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 969735; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 971108; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 1000393; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 1018888; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 1189967; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 1332094; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 1547453; code bytes = 8030 Found XOR loop in file "Cz3Js38.exe" at offset 1559775; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 1274152; code bytes = 30d0 Found XOR loop in file "1sL92vc6.exe" at offset 1287765; code bytes = 30d0 Found XOR loop in file "1sL92vc6.exe" at offset 1485168; code bytes = 30d0 Found XOR loop in file "1sL92vc6.exe" at offset 1507775; code bytes = 30d0 Found XOR loop in file "1sL92vc6.exe" at offset 1514635; code bytes = 30d0 Found XOR loop in file "1sL92vc6.exe" at offset 1514887; code bytes = 30d0 Found XOR loop in file "1sL92vc6.exe" at offset 1515347; code bytes = 30d0 Found XOR loop in file "1sL92vc6.exe" at offset 1516553; code bytes = 30d0 Found XOR loop in file "1sL92vc6.exe" at offset 1521461; code bytes = 30d0 Found XOR loop in file "1sL92vc6.exe" at offset 1522625; code bytes = 30d0 Found XOR loop in file "1sL92vc6.exe" at offset 1538921; code bytes = 30d0 Found XOR loop in file "1sL92vc6.exe" at offset 688249; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 688345; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 688444; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 688500; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 688526; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 688604; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 688747; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 688843; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 689850; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 690446; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 764137; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 817238; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 817472; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 909588; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 924330; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 942350; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 948128; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 953465; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 953616; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 969842; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 971092; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 983876; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 985045; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 985160; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 989471; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 989786; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 990362; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 992172; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 992479; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 992865; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 992957; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 993612; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 995617; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 999815; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 1000389; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 1001271; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 1001375; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 1002055; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 1002170; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 1006463; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 1007340; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 1027259; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 1033356; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 1034159; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 1289436; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 1441388; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 1505345; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 1507059; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 1513223; code bytes = 33c1 Found XOR loop in file "1sL92vc6.exe" at offset 735579; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 735612; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 735686; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 735764; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 735781; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 735802; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 735842; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 735923; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 735946; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 735963; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 736030; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 736068; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 736997; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 737018; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 833270; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 838380; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 845494; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 845523; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 857223; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 869347; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 869366; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 869863; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 925121; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 925175; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 925196; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 925223; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 925256; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 925280; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 925297; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 925319; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 925429; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 925471; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 1337260; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 1349610; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 1362066; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 1495860; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 1517374; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 1521442; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 1522614; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 1523404; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 1537116; code bytes = 8030 Found XOR loop in file "1sL92vc6.exe" at offset 1538890; code bytes = 8030 Found XOR loop in file "2cG0873.exe" at offset 876034; code bytes = 30d0 Found XOR loop in file "2cG0873.exe" at offset 1141197; code bytes = 30d0 Found XOR loop in file "2cG0873.exe" at offset 1152317; code bytes = 30d0 Found XOR loop in file "2cG0873.exe" at offset 1154881; code bytes = 30d0 Found XOR loop in file "2cG0873.exe" at offset 1155737; code bytes = 30d0 Found XOR loop in file "2cG0873.exe" at offset 1156521; code bytes = 30d0 Found XOR loop in file "2cG0873.exe" at offset 89010; code bytes = 33c1 Found XOR loop in file "2cG0873.exe" at offset 148580; code bytes = 33c1 Found XOR loop in file "2cG0873.exe" at offset 148752; code bytes = 33c1 Found XOR loop in file "2cG0873.exe" at offset 149045; code bytes = 33c1 Found XOR loop in file "2cG0873.exe" at offset 154932; code bytes = 33c1 Found XOR loop in file "2cG0873.exe" at offset 155104; code bytes = 33c1 Found XOR loop in file "2cG0873.exe" at offset 155397; code bytes = 33c1 Found XOR loop in file "2cG0873.exe" at offset 181222; code bytes = 33c1 Found XOR loop in file "2cG0873.exe" at offset 277995; code bytes = 33c1 Found XOR loop in file "2cG0873.exe" at offset 678287; code bytes = 33c1 Found XOR loop in file "2cG0873.exe" at offset 1149387; code bytes = 33c1 Found XOR loop in file "2cG0873.exe" at offset 622993; code bytes = 8030 Found XOR loop in file "2cG0873.exe" at offset 625199; code bytes = 8030 Found XOR loop in file "2cG0873.exe" at offset 629564; code bytes = 8030 Found XOR loop in file "2cG0873.exe" at offset 632680; code bytes = 8030 Found XOR loop in file "2cG0873.exe" at offset 796692; code bytes = 8030 Found XOR loop in file "2cG0873.exe" at offset 811562; code bytes = 8030 Found XOR loop in file "2cG0873.exe" at offset 934568; code bytes = 8030 Found XOR loop in file "2cG0873.exe" at offset 934582; code bytes = 8030 Found XOR loop in file "2cG0873.exe" at offset 1146358; code bytes = 8030 Found XOR loop in file "2cG0873.exe" at offset 1152284; code bytes = 8030 Found XOR loop in file "2cG0873.exe" at offset 1164451; code bytes = 8030 Found XOR loop in file "2cG0873.exe" at offset 1165667; code bytes = 8030 Found XOR loop in file "we4pZ94.exe" at offset 242268; code bytes = 30d0 Found XOR loop in file "we4pZ94.exe" at offset 485195; code bytes = 30d0 Found XOR loop in file "we4pZ94.exe" at offset 663471; code bytes = 30d0 Found XOR loop in file "we4pZ94.exe" at offset 720194; code bytes = 30d0 Found XOR loop in file "we4pZ94.exe" at offset 835079; code bytes = 30d0 Found XOR loop in file "we4pZ94.exe" at offset 922915; code bytes = 30d0 Found XOR loop in file "we4pZ94.exe" at offset 946463; code bytes = 30d0 Found XOR loop in file "we4pZ94.exe" at offset 950485; code bytes = 30d0 Found XOR loop in file "we4pZ94.exe" at offset 1030113; code bytes = 30d0 Found XOR loop in file "we4pZ94.exe" at offset 1094080; code bytes = 30d0 Found XOR loop in file "we4pZ94.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "we4pZ94.exe" at offset 262366; code bytes = 33c1 Found XOR loop in file "we4pZ94.exe" at offset 416000; code bytes = 33c1 Found XOR loop in file "we4pZ94.exe" at offset 424333; code bytes = 33c1 Found XOR loop in file "we4pZ94.exe" at offset 444492; code bytes = 33c1 Found XOR loop in file "we4pZ94.exe" at offset 471374; code bytes = 33c1 Found XOR loop in file "we4pZ94.exe" at offset 646166; code bytes = 33c1 Found XOR loop in file "we4pZ94.exe" at offset 668319; code bytes = 33c1 Found XOR loop in file "we4pZ94.exe" at offset 775089; code bytes = 33c1 Found XOR loop in file "we4pZ94.exe" at offset 796111; code bytes = 33c1 Found XOR loop in file "we4pZ94.exe" at offset 849146; code bytes = 33c1 Found XOR loop in file "we4pZ94.exe" at offset 883457; code bytes = 33c1 Found XOR loop in file "we4pZ94.exe" at offset 936649; code bytes = 33c1 Found XOR loop in file "we4pZ94.exe" at offset 946243; code bytes = 33c1 Found XOR loop in file "we4pZ94.exe" at offset 1022496; code bytes = 33c1 Found XOR loop in file "we4pZ94.exe" at offset 1066800; code bytes = 33c1 Found XOR loop in file "we4pZ94.exe" at offset 1090046; code bytes = 33c1 Found XOR loop in file "we4pZ94.exe" at offset 1091132; code bytes = 33c1 Found XOR loop in file "we4pZ94.exe" at offset 1097889; code bytes = 33c1 Found XOR loop in file "we4pZ94.exe" at offset 1154489; code bytes = 33c1 Found XOR loop in file "we4pZ94.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "we4pZ94.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "we4pZ94.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "we4pZ94.exe" at offset 196316; code bytes = 8030 Found XOR loop in file "we4pZ94.exe" at offset 300934; code bytes = 8030 Found XOR loop in file "we4pZ94.exe" at offset 397313; code bytes = 8030 Found XOR loop in file "we4pZ94.exe" at offset 460472; code bytes = 8030 Found XOR loop in file "we4pZ94.exe" at offset 460756; code bytes = 8030 Found XOR loop in file "we4pZ94.exe" at offset 564408; code bytes = 8030 Found XOR loop in file "we4pZ94.exe" at offset 573757; code bytes = 8030 Found XOR loop in file "we4pZ94.exe" at offset 588873; code bytes = 8030 Found XOR loop in file "we4pZ94.exe" at offset 710613; code bytes = 8030 Found XOR loop in file "we4pZ94.exe" at offset 762691; code bytes = 8030 Found XOR loop in file "we4pZ94.exe" at offset 898211; code bytes = 8030 Found XOR loop in file "we4pZ94.exe" at offset 904994; code bytes = 8030 Found XOR loop in file "we4pZ94.exe" at offset 1094026; code bytes = 8030 Found XOR loop in file "vz2Kg11.exe" at offset 273895; code bytes = 30d0 Found XOR loop in file "vz2Kg11.exe" at offset 329386; code bytes = 30d0 Found XOR loop in file "vz2Kg11.exe" at offset 390149; code bytes = 30d0 Found XOR loop in file "vz2Kg11.exe" at offset 568326; code bytes = 30d0 Found XOR loop in file "vz2Kg11.exe" at offset 625016; code bytes = 30d0 Found XOR loop in file "vz2Kg11.exe" at offset 739845; code bytes = 30d0 Found XOR loop in file "vz2Kg11.exe" at offset 827640; code bytes = 30d0 Found XOR loop in file "vz2Kg11.exe" at offset 851188; code bytes = 30d0 Found XOR loop in file "vz2Kg11.exe" at offset 855202; code bytes = 30d0 Found XOR loop in file "vz2Kg11.exe" at offset 906314; code bytes = 30d0 Found XOR loop in file "vz2Kg11.exe" at offset 934808; code bytes = 30d0 Found XOR loop in file "vz2Kg11.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "vz2Kg11.exe" at offset 147919; code bytes = 33c1 Found XOR loop in file "vz2Kg11.exe" at offset 349454; code bytes = 33c1 Found XOR loop in file "vz2Kg11.exe" at offset 376328; code bytes = 33c1 Found XOR loop in file "vz2Kg11.exe" at offset 551029; code bytes = 33c1 Found XOR loop in file "vz2Kg11.exe" at offset 573174; code bytes = 33c1 Found XOR loop in file "vz2Kg11.exe" at offset 679887; code bytes = 33c1 Found XOR loop in file "vz2Kg11.exe" at offset 700901; code bytes = 33c1 Found XOR loop in file "vz2Kg11.exe" at offset 753904; code bytes = 33c1 Found XOR loop in file "vz2Kg11.exe" at offset 788207; code bytes = 33c1 Found XOR loop in file "vz2Kg11.exe" at offset 841374; code bytes = 33c1 Found XOR loop in file "vz2Kg11.exe" at offset 850968; code bytes = 33c1 Found XOR loop in file "vz2Kg11.exe" at offset 915833; code bytes = 33c1 Found XOR loop in file "vz2Kg11.exe" at offset 971487; code bytes = 33c1 Found XOR loop in file "vz2Kg11.exe" at offset 994725; code bytes = 33c1 Found XOR loop in file "vz2Kg11.exe" at offset 995811; code bytes = 33c1 Found XOR loop in file "vz2Kg11.exe" at offset 1028025; code bytes = 33c1 Found XOR loop in file "vz2Kg11.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "vz2Kg11.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "vz2Kg11.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "vz2Kg11.exe" at offset 185308; code bytes = 8030 Found XOR loop in file "vz2Kg11.exe" at offset 288876; code bytes = 8030 Found XOR loop in file "vz2Kg11.exe" at offset 365426; code bytes = 8030 Found XOR loop in file "vz2Kg11.exe" at offset 365710; code bytes = 8030 Found XOR loop in file "vz2Kg11.exe" at offset 469321; code bytes = 8030 Found XOR loop in file "vz2Kg11.exe" at offset 478653; code bytes = 8030 Found XOR loop in file "vz2Kg11.exe" at offset 493761; code bytes = 8030 Found XOR loop in file "vz2Kg11.exe" at offset 615443; code bytes = 8030 Found XOR loop in file "vz2Kg11.exe" at offset 667505; code bytes = 8030 Found XOR loop in file "vz2Kg11.exe" at offset 802944; code bytes = 8030 Found XOR loop in file "vz2Kg11.exe" at offset 809727; code bytes = 8030 Found XOR loop in file "vz2Kg11.exe" at offset 921952; code bytes = 8030 Found XOR loop in file "5dD8fu8.exe" at offset 834088; code bytes = 30d0 Found XOR loop in file "5dD8fu8.exe" at offset 916941; code bytes = 30d0 Found XOR loop in file "5dD8fu8.exe" at offset 928061; code bytes = 30d0 Found XOR loop in file "5dD8fu8.exe" at offset 930625; code bytes = 30d0 Found XOR loop in file "5dD8fu8.exe" at offset 931487; code bytes = 30d0 Found XOR loop in file "5dD8fu8.exe" at offset 933143; code bytes = 30d0 Found XOR loop in file "5dD8fu8.exe" at offset 89010; code bytes = 33c1 Found XOR loop in file "5dD8fu8.exe" at offset 148580; code bytes = 33c1 Found XOR loop in file "5dD8fu8.exe" at offset 148752; code bytes = 33c1 Found XOR loop in file "5dD8fu8.exe" at offset 149045; code bytes = 33c1 Found XOR loop in file "5dD8fu8.exe" at offset 154932; code bytes = 33c1 Found XOR loop in file "5dD8fu8.exe" at offset 155104; code bytes = 33c1 Found XOR loop in file "5dD8fu8.exe" at offset 155397; code bytes = 33c1 Found XOR loop in file "5dD8fu8.exe" at offset 181222; code bytes = 33c1 Found XOR loop in file "5dD8fu8.exe" at offset 277995; code bytes = 33c1 Found XOR loop in file "5dD8fu8.exe" at offset 678287; code bytes = 33c1 Found XOR loop in file "5dD8fu8.exe" at offset 925131; code bytes = 33c1 Found XOR loop in file "5dD8fu8.exe" at offset 622993; code bytes = 8030 Found XOR loop in file "5dD8fu8.exe" at offset 625199; code bytes = 8030 Found XOR loop in file "5dD8fu8.exe" at offset 629564; code bytes = 8030 Found XOR loop in file "5dD8fu8.exe" at offset 632680; code bytes = 8030 Found XOR loop in file "5dD8fu8.exe" at offset 796692; code bytes = 8030 Found XOR loop in file "5dD8fu8.exe" at offset 811562; code bytes = 8030 Found XOR loop in file "5dD8fu8.exe" at offset 895011; code bytes = 8030 Found XOR loop in file "5dD8fu8.exe" at offset 922102; code bytes = 8030 Found XOR loop in file "5dD8fu8.exe" at offset 928028; code bytes = 8030 Found XOR loop in file "5dD8fu8.exe" at offset 932706; code bytes = 8030 Found XOR loop in file "5dD8fu8.exe" at offset 939683; code bytes = 8030 Found XOR loop in file "5dD8fu8.exe" at offset 940899; code bytes = 8030 Found XOR loop in file "4Ai174ie.exe" at offset 72323; code bytes = 30d0 Found XOR loop in file "4Ai174ie.exe" at offset 122082; code bytes = 30d0 Found XOR loop in file "4Ai174ie.exe" at offset 376916; code bytes = 30d0 Found XOR loop in file "4Ai174ie.exe" at offset 376937; code bytes = 30d0 Found XOR loop in file "4Ai174ie.exe" at offset 691258; code bytes = 30d0 Found XOR loop in file "4Ai174ie.exe" at offset 887915; code bytes = 30d0 Found XOR loop in file "4Ai174ie.exe" at offset 888929; code bytes = 30d0 Found XOR loop in file "4Ai174ie.exe" at offset 891921; code bytes = 30d0 Found XOR loop in file "4Ai174ie.exe" at offset 900833; code bytes = 30d0 Found XOR loop in file "4Ai174ie.exe" at offset 913601; code bytes = 30d0 Found XOR loop in file "4Ai174ie.exe" at offset 130790; code bytes = 33c1 Found XOR loop in file "4Ai174ie.exe" at offset 140043; code bytes = 33c1 Found XOR loop in file "4Ai174ie.exe" at offset 140172; code bytes = 33c1 Found XOR loop in file "4Ai174ie.exe" at offset 351053; code bytes = 33c1 Found XOR loop in file "4Ai174ie.exe" at offset 463773; code bytes = 33c1 Found XOR loop in file "4Ai174ie.exe" at offset 463848; code bytes = 33c1 Found XOR loop in file "4Ai174ie.exe" at offset 597022; code bytes = 33c1 Found XOR loop in file "4Ai174ie.exe" at offset 701978; code bytes = 33c1 Found XOR loop in file "4Ai174ie.exe" at offset 709317; code bytes = 33c1 Found XOR loop in file "4Ai174ie.exe" at offset 709765; code bytes = 33c1 Found XOR loop in file "4Ai174ie.exe" at offset 710341; code bytes = 33c1 Found XOR loop in file "4Ai174ie.exe" at offset 710789; code bytes = 33c1 Found XOR loop in file "4Ai174ie.exe" at offset 895349; code bytes = 33c1 Found XOR loop in file "4Ai174ie.exe" at offset 905289; code bytes = 33c1 Found XOR loop in file "4Ai174ie.exe" at offset 1330; code bytes = 8030 Found XOR loop in file "4Ai174ie.exe" at offset 1959; code bytes = 8030 Found XOR loop in file "4Ai174ie.exe" at offset 232120; code bytes = 8030 Found XOR loop in file "4Ai174ie.exe" at offset 356589; code bytes = 8030 Found XOR loop in file "4Ai174ie.exe" at offset 674772; code bytes = 8030 Found XOR loop in file "4Ai174ie.exe" at offset 687130; code bytes = 8030 Found XOR loop in file "4Ai174ie.exe" at offset 887876; code bytes = 8030 Found XOR loop in file "4Ai174ie.exe" at offset 890824; code bytes = 8030 Found XOR loop in file "4Ai174ie.exe" at offset 894056; code bytes = 8030 Found XOR loop in file "4Ai174ie.exe" at offset 913562; code bytes = 8030 Found XOR loop in file "3ct40Lc.exe" at offset 1293; code bytes = 30d0 Found XOR loop in file "3ct40Lc.exe" at offset 1173; code bytes = 8030 Found XOR loop in file "3ct40Lc.exe" at offset 24690; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A9901B8.bin" at offset 76665; code bytes = 30d0 Found XOR loop in file "DISMHOST.EXE.6A9901B8.bin" at offset 77648; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A9901B8.bin" at offset 77788; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A9901B8.bin" at offset 78978; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1274152; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1287765; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1485168; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1507775; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1514635; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1514887; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1515347; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1516553; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1521461; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1522625; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1538921; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 688249; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688345; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688444; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688500; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688526; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688604; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688747; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688843; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 689850; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 690446; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 764137; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 817238; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 817472; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 909588; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 924330; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 942350; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 948128; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 953465; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 953616; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 969842; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 971092; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 983876; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 985045; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 985160; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 989471; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 989786; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 990362; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 992172; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 992479; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 992865; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 992957; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 993612; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 995617; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 999815; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1000389; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1001271; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1001375; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1002055; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1002170; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1006463; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1007340; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1027259; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1033356; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1034159; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1289436; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1441388; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1505345; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1507059; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1513223; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 735579; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735612; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735686; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735764; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735781; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735802; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735842; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735923; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735946; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735963; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 736030; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 736068; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 736997; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 737018; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 833270; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 838380; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 845494; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 845523; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 857223; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 869347; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 869366; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 869863; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925121; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925175; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925196; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925223; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925256; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925280; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925297; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925319; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925429; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925471; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1337260; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1349610; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1362066; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1495860; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1517374; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1521442; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1522614; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1523404; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1537116; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1538890; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1274152; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1287765; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1485168; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1507775; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1514635; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1514887; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1515347; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1516553; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1521461; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1522625; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1538921; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688249; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688345; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688444; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688500; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688526; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688604; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688747; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688843; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 689850; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 690446; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 764137; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 817238; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 817472; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 909588; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 924330; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 942350; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 948128; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 953465; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 953616; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 969842; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 971092; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 983876; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 985045; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 985160; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 989471; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 989786; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 990362; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 992172; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 992479; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 992865; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 992957; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 993612; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 995617; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 999815; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1000389; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1001271; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1001375; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1002055; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1002170; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1006463; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1007340; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1027259; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1033356; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1034159; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1289436; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1441388; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1505345; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1507059; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1513223; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735579; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735612; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735686; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735764; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735781; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735802; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735842; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735923; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735946; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735963; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 736030; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 736068; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 736997; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 737018; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 833270; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 838380; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 845494; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 845523; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 857223; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 869347; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 869366; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 869863; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925121; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925175; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925196; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925223; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925256; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925280; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925297; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925319; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925429; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925471; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1337260; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1349610; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1362066; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1495860; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1517374; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1521442; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1522614; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1523404; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1537116; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1538890; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1274152; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1287765; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1485168; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1507775; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1514635; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1514887; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1515347; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1516553; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1521461; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1522625; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1538921; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688249; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688345; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688444; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688500; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688526; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688604; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688747; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688843; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 689850; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 690446; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 764137; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 817238; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 817472; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 909588; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 924330; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 942350; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 948128; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 953465; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 953616; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 969842; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 971092; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 983876; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 985045; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 985160; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 989471; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 989786; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 990362; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 992172; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 992479; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 992865; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 992957; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 993612; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 995617; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 999815; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1000389; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1001271; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1001375; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1002055; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1002170; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1006463; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1007340; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1027259; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1033356; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1034159; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1289436; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1441388; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1505345; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1507059; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1513223; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735579; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735612; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735686; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735764; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735781; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735802; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735842; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735923; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735946; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735963; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 736030; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 736068; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 736997; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 737018; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 833270; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 838380; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 845494; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 845523; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 857223; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 869347; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 869366; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 869863; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925121; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925175; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925196; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925223; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925256; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925280; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925297; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925319; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925429; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925471; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1337260; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1349610; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1362066; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1495860; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1517374; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1521442; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1522614; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1523404; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1537116; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1538890; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 433401; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 676555; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 855009; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 911781; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1026798; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1060599; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1079069; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1101066; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1138260; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1142290; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1221992; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1286024; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1347942; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1364267; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1405328; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1459978; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1493366; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1505157; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1624824; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1767149; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1811351; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1812270; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1868811; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 26031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 163376; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 269236; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 287716; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 453507; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 607295; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 615628; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 635819; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 662734; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 837688; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 859873; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 966742; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 987780; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1040865; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1061453; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1079267; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1094380; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1128446; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1138040; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1214375; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1258728; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1281990; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1283076; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1289849; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1360199; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1362731; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1440017; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1441057; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1462380; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1485220; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1609627; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1629588; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1707785; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1914633; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1972673; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1996711; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2003422; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2022329; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 90891; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 102399; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 103104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 203928; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 279428; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 387384; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 492116; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 588592; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 651807; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 652091; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 755848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 765213; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 780329; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 902200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 954327; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1058535; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1065632; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1067005; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1096314; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1114817; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1285970; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1428178; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1643644; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1655966; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1960217; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1964417; code bytes = 80302f:T553,file/memory contains long string with (Indicator: "GetCommandLine"; File: "DISMHOST.EXE.6A9901B8.bin") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp")30:T48c,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp")31:Tf65,Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00004408.00000002.82877.00EF7000.00000002.mdmp")32:T6c0,Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00004408.00000002.82877.00EF7000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00004408.00000002.82877.00EF7000.00000002.mdmp")33:T4e9,Found reference to API "SetupDiGetClassDevsA" (Indicator: "setupdigetclassdevs"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "SetupDiEnumDeviceInfo" (Indicator: "setupdienumdeviceinfo"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "SetupDiGetClassDevsA" (Indicator: "setupdigetclassdevs"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "SetupDiEnumDeviceInfo" (Indicator: "setupdienumdeviceinfo"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "SetupDiGetClassDevsA" (Indicator: "setupdigetclassdevs"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp") Found reference to API "SetupDiEnumDeviceInfo" (Indicator: "setupdienumdeviceinfo"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp")34:T48c,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp")35:T462,Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp")36:T3e22,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005928) "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005928) "Cz3Js38.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006132) "we4pZ94.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006096) "vz2Kg11.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004184) "vz2Kg11.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004184) "1sL92vc6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004408) "1sL92vc6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000001ab5bd1114d3160014d316001e755a7200000000e85136004cda160084010000000000000000000000000000f0d716005ecba7758401000000000000005da5754cda16000e5da575e4d51600dcaaa975010000000000000072000000ffffffffffffffff6cd316007802000000000000250000006cd316007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600ee48a411c4d316006d82aa76ac6d360004010000 (UID: 00000000-00004408) "1sL92vc6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005c0003000000000000000200000028a8360080313500e86c2e003200020001000000bc0200000e0000000000000000000000883135008a0200000d000000b0712e0005000000000000003200000008b03600e4be1600cc416b7728a8360028000000fc000000ff2b6a7777837677d8eb3477ac012e0000002e002c002000010000000000ffffa703000004000000010000002d001b000100000002000000010000000000000000000000f86f2e00f807000020000000000000000000000080313500e86c2e00086e2e0008a93600b0712e000000000060be160000000000e0bf1600 (UID: 00000000-00004408) "1sL92vc6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff2d000d0004000000620ba77500000000f86f2e000000000050000000bca036000200000050633900000000000100000898b0360020742e00380ba775f8d1160002000000acd216003f08d6760200000050633900000000000100001888fbd5769cd21600c81ca97572d4160095fbd576d0d316005063390000000000000000000000000058d3160000002e007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600b249a41118d316006d82aa76ac6d360004010000 (UID: 00000000-00004408) "1sL92vc6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036005a57a41130cc16006d82aa76b426380004010000 (UID: 00000000-00004408) "1sL92vc6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000e86f3900c82f2e00a9220000c8c5160067e5677700002e00883538000000000000002e000000000088353800000000002f22000d0000000060393800e86f3900702a3800003b000000002e00000000008835380000002e0048323800000000003400013553fb76770000000000002e00783738000000000000002e000000100048323800f0c6160004646a777b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600065da4116cc616006d82aa76242b380004010000 (UID: 00000000-00004408) "1sL92vc6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000160098cfdb75a033a775fe57a7750540008004e016000000000043003a005c00550073006500720073005c0048004100500055004200570053000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600625ba41148c016006d82aa7664a4380004010000 (UID: 00000000-00004408) "1sL92vc6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003900f83b0000ff07000000002e00000000007f070000c4002e00c82f2e009f800000b8bf160067e5677700002e00e88a39000000000000002e0000000000e88a3900000000004b8000cb80000000908d3900c4002e0050993800003b000000002e0000000000e88a3900201f000000002e00e0873900f83b0000ff07000000002e00000000007f070000c4002e007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600625ba41148c016006d82aa76f487390004010000 (UID: 00000000-00004408) "1sL92vc6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003900f83b0000ff07000000002e00000000007f070000c4002e00c82f2e005a800000b8bf160067e5677700002e00108d39000000000000002e0000000000108d3900000000000680008680000000b88f3900c4002e0050993800003b000000002e0000000000108d3900201f000000002e00088a3900f83b0000ff07000000002e00000000007f070000c4002e007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600625ba41148c016006d82aa76f488390004010000 (UID: 00000000-00004408) "1sL92vc6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003900f83b0000ff07000000002e00000000007f070000c4002e00c82f2e003a800000b8bf160067e5677700002e00108e39000000000000002e0000000000108e390000000000e67f009980000000b8903900c4002e0050993800003b000000002e0000000000108e3900201f000000002e00088b3900f83b0000ff07000000002e00000000007f070000c4002e007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600625ba41148c016006d82aa76948a390004010000 (UID: 00000000-00004408) "1sL92vc6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003900f83b0000ff07000000002e00000000007f070000c4002e00c82f2e0006800000b8bf160067e5677700002e00b08f39000000000000002e0000000000b08f390000000000b27f00cd8000000058923900c4002e0038a63800003b000000002e0000000000b08f3900201f000000002e00a88c3900f83b0000ff07000000002e00000000007f070000c4002e007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600625ba41148c016006d82aa76c48b390004010000 (UID: 00000000-00004408) "1sL92vc6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003900f83b0000ff07000000002e00000000007f070000c4002e00c82f2e00e07f0000b8bf160067e5677700002e00e09039000000000000002e0000000000e0903900000000008c7f00f38000000088933900c4002e0038a63800003b000000002e0000000000e0903900201f000000002e00d88d3900f83b0000ff07000000002e00000000007f070000c4002e007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600625ba41148c016006d82aa76ec8c390004010000 (UID: 00000000-00004408) "1sL92vc6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003900f83b0000ff07000000002e00000000007f070000c4002e00c82f2e00bb7f0000b8bf160067e5677700002e00089239000000000000002e00000000000892390000000000677f001880000000b0943900c4002e0038a63800003b000000002e000000000008923900201f000000002e00008f3900f83b0000ff07000000002e00000000007f070000c4002e007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600625ba41148c016006d82aa761c8e390004010000 (UID: 00000000-00004408) "1sL92vc6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003900f83b0000ff07000000002e00000000007f070000c4002e00c82f2e00957f0000b8bf160067e5677700002e00389339000000000000002e00000000003893390000000000417f003e80000000e0953900c4002e0038a63800003b000000002e000000000038933900201f000000002e0030903900f83b0000ff07000000002e00000000007f070000c4002e007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600625ba41148c016006d82aa764c8f390004010000 (UID: 00000000-00004408) "1sL92vc6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003900f83b0000ff07000000002e00000000007f070000c4002e00c82f2e006f7f0000b8bf160067e5677700002e00689439000000000000002e000000000068943900000000001b7f00648000000010973900c4002e0038a63800003b000000002e000000000068943900201f000000002e0060913900f83b0000ff07000000002e00000000007f070000c4002e007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600625ba41148c016006d82aa767490390004010000 (UID: 00000000-00004408) "1sL92vc6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003900f83b0000ff07000000002e00000000007f070000c4002e00c82f2e004a7f0000b8bf160067e5677700002e00909539000000000000002e00000000009095390000000000f67e00888000000038983900c4002e0038a63800003b000000002e000000000090953900201f000000002e0088923900f83b0000ff07000000002e00000000007f070000c4002e007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600625ba41148c016006d82aa76ac91390004010000 (UID: 00000000-00004408) "1sL92vc6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000b6aebd1168c9160068c916001e755a720000000030683a00a0d016001c02000000000000000000000000000044ce16005ecba7751c02000000000000005da575a0d016000e5da57538cc1600dcaaa975010000000000000072000000ffffffffffffffffc0c91600780200000000000025000000c0c916007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600b252a41118ca16006d82aa7664043a0004010000 (UID: 00000000-00004408) "1sL92vc6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff1500990156000000620ba77500000000f86f2e000000000050000000bca0360002000000506339000000000001000008f8bc360020742e00380ba7754cc816000200000000c916003f08d6760200000050633900000000000100001888fbd576f0c81600c81ca975c6ca160095fbd57624ca160050633900000000000000000000000000acc9160000002e007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036000652a4116cc916006d82aa7664043a0004010000 (UID: 00000000-00004408) "1sL92vc6.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036002e59a41184c216006d82aa7624103a0004010000 (UID: 00000000-00004408)37:T574,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Cz3Js38.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Cz3Js38.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "we4pZ94.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "we4pZ94.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "vz2Kg11.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "vz2Kg11.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1sL92vc6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1sL92vc6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "OfficeTrackerNMP131.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")38:T48c,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp")39:Ta4a,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005928) "Cz3Js38.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00006132) "we4pZ94.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00006096) "vz2Kg11.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00004184) "vz2Kg11.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004184) "1sL92vc6.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004408) "1sL92vc6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004408) "1sL92vc6.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00004408) "1sL92vc6.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004408) "1sL92vc6.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004408) "1sL92vc6.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00004408) "1sL92vc6.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004408) "1sL92vc6.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00004408) "1sL92vc6.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00004408) "1sL92vc6.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004408) "1sL92vc6.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004408) "1sL92vc6.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00004408) "1sL92vc6.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00004408) "1sL92vc6.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00004408) "1sL92vc6.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00004408) "1sL92vc6.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004408) "1sL92vc6.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00004408) "1sL92vc6.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004408) "1sL92vc6.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004408) "1sL92vc6.exe" called "LoadLibrary" with a parameter WININET.DLL (UID: 00000000-00004408) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00006060) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00000696)3a:T2bc1,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005928) "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005928) "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005928) "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005928) "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005928) "Cz3Js38.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006132) "Cz3Js38.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00006132) "we4pZ94.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00006096) "vz2Kg11.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00004184) "vz2Kg11.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004184) "vz2Kg11.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004184) "vz2Kg11.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004184) "vz2Kg11.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004184) "vz2Kg11.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00004184) "vz2Kg11.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004184) "1sL92vc6.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CreateLinkInfoW (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter IsCharAlphaW (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CharPrevW (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter GetNetResourceFromLocalPathW (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter NetShareEnum (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CscNetApiGetInterface (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter SLGetWindowsInformationDWORD (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecW (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CharNextW (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter DestroyLinkInfo (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter O/ (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter O (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter ?/ (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter ? (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00004408) "1sL92vc6.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00004408) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006060) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00006060) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000696) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000696) "schtasks.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000696) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000696) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00000696) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002748) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002748) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002748) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002748)3b:T1922,"CREATE TABLE sqlite_master(" (Source: 00000000-00002748.00000002.84972.00E17000.00000002.mdmp, Indicator: "create table sqlite_master(") "CREATE TABLE" (Source: 00000000-00002748.00000002.84972.00E17000.00000002.mdmp, Indicator: "create table") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 00000000-00002748.00000002.84972.00E17000.00000002.mdmp, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00002748.00000002.84972.00E17000.00000002.mdmp, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 00000000-00002748.00000002.84972.00E17000.00000002.mdmp, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00002748.00000002.84972.00E17000.00000002.mdmp, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 00000000-00002748.00000002.84972.00E17000.00000002.mdmp, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 00000000-00002748.00000002.84972.00E17000.00000002.mdmp, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 00000000-00002748.00000002.84972.00E17000.00000002.mdmp, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 00000000-00002748.00000002.84972.00E17000.00000002.mdmp, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 00000000-00002748.00000002.84972.00E17000.00000002.mdmp, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 00000000-00002748.00000002.84972.00E17000.00000002.mdmp, Indicator: "select name rootpage sql from '%q'.%s"), "UPDATE %Q.%s SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 00000000-00002748.00000002.84972.00E17000.00000002.mdmp, Indicator: "update %q.%s set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d"), "CREATE TABLE" (Source: 00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp, Indicator: "create table"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigg" (Source: 00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigg"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%" (Source: 00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%") "DELETE FROM %Q.%s WHERE name=%Q" (Source: 00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp, Indicator: "delete from %q.%s where name=%q") "DELETE FROM" (Source: 00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, Indicator: "delete from") "CREATE TABLE sqlite_master(" (Source: 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp, Indicator: "create table sqlite_master(") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'")3c:T53c,Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.00EF7000.00000002.mdmp")3d:Tc49,":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002748.00000000.81128.00300000.00000004.mdmp 00000000-00002748.00000001.83050.00300000.00000004.mdmp 00000000-00002748.00000002.84972.00300000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00004408.00000000.79030.002E0000.00000004.mdmp 00000000-00004408.00000000.79030.00520000.00000002.mdmp 00000000-00004408.00000001.80954.002E0000.00000004.mdmp 00000000-00004408.00000002.82877.002E0000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00004408.00000000.79030.002E0000.00000004.mdmp 00000000-00004408.00000000.79030.00520000.00000002.mdmp 00000000-00004408.00000001.80954.002E0000.00000004.mdmp 00000000-00004408.00000002.82877.002E0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00004408.00000000.79030.002E0000.00000004.mdmp 00000000-00004408.00000001.80954.002E0000.00000004.mdmp 00000000-00004408.00000002.82877.002E0000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00004408.00000000.79030.002E0000.00000004.mdmp 00000000-00004408.00000001.80954.002E0000.00000004.mdmp 00000000-00004408.00000002.82877.002E0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00004408.00000000.79030.002E0000.00000004.mdmp 00000000-00004408.00000001.80954.002E0000.00000004.mdmp 00000000-00004408.00000002.82877.002E0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\fanbooster131.lnk") in Source: 00000000-00004408.00000000.79030.002E0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\fanbooster131.lnk") in Source: 00000000-00004408.00000001.80954.002E0000.00000004.mdmp 00000000-00004408.00000002.82877.002E0000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00004408.00000001.80954.0039B000.00000004.mdmp 00000000-00004408.00000002.82877.0039B000.00000004.mdmp3e:T4fc,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Cz3Js38.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "2cG0873.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "we4pZ94.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "vz2Kg11.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "5dD8fu8.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "DISMHOST.EXE.6A9901B8.bin" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE3f:T13b8,"Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002748.00000000.81128.00300000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002748.00000000.81128.00300000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002748.00000000.81128.00300000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002748.00000000.81128.00300000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002748.00000001.83050.00300000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002748.00000001.83050.00300000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002748.00000001.83050.00300000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002748.00000001.83050.00300000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002748.00000002.84972.00300000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002748.00000002.84972.00300000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002748.00000002.84972.00300000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002748.00000002.84972.00300000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00004184.00000001.80890.00991000.00000020.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004408.00000000.79030.002E0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004408.00000000.79030.002E0000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004408.00000000.79030.002E0000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004408.00000000.79030.002E0000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004408.00000001.80954.002E0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004408.00000001.80954.002E0000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004408.00000001.80954.002E0000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004408.00000001.80954.002E0000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004408.00000002.82877.002E0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004408.00000002.82877.002E0000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004408.00000002.82877.002E0000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004408.00000002.82877.002E0000.00000004.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004888.00000001.83267.00751000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005928.00000000.78803.00EB1000.00000020.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00006096.00000000.78920.00310000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00006096.00000000.78920.011A1000.00000020.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00006096.00000002.82768.00310000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00006132.00000000.78876.00D41000.00000020.mdmp40:Td6f,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73440000 "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75400000 "Cz3Js38.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72500000 "Cz3Js38.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75400000 "we4pZ94.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6e6c0000 "we4pZ94.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75400000 "vz2Kg11.exe" loaded module "FECLIENT.DLL" at base 73470000 "vz2Kg11.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73420000 "vz2Kg11.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75400000 "1sL92vc6.exe" loaded module "ADVAPI32.DLL" at base 769e0000 "1sL92vc6.exe" loaded module "KERNEL32.DLL" at base 76d10000 "1sL92vc6.exe" loaded module "CRYPTBASE.DLL" at base 75450000 "1sL92vc6.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74050000 "1sL92vc6.exe" loaded module "CLBCATQ.DLL" at base 76c80000 "1sL92vc6.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 759f0000 "1sL92vc6.exe" loaded module "PROPSYS.DLL" at base 740a0000 "1sL92vc6.exe" loaded module "OLE32.DLL" at base 75890000 "1sL92vc6.exe" loaded module "COMCTL32.DLL" at base 74450000 "1sL92vc6.exe" loaded module "OLEAUT32.DLL" at base 76940000 "1sL92vc6.exe" loaded module "SETUPAPI.DLL" at base 76f50000 "1sL92vc6.exe" loaded module "RPCRT4.DLL" at base 77360000 "1sL92vc6.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 740a0000 "1sL92vc6.exe" loaded module "NTMARTA.DLL" at base 749c0000 "1sL92vc6.exe" loaded module "SHELL32.DLL" at base 759f0000 "1sL92vc6.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 777d0000 "1sL92vc6.exe" loaded module "PROFAPI.DLL" at base 75570000 "1sL92vc6.exe" loaded module "APPHELP.DLL" at base 75400000 "1sL92vc6.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6e890000 "1sL92vc6.exe" loaded module "LINKINFO.DLL" at base 70320000 "1sL92vc6.exe" loaded module "USER32.DLL" at base 77240000 "1sL92vc6.exe" loaded module "NTSHRUI.DLL" at base 71fc0000 "1sL92vc6.exe" loaded module "SRVCLI.DLL" at base 75150000 "1sL92vc6.exe" loaded module "CSCAPI.DLL" at base 70a90000 "1sL92vc6.exe" loaded module "SLC.DLL" at base 73910000 "1sL92vc6.exe" loaded module "SHLWAPI.DLL" at base 76a90000 "1sL92vc6.exe" loaded module "SSPICLI.DLL" at base 753e0000 "1sL92vc6.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75400000 "1sL92vc6.exe" loaded module "WINHTTP.DLL" at base 70de0000 "1sL92vc6.exe" loaded module "WININET.DLL" at base 76640000 "1sL92vc6.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74f20000 "1sL92vc6.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74a80000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 769e0000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 753e0000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 777d0000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 73d80000 "OfficeTrackerNMP131.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72530000 "OfficeTrackerNMP131.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74a80000 "OfficeTrackerNMP131.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74f2000041:Tff3,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3" was detected as "Microsoft Cabinet" and name: "sfx" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3" was detected as "Microsoft Visual C/C++" and name: "Compiler" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3" was detected as "Microsoft Cabinet File" and name: "Archive" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3" was detected as "Microsoft Linker" and name: "Linker" "Cz3Js38.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Cz3Js38.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Cz3Js38.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Cz3Js38.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Cz3Js38.exe" was detected as "Microsoft Linker" and name: "Linker" "1sL92vc6.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1sL92vc6.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1sL92vc6.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1sL92vc6.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1sL92vc6.exe" was detected as "Microsoft Linker" and name: "Linker" "2cG0873.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2cG0873.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2cG0873.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2cG0873.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2cG0873.exe" was detected as "Microsoft Linker" and name: "Linker" "we4pZ94.exe" was detected as "Microsoft Cabinet" and name: "sfx" "we4pZ94.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "we4pZ94.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "we4pZ94.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "we4pZ94.exe" was detected as "Microsoft Linker" and name: "Linker" "vz2Kg11.exe" was detected as "Microsoft Cabinet" and name: "sfx" "vz2Kg11.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "vz2Kg11.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "vz2Kg11.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "vz2Kg11.exe" was detected as "Microsoft Linker" and name: "Linker" "5dD8fu8.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5dD8fu8.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5dD8fu8.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5dD8fu8.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5dD8fu8.exe" was detected as "Microsoft Linker" and name: "Linker" "4Ai174ie.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4Ai174ie.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4Ai174ie.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4Ai174ie.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4Ai174ie.exe" was detected as "Microsoft Linker" and name: "Linker" "3ct40Lc.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3ct40Lc.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3ct40Lc.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3ct40Lc.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3ct40Lc.exe" was detected as "Microsoft Linker" and name: "Linker" "DISMHOST.EXE.6A9901B8.bin" was detected as "Microsoft Cabinet" and name: "sfx" "DISMHOST.EXE.6A9901B8.bin" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "DISMHOST.EXE.6A9901B8.bin" was detected as "Microsoft Visual C/C++" and name: "Compiler" "DISMHOST.EXE.6A9901B8.bin" was detected as "Microsoft Cabinet File" and name: "Archive" "DISMHOST.EXE.6A9901B8.bin" was detected as "Microsoft Linker" and name: "Linker"42:T15f2,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Cz3Js38.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "1sL92vc6.exe" file has an entrypoint instructions - "call 0x4e6d12,jmp 0x4e64df,cmp ecx, dword ptr [0x56d048],jne 0x4e666e,ret ,jmp 0x4e6e45,push ebp,mov ebp, esp,and dword ptr [0x56f3d0], 0,sub esp, 0x24,or dword ptr [0x56d050], 1,push 0xa,call dword ptr [0x5370d8],test eax, eax,je 0x4e6843,and dword ptr [ebp - 0x10], 0,xor eax, eax,push ebx,push esi,push edi,xor ecx, ecx,lea edi, [ebp - 0x24],push ebx,cpuid ,mov esi, ebx,pop ebx,nop ,mov dword ptr [edi], eax,mov dword ptr [edi + 4], esi,mov dword ptr [edi + 8], ecx,xor ecx, ecx,mov dword ptr [edi + 0xc], edx,mov eax, dword ptr [ebp - 0x24],mov edi, dword ptr [ebp - 0x20]," "2cG0873.exe" file has an entrypoint instructions - "jmp 0x415f30,jmp 0x46b9b9,jmp 0x44a550,jmp 0x4364c9,jmp 0x4209c7,jmp 0x4a87f0,jmp 0x436a6a,jmp 0x46c75a,jmp 0x4a377a,jmp 0x41c05f,jmp 0x416984,jmp 0x452ee7,jmp 0x42c224,jmp 0x459d4b,jmp 0x41cc67,jmp 0x419015,jmp 0x492f8b,jmp 0x40de90,jmp 0x466efc,jmp 0x4838f0," "we4pZ94.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "vz2Kg11.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "5dD8fu8.exe" file has an entrypoint instructions - "jmp 0x415f30,jmp 0x46b9b9,jmp 0x44a550,jmp 0x4364c9,jmp 0x4209c7,jmp 0x4a87f0,jmp 0x436a6a,jmp 0x46c75a,jmp 0x4a377a,jmp 0x41c05f,jmp 0x416984,jmp 0x452ee7,jmp 0x42c224,jmp 0x459d4b,jmp 0x41cc67,jmp 0x419015,jmp 0x492f8b,jmp 0x40de90,jmp 0x466efc,jmp 0x4838f0," "4Ai174ie.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "3ct40Lc.exe" file has an entrypoint instructions - "call 0x4032e6,jne 0x4032ed,je 0x4032ed,test eax, 0xeb5b9ba5,or al, byte ptr [ecx + eax*4 - 0x15],out 0x32, al,add byte ptr [eax], al,jmp 0x4032fe,and ch, bl,cmc ,inc esp,and dh, byte ptr [esi + eax + 0x75],add al, 0x94,push ss,xor dword ptr [ecx - 0x3dbbb39], ebx,xor byte ptr [eax], al,add byte ptr [eax], al,sub esp, 4,jne 0x403317,je 0x403317,dec ebp,lahf ,mov edx, dword ptr [esp],add esp, 4,jmp 0x403325,mov byte ptr [ecx], ch,shr bl, 5,test al, 0xeb,stc ,mov byte ptr [eax - 0x4373fa15], ch,shr bl, 1,pop es,add eax, dword ptr fs:[edx],je 0x40333c,jne 0x40333c,jb 0x40337c,and dh, byte ptr [esi],in eax, dx,push dword ptr [eax + 0xa4],jne 0x403349," "DISMHOST.EXE.6A9901B8.bin" file has an entrypoint instructions - "call 0x100a7e6,jmp 0x10097f4,int3 ,int3 ,int3 ,int3 ,int3 ,push 0x14,push 0x1010878,call 0x1009d10,and dword ptr [ebp - 4], 0,dec dword ptr [ebp + 0x10],js 0x1009afc,mov ecx, dword ptr [ebp + 8],sub ecx, dword ptr [ebp + 0xc],mov dword ptr [ebp + 8], ecx,call dword ptr [ebp + 0x14],jmp 0x1009abc,mov eax, dword ptr [ebp - 0x14],mov dword ptr [ebp - 0x1c], eax,mov eax, dword ptr [ebp - 0x1c],mov eax, dword ptr [eax],mov dword ptr [ebp - 0x20], eax,mov eax, dword ptr [ebp - 0x20],cmp dword ptr [eax], 0xe06d7363,je 0x1009af3,mov dword ptr [ebp - 0x24], 0,mov eax, dword ptr [ebp - 0x24],ret ,call dword ptr [0x1001210],mov esp, dword ptr [ebp - 0x18],"43:T4ce,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Cz3Js38.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Cz3Js38.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "we4pZ94.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "we4pZ94.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "vz2Kg11.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "vz2Kg11.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1sL92vc6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1sL92vc6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "OfficeTrackerNMP131.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "OfficeTrackerNMP131.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")44:T45a,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00006096.000017D0.700016.00050000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00005928-00000C2B-236390251] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00005928-00000BC1-236629702] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00006132-00000BC1-237398002] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00006096-00000BC1-238115632] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00004184-00000BC1-239057458] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00004408-00000C2B-239825551] Observed system executable string:"%WINDIR%\System32\shdocvw.dll" [Source: 00000000-00004408-00000C2B-242375395]45:Tb3f,"Cz3Js38.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\Cz3Js38.exe]- [targetUID: 00000000-00006132] "1sL92vc6.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1sL92vc6.exe]- [targetUID: 00000000-00004408] "2cG0873.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 8 sections"- Location: [%TEMP%\IXP003.TMP\2cG0873.exe]- [targetUID: 00000000-00004184] "we4pZ94.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\we4pZ94.exe]- [targetUID: 00000000-00006096] "vz2Kg11.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\vz2Kg11.exe]- [targetUID: 00000000-00006096] "5dD8fu8.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 8 sections"- Location: [%TEMP%\IXP000.TMP\5dD8fu8.exe]- [targetUID: 00000000-00005928] "4Ai174ie.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4Ai174ie.exe]- [targetUID: 00000000-00006132] "3ct40Lc.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\3ct40Lc.exe]- [targetUID: 00000000-00006096] "FANBooster131.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Unicoded MachineID hapubws-pc KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive NeedIndexed ctime=Thu Sep 3 01:01:50 2026 atime=Thu Sep 3 01:01:50 2026 mtime=Wed Nov 29 03:08:40 2023 length=1539712 window=normal IDListSize 0x01f6 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00004408] "dism.log" has type "Unicode text UTF-8 (with BOM) text with very long lines (312) with CRLF line terminators"- [targetUID: N/A] "DISMHOST.EXE.6A9901B8.bin" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A] "rise131M9Asphalt.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\rise131M9Asphalt.tmp]- [targetUID: 00000000-00004408] "FANBooster131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00004408] "OfficeTrackerNMP131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00004408] "MaxLoonaFest131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00004408]46:Tadb,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "")47:Tfff,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "87252D3C1DE3DCEFBD12DE44B7345B00B9BDACE2E4B5F00D02D197078CF8E9C3"; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "")48:T444,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to retrieve information set for devices (API string) Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Reference to an external IP address lookup service identified Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to query volume size Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: YARA signature match - References common sandbox DLLs (sandbox evasion)49:Tc9a,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe.Local\" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\Cabinet.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\VERSION.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\SspiCli.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\WINSPOOL.DRV" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\MPR.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\Windows\system32\MPR.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\UxTheme.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\WINMM.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\samcli.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\Windows\system32\samcli.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\MSACM32.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to touch file "C:\Windows\system32\MSACM32.dll"4a:Td0d,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\Cabinet.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\VERSION.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\SspiCli.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\MPR.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\UxTheme.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\WINMM.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\samcli.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\MSACM32.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\sfc.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\sfc_os.DLL" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\dwmapi.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Cz3Js38.exe" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\FLTLIB.DLL" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\MSVCP140.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\ucrtbase.DLL" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll"4b:T87a,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe.Local\" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe.Config" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\87252D3C1DE3DCEFBD12DE44B7345B00B9BDACE2E4B5F00D02D197078CF8E9C3.EXE.LOCAL" "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" trying to access non-existent file "C:\87252D3C1DE3DCEFBD12DE44B7345B00B9BDACE2E4B5F00D02D197078CF8E9C3.EXE.CONFIG" "Cz3Js38.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Cz3Js38.exe.Local\" "Cz3Js38.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "Cz3Js38.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Cz3Js38.exe.Config" "Cz3Js38.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "Cz3Js38.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CZ3JS38.EXE.LOCAL" "Cz3Js38.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CZ3JS38.EXE.CONFIG" "we4pZ94.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\we4pZ94.exe.Local\" "we4pZ94.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "we4pZ94.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\we4pZ94.exe.Config" "we4pZ94.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"4c:T487,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3")4d:Tbc7,Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "gethostname" (Indicator: "gethostname"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00002748.00000000.81128.00E60000.00000002.mdmp, 00000000-00002748.00000001.83050.00E60000.00000002.mdmp, 00000000-00002748.00000002.84972.00E60000.00000002.mdmp") Found reference to API "LL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00002748.00000000.81128.00E60000.00000002.mdmp, 00000000-00002748.00000001.83050.00E60000.00000002.mdmp, 00000000-00002748.00000002.84972.00E60000.00000002.mdmp") Found reference to API "Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement." (Indicator: " accept "; Source: "00000000-00004184.00000000.78965.0099A000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00004184.00000000.78965.00C50000.00000002.mdmp, 00000000-00004184.00000001.80890.00C50000.00000002.mdmp, 00000000-00004184.00000002.82812.00C50000.00000002.mdmp") Found reference to API "LL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00004184.00000000.78965.00C50000.00000002.mdmp, 00000000-00004184.00000001.80890.00C50000.00000002.mdmp, 00000000-00004184.00000002.82812.00C50000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00004408.00000000.79030.010D0000.00000002.mdmp, 00000000-00004408.00000001.80954.010D0000.00000002.mdmp, 00000000-00004408.00000002.82877.010D0000.00000002.mdmp") Found reference to API "LL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00004408.00000000.79030.010D0000.00000002.mdmp, 00000000-00004408.00000001.80954.010D0000.00000002.mdmp, 00000000-00004408.00000002.82877.010D0000.00000002.mdmp")4e:T16d3,Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localtemp=c:\users\hapubws\appdata\local\tempcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey1" - Source: "00000000-00002748.00000000.81128.00300000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00002748.00000000.81128.00300000.00000004.mdmp") Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localtemp=c:\users\hapubws\appdata\local\tempcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey1" - Source: "00000000-00002748.00000001.83050.00300000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00002748.00000001.83050.00300000.00000004.mdmp") Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localtemp=c:\users\hapubws\appdata\local\tempcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey1" - Source: "00000000-00002748.00000002.84972.00300000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00002748.00000002.84972.00300000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00002748.00000002.84972.00E17000.00000002.mdmp") Found URL "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%symantec" - Source: "00000000-00004184.00000000.78965.00340000.00000004.mdmp") Found URL "http://ts-ocsp.ws.symantec.com07+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<50301+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(timestamp-2048-20b07x,&c3\vno^efany3+." - Source: "00000000-00004184.00000000.78965.00340000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0kd0b070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0fuscdigicert" - Source: "00000000-00004184.00000000.78965.00340000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0oh0f080*0(https://www.digicert.com/cps0," - Source: "00000000-00004184.00000000.78965.00340000.00000004.mdmp") Found URL "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%symantec" - Source: "00000000-00004184.00000002.82812.00340000.00000004.mdmp") Found URL "http://ts-ocsp.ws.symantec.com07+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<50301+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(timestamp-2048-20b07x,&c3\vno^efany3+." - Source: "00000000-00004184.00000002.82812.00340000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0kd0b070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0fuscdigicert" - Source: "00000000-00004184.00000002.82812.00340000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0oh0f080*0(https://www.digicert.com/cps0," - Source: "00000000-00004184.00000002.82812.00340000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp") Found URL "https://t.me/riseprosupport:%g0appdata=c:\users\hapubws\appdata\roaming" - Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00004408.00000001.80954.002E0000.00000004.mdmp") Found URL "https://t.me/riseprosupport:%g0appdata=c:\users\hapubws\appdata\roaming" - Source: "00000000-00004408.00000001.80954.002E0000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00004408.00000001.80954.002E0000.00000004.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00004408.00000001.80954.002E0000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00004408.00000002.82877.002E0000.00000004.mdmp") Found URL "https://t.me/riseprosupport:%g0appdata=c:\users\hapubws\appdata\roaming" - Source: "00000000-00004408.00000002.82877.002E0000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00004408.00000002.82877.002E0000.00000004.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00004408.00000002.82877.002E0000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00004408.00000002.82877.00EF7000.00000002.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00004408.00000002.82877.00EF7000.00000002.mdmp")4f:T488,Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3")50:Ta4c,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00005928) "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005928) "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" called "FindNextFileW" with parameter 5dD8fu8.exe (UID: 00000000-00005928) "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" called "FindNextFileW" with parameter Cz3Js38.exe (UID: 00000000-00005928) "Cz3Js38.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00006132) "Cz3Js38.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006132) "Cz3Js38.exe" called "FindNextFileW" with parameter 4Ai174ie.exe (UID: 00000000-00006132) "Cz3Js38.exe" called "FindNextFileW" with parameter we4pZ94.exe (UID: 00000000-00006132) "we4pZ94.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00006096) "we4pZ94.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006096) "we4pZ94.exe" called "FindNextFileW" with parameter 3ct40Lc.exe (UID: 00000000-00006096) "we4pZ94.exe" called "FindNextFileW" with parameter vz2Kg11.exe (UID: 00000000-00006096) "vz2Kg11.exe" called "FindFirstFileW" with parameter %TEMP%\IXP003.TMP\*.* (UID: 00000000-00004184) "vz2Kg11.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004184) "vz2Kg11.exe" called "FindNextFileW" with parameter 1sL92vc6.exe (UID: 00000000-00004184) "vz2Kg11.exe" called "FindNextFileW" with parameter 2cG0873.exe (UID: 00000000-00004184) "1sL92vc6.exe" called "FindFirstFileW" with parameter %WINDIR%\System32\*.* (UID: 00000000-00004408) "1sL92vc6.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004408) "1sL92vc6.exe" called "FindNextFileW" with parameter 0409 (UID: 00000000-00004408) "1sL92vc6.exe" called "FindNextFileW" with parameter 12520437.cpx (UID: 00000000-00004408) "1sL92vc6.exe" called "FindNextFileW" with parameter 12520850.cpx (UID: 00000000-00004408) "1sL92vc6.exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00004408) "1sL92vc6.exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00004408) "1sL92vc6.exe" called "FindNextFileW" with parameter aaclient.dll (UID: 00000000-00004408) "1sL92vc6.exe" called "FindNextFileW" with parameter accessibilitycpl.dll (UID: 00000000-00004408)51:T6a8,"Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002748.00000000.81128.00300000.00000004.mdmp 00000000-00002748.00000001.83050.00300000.00000004.mdmp 00000000-00002748.00000002.84972.00300000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002748.00000000.81128.00300000.00000004.mdmp 00000000-00002748.00000001.83050.00300000.00000004.mdmp 00000000-00002748.00000002.84972.00300000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002748.00000000.81128.00300000.00000004.mdmp 00000000-00002748.00000001.83050.00300000.00000004.mdmp 00000000-00002748.00000002.84972.00300000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004408.00000000.79030.002E0000.00000004.mdmp 00000000-00004408.00000001.80954.002E0000.00000004.mdmp 00000000-00004408.00000002.82877.002E0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004408.00000000.79030.002E0000.00000004.mdmp 00000000-00004408.00000001.80954.002E0000.00000004.mdmp 00000000-00004408.00000002.82877.002E0000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004408.00000000.79030.002E0000.00000004.mdmp 00000000-00004408.00000001.80954.002E0000.00000004.mdmp 00000000-00004408.00000002.82877.002E0000.00000004.mdmp52:T1845,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002748.00000000.81128.00300000.00000004.mdmp, 00000000-00002748.00000001.83050.00300000.00000004.mdmp, 00000000-00002748.00000002.84972.00300000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002748.00000000.81128.00300000.00000004.mdmp, 00000000-00002748.00000001.83050.00300000.00000004.mdmp, 00000000-00002748.00000002.84972.00300000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002748.00000000.81128.00300000.00000004.mdmp, 00000000-00002748.00000001.83050.00300000.00000004.mdmp, 00000000-00002748.00000002.84972.00300000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002748.00000000.81128.00300000.00000004.mdmp, 00000000-00002748.00000001.83050.00300000.00000004.mdmp, 00000000-00002748.00000002.84972.00300000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002748.00000000.81128.00300000.00000004.mdmp, 00000000-00002748.00000001.83050.00300000.00000004.mdmp, 00000000-00002748.00000002.84972.00300000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002748.00000000.81128.00300000.00000004.mdmp, 00000000-00002748.00000001.83050.00300000.00000004.mdmp, 00000000-00002748.00000002.84972.00300000.00000004.mdmp") Found string "\Device\HarddiskVolume2\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" (Indicator: "\Device\"; Source: "00000000-00002748.00000000.81128.00300000.00000004.mdmp, 00000000-00002748.00000001.83050.00300000.00000004.mdmp, 00000000-00002748.00000002.84972.00300000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}] DATAGRAM 2" (Indicator: "\Device\"; Source: "00000000-00002748.00000001.83050.00300000.00000004.mdmp, 00000000-00002748.00000002.84972.00300000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00004184.00000000.78965.00340000.00000004.mdmp, 00000000-00004184.00000002.82812.00340000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00004184.00000000.78965.00340000.00000004.mdmp, 00000000-00004184.00000002.82812.00340000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00004184.00000000.78965.00340000.00000004.mdmp, 00000000-00004184.00000002.82812.00340000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00004184.00000000.78965.00340000.00000004.mdmp, 00000000-00004184.00000002.82812.00340000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00004184.00000000.78965.00340000.00000004.mdmp, 00000000-00004184.00000002.82812.00340000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004184.00000000.78965.00340000.00000004.mdmp, 00000000-00004184.00000002.82812.00340000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP002.TMP\vz2Kg11.exe" (Indicator: "\Device\"; Source: "00000000-00004184.00000000.78965.00340000.00000004.mdmp, 00000000-00004184.00000002.82812.00340000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP003.TMP\1sL92vc6.exe" (Indicator: "\Device\"; Source: "00000000-00004408.00000000.79030.002E0000.00000004.mdmp, 00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}] DATAGRAM 2" (Indicator: "\Device\"; Source: "00000000-00004408.00000001.80954.002E0000.00000004.mdmp, 00000000-00004408.00000002.82877.002E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Temp\62466A67-D71C-4BB8-97AA-3ECEB280AA1E\DismHost.exe" (Indicator: "\Device\"; Source: "00000000-00004888.00000000.82782.001E0000.00000004.mdmp") Found string ":\Windows\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004888.00000001.83267.00233000.00000004.mdmp")53:T221c,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: 87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: Cz3Js38.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: Cz3Js38.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Cz3Js38.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: Cz3Js38.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: Cz3Js38.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: we4pZ94.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: we4pZ94.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: we4pZ94.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: we4pZ94.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: we4pZ94.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: vz2Kg11.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: vz2Kg11.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: vz2Kg11.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: vz2Kg11.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: vz2Kg11.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 4Ai174ie.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 4Ai174ie.exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: 4Ai174ie.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: 4Ai174ie.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: 4Ai174ie.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: 4Ai174ie.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 4Ai174ie.exe] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 4Ai174ie.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: 4Ai174ie.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: 4Ai174ie.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 4Ai174ie.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 4Ai174ie.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: 4Ai174ie.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: 4Ai174ie.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 4Ai174ie.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: 4Ai174ie.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: DISMHOST.EXE.6A9901B8.bin] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: DISMHOST.EXE.6A9901B8.bin] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: DISMHOST.EXE.6A9901B8.bin] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: DISMHOST.EXE.6A9901B8.bin] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: DISMHOST.EXE.6A9901B8.bin] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: DISMHOST.EXE.6A9901B8.bin] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: DISMHOST.EXE.6A9901B8.bin] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: DISMHOST.EXE.6A9901B8.bin] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: DISMHOST.EXE.6A9901B8.bin] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: DISMHOST.EXE.6A9901B8.bin] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: DISMHOST.EXE.6A9901B8.bin] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: DISMHOST.EXE.6A9901B8.bin] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: DISMHOST.EXE.6A9901B8.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: DISMHOST.EXE.6A9901B8.bin] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: DISMHOST.EXE.6A9901B8.bin] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: DISMHOST.EXE.6A9901B8.bin] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: DISMHOST.EXE.6A9901B8.bin] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: DISMHOST.EXE.6A9901B8.bin] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: DISMHOST.EXE.6A9901B8.bin] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: DISMHOST.EXE.6A9901B8.bin]54:T9ba,"1sL92vc6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "1sL92vc6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "1sL92vc6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "1sL92vc6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "1sL92vc6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "1sL92vc6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "1sL92vc6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "1sL92vc6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "1sL92vc6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "1sL92vc6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "1sL92vc6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "1sL92vc6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "1sL92vc6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "1sL92vc6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")55:T45c,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "Cz3Js38.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "we4pZ94.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "vz2Kg11.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "1sL92vc6.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "MAXLOONAFEST131"; Value: "%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe")56:T5db,"Cz3Js38.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\Cz3Js38.exe]- [targetUID: 00000000-00006132] "1sL92vc6.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1sL92vc6.exe]- [targetUID: 00000000-00004408] "2cG0873.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 8 sections"- Location: [%TEMP%\IXP003.TMP\2cG0873.exe]- [targetUID: 00000000-00004184] "we4pZ94.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\we4pZ94.exe]- [targetUID: 00000000-00006096] "vz2Kg11.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\vz2Kg11.exe]- [targetUID: 00000000-00006096] "5dD8fu8.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 8 sections"- Location: [%TEMP%\IXP000.TMP\5dD8fu8.exe]- [targetUID: 00000000-00005928] "4Ai174ie.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4Ai174ie.exe]- [targetUID: 00000000-00006132] "3ct40Lc.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\3ct40Lc.exe]- [targetUID: 00000000-00006096] "FANBooster131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00004408]57:T7e8,"Cz3Js38.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\Cz3Js38.exe]- [targetUID: 00000000-00006132] "1sL92vc6.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1sL92vc6.exe]- [targetUID: 00000000-00004408] "2cG0873.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 8 sections"- Location: [%TEMP%\IXP003.TMP\2cG0873.exe]- [targetUID: 00000000-00004184] "we4pZ94.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\we4pZ94.exe]- [targetUID: 00000000-00006096] "vz2Kg11.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\vz2Kg11.exe]- [targetUID: 00000000-00006096] "5dD8fu8.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 8 sections"- Location: [%TEMP%\IXP000.TMP\5dD8fu8.exe]- [targetUID: 00000000-00005928] "4Ai174ie.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4Ai174ie.exe]- [targetUID: 00000000-00006132] "3ct40Lc.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\3ct40Lc.exe]- [targetUID: 00000000-00006096] "DISMHOST.EXE.6A9901B8.bin" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A] "FANBooster131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00004408] "OfficeTrackerNMP131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00004408] "MaxLoonaFest131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00004408]58:T631,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "Cz3Js38.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "Cz3Js38.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "we4pZ94.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "we4pZ94.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "vz2Kg11.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "vz2Kg11.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "1sL92vc6.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "MAXLOONAFEST131"; Value: "%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe")59:Tce8,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Cz3Js38.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f00d02d197078cf8e9c3.exe" wrote 25600 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5dD8fu8.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Cz3Js38.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\we4pZ94.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Cz3Js38.exe" wrote 24064 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4Ai174ie.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "we4pZ94.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\vz2Kg11.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "we4pZ94.exe" wrote 19456 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3ct40Lc.exe": 4d5aff000100000004001000ffff00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0a240000000000000000 ... "vz2Kg11.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1sL92vc6.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000300100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "vz2Kg11.exe" wrote 384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2cG0873.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...5a:T893,RegDeleteValueA RegOpenKeyExA OpenProcessToken RegCloseKey RegCreateKeyExA GetStartupInfoW GetFileAttributesA GetTempFileNameA GetVersionExA UnhandledExceptionFilter Sleep GetTickCount GetModuleFileNameA FindResourceA CreateProcessA CreateFileA WriteFile LoadLibraryExA FindNextFileA GetDriveTypeA TerminateProcess LockResource CreateDirectoryA GetSystemDirectoryA GetTempPathA GetModuleHandleW GetProcAddress LoadLibraryA DeleteFileA FindFirstFileA CreateThread GetSystemInfo GetUserNameA RegEnumKeyExA CredEnumerateA RegEnumKeyA GetFileSizeEx CreateRemoteThread CopyFileA GetCommandLineW LoadLibraryExW GetComputerNameA WriteProcessMemory GetModuleFileNameW CreateFileW GetFileSize GetCommandLineA GetFileAttributesExW GetModuleHandleA OpenProcess DeleteFileW VirtualAllocEx Process32Next GetFileAttributesW GetModuleHandleExW GetModuleHandleExA GetTempPathW CreateToolhelp32Snapshot FindFirstFileExW IsDebuggerPresent GetTickCount64 FindFirstFileW Process32First FindNextFileW ShellExecuteA connect closesocket recv WSAStartup send socket CreateThreadpoolWait OutputDebugStringW GetNativeSystemInfo SleepConditionVariableSRW SleepConditionVariableCS CreateThreadpoolTimer ExitThread CreateThreadpoolWork GetUserNameW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegCreateKeyExW RegOpenKeyExW CreateProcessWithLogonW CreateProcessAsUserW SetSecurityDescriptorDacl IcmpSendEcho Process32NextW CreateDirectoryW GetVersionExW GetComputerNameW Process32FirstW VirtualAlloc DeviceIoControl CopyFileW FindResourceExW CreateProcessW CopyFileExW GetDriveTypeW ReadProcessMemory LoadLibraryW GetSystemDirectoryW GetTempFileNameW ShellExecuteExW ShellExecuteW GetClipboardData GetWindowThreadProcessId SetKeyboardState GetCursorPos FindWindowExW FindWindowW FtpGetFileSize InternetCloseHandle FtpOpenFileW InternetConnectW InternetReadFile InternetOpenW InternetQueryDataAvailable HttpSendRequestW InternetQueryOptionW HttpQueryInfoW InternetCrackUrlW InternetOpenUrlW recvfrom accept bind listen sendto GetStartupInfoA MapViewOfFile CreateFileMappingW OutputDebugStringA5b:Tc03,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP\ (UID: 00000000-00002152) "Cz3Js38.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP\ (UID: 00000000-00002880) "we4pZ94.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP\ (UID: 00000000-00001412) "vz2Kg11.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP\ (UID: 00000000-00004048) "1sL92vc6.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7jny9bXVG7b3K\CC (UID: 00000000-00001172) "1sL92vc6.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7jny9bXVG7b3K\Files\Amazon Downloader Logs (UID: 00000000-00001172) "1sL92vc6.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7jny9bXVG7b3K\FTP\FileZilla (UID: 00000000-00001172) "1sL92vc6.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7jny9bXVG7b3K\Files\hancom (UID: 00000000-00001172) "1sL92vc6.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7jny9bXVG7b3K\FTP\TotalCommander (UID: 00000000-00001172) "1sL92vc6.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7jny9bXVG7b3K\Files\My Music (UID: 00000000-00001172) "1sL92vc6.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7jny9bXVG7b3K\FTP (UID: 00000000-00001172) "1sL92vc6.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7jny9bXVG7b3K\Games\Growtopia (UID: 00000000-00001172) "1sL92vc6.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7jny9bXVG7b3K\Files\My Pictures (UID: 00000000-00001172) "1sL92vc6.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7jny9bXVG7b3K\Games\Minecraft (UID: 00000000-00001172) "1sL92vc6.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7jny9bXVG7b3K\Files\My Videos (UID: 00000000-00001172) "1sL92vc6.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7jny9bXVG7b3K\Games\TLauncher (UID: 00000000-00001172) "1sL92vc6.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7jny9bXVG7b3K\Autofill (UID: 00000000-00001172) "1sL92vc6.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7jny9bXVG7b3K\Games\FeatherClient (UID: 00000000-00001172) "1sL92vc6.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7jny9bXVG7b3K\Downloads (UID: 00000000-00001172) "1sL92vc6.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7jny9bXVG7b3K\Games\LunarClient (UID: 00000000-00001172) "1sL92vc6.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7jny9bXVG7b3K\Games\Battle.net (UID: 00000000-00001172) "1sL92vc6.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7jny9bXVG7b3K\Games\Steam (UID: 00000000-00001172) "1sL92vc6.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7jny9bXVG7b3K\Files\Outlook Files (UID: 00000000-00001172) "1sL92vc6.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7jny9bXVG7b3K\Games (UID: 00000000-00001172) "1sL92vc6.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIA7jny9bXVG7b3K\Messengers\Skype (UID: 00000000-00001172)5c:T55d,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f.exe") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00000784.00000000.69204.00C27000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000784.00000000.69204.00C27000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00000784.00000000.69204.00C27000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000784.00000000.69204.00C27000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001172.00000000.66012.001E7000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001172.00000000.66012.001E7000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00001172.00000000.66012.001E7000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00001172.00000000.66012.001E7000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00001172.00000000.66012.001E7000.00000002.mdmp")5d:T417,"schtasks.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK")5e:T6b2b,Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 29 Nov 2023 05:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Modified" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 29 Nov 2023 05:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2023" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 29 Nov 2023 05:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 29 Nov 2023 05:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 29 Nov 2023 05:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDmzKJl66ZMrRKtZxoAGQQd HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDmzKJl66ZMrRKtZxoAGQQd HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDmzKJl66ZMrRKtZxoAGQQd HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDmzKJl66ZMrRKtZxoAGQQd HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"5f:T946,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00000680.00000000.67407.01437000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00000680.00000000.67407.01437000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00000680.00000000.67407.01437000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00000784.00000000.69204.00C07000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00000784.00000000.69204.00C07000.00000002.mdmp, 00000000-00000784.00000000.69204.00C27000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00000784.00000000.69204.00C07000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00000784.00000000.69204.00C27000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00000784.00000000.69204.00C27000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00000784.00000000.69204.00C27000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00001172.00000000.66012.001E7000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00001172.00000000.66012.001E7000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001172.00000000.66012.001E7000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00001172.00000000.66012.001E7000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001172.00000000.66012.001E7000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001172.00000000.66012.001E7000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00001172.00000000.66012.001E7000.00000002.mdmp")60:T503,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f.exe") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; File: "00003632.00000E30.1806736.00402000.wprm") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; File: "00000000-00003564.00000001.68771.00E91000.00000020.mdmp") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; Source: "00000000-00000680.00000000.67400.01459000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00000680.00000000.67407.01437000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00000784.00000000.69204.00C07000.00000002.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000784.00000000.69204.00C27000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00001172.00000000.66012.001E7000.00000002.mdmp")61:Ta24,"schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "NAMESERVER"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPNAMESERVER"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")62:T536,"AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")63:T9d1,"1sL92vc6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1sL92vc6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1sL92vc6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "1sL92vc6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "1sL92vc6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1sL92vc6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1sL92vc6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "1sL92vc6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "1sL92vc6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "1sL92vc6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "1sL92vc6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "1sL92vc6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "1sL92vc6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "1sL92vc6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "1sL92vc6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "1sL92vc6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "1sL92vc6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "1sL92vc6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "1sL92vc6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "1sL92vc6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "1sL92vc6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "1sL92vc6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "1sL92vc6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "1sL92vc6.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "1sL92vc6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")64:T58d,"1sL92vc6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "1sL92vc6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "1sL92vc6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1sL92vc6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1sL92vc6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "1sL92vc6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "1sL92vc6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "1sL92vc6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "1sL92vc6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "1sL92vc6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "1sL92vc6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1sL92vc6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1sL92vc6.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")65:T149e,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "Cz3Js38.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "Cz3Js38.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "vz2Kg11.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "vz2Kg11.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1sL92vc6.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "1sL92vc6.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1sL92vc6.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "1sL92vc6.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "2cG0873.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "2cG0873.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll" - [base:0; Status:c0000135] "4Ai174ie.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "4Ai174ie.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "4Ai174ie.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "4Ai174ie.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "5dD8fu8.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135]66:T99a,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f.exe") Found string "https://twitter.com/i/flow/login" (Indicator: "twitter"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f.exe") file/memory contains long string with (Indicator: "twitter"; File: "S18UDG7H.txt") file/memory contains long string with (Indicator: "youtube"; File: "XQQ9P3YC.txt") file/memory contains long string with (Indicator: "youtube"; File: "css_2_.css") file/memory contains long string with (Indicator: "twitter"; File: "0268SXCO.txt") Found string "VISITOR_INFO1_LIVE_MUXc6BdYyEyoutube.com/9217237743155231109113142558100731072902CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921722034688031075720142542500731072902" (Indicator: "youtube"; File: "WFARTFKT.txt") Found string "CheckConnectionTempCookie844852466accounts.youtube.com/accounts/21474847523732197123107290327842903531072903CheckConnectionTempCookie328278237accounts.youtube.com/accounts/21474847523832197123107290329202924431072903" (Indicator: "youtube"; File: "XAJ819C1.txt") Found string "guest_id_marketingv1%3A170123694844483237twitter.com/102530608348163121975427535398731072903guest_id_adsv1%3A170123694844483237twitter.com/102530608348163121975427590399631072903" (Indicator: "twitter"; File: "GPGTPH0X.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/921722034688031075720142542500731072902" (Indicator: "youtube"; File: "CCYW6FED.txt") Found string "CheckConnectionTempCookie288471748accounts.youtube.com/accounts/21474847524832197123107290338981110731072903" (Indicator: "youtube"; File: "45XXCLZ1.txt") Found string "CheckConnectionTempCookie844852466accounts.youtube.com/accounts/21474847523732197123107290327842903531072903" (Indicator: "youtube"; File: "UFA8P885.txt") Found string "guest_id_marketingv1%3A170123694844483237twitter.com/102530608348163121975427535398731072903" (Indicator: "twitter"; File: "20ZNABAU.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "twitter.com" (Indicator: "twitter"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") file/memory contains long string with (Indicator: "youtube"; File: "SSL")67:T398d,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2748 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 29 Nov 2023 05:48:49 GMT Last-Modified: Wed 29 Nov 2023 05:03:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 721 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 29 Nov 2023 05:48:49 GMT Last-Modified: Wed 29 Nov 2023 05:36:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 29 Nov 2023 04:50:51 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3478 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 871 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 29 Nov 2023 05:48:50 GMT Last-Modified: Wed 29 Nov 2023 05:34:19 GMT Server: ECAcc (sac/2507) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2750 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 29 Nov 2023 05:48:51 GMT Last-Modified: Wed 29 Nov 2023 05:03:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5355 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 29 Nov 2023 05:48:51 GMT Last-Modified: Wed 29 Nov 2023 04:19:36 GMT Server: ECAcc (sac/254D) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 29 Nov 2023 05:05:49 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2582 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 29 Nov 2023 05:03:01 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 2750 Cache-Control: max-age=7200 Date: Wed 29 Nov 2023 05:48:51 GMT Last-Modified: Wed 29 Nov 2023 05:03:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 29 Nov 2023 05:03:01 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 2751 Cache-Control: max-age=7200 Date: Wed 29 Nov 2023 05:48:52 GMT Last-Modified: Wed 29 Nov 2023 05:03:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT with response body ==>....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 29 Nov 2023 05:33:36 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 916 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Cache-Control: max-age = 14400 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 29 Nov 2023 05:05:49 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2583 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 29 Nov 2023 05:03:04 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2749 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 6329 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 29 Nov 2023 05:48:54 GMT Last-Modified: Wed 29 Nov 2023 04:03:25 GMT Server: ECAcc (sac/254F) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1 Cache-Control: max-age = 14400 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 29 Nov 2023 05:03:04 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2750 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5524 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 29 Nov 2023 05:48:55 GMT Last-Modified: Wed 29 Nov 2023 04:16:52 GMT Server: ECAcc (sac/253A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B76BA2EAA8AA848C79EAB4DA0F98B2C59576B9F4180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDmzKJl66ZMrRKtZxoAGQQd HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 29 Nov 2023 05:13:34 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2124 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 29 Nov 2023 05:21:08 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1671 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1960 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 29 Nov 2023 05:49:07 GMT Last-Modified: Wed 29 Nov 2023 05:16:27 GMT Server: ECAcc (sac/253E) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 493 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 29 Nov 2023 05:49:10 GMT Last-Modified: Wed 29 Nov 2023 05:40:57 GMT Server: ECAcc (sac/2505) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414748580C066C7DF37DECFBD2937AA031DBEEDCD17180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 29 Nov 2023 04:52:19 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3411 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4395 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 29 Nov 2023 05:49:43 GMT Last-Modified: Wed 29 Nov 2023 04:36:29 GMT Server: ECAcc (sac/252C) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5323 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 29 Nov 2023 05:49:44 GMT Last-Modified: Wed 29 Nov 2023 04:21:01 GMT Server: ECAcc (sac/2561) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 777 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 29 Nov 2023 05:49:45 GMT Last-Modified: Wed 29 Nov 2023 05:36:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32.......68:T9dd,"UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d" (Source: 61525-2739-004DC570, Indicator: "update %q.%s set type='table', name=%q, tbl_name=%q, rootpage=0, sql=%q where rowid=#%d") "CREATE TABLE" (Source: 61525-2466-004CF340, Indicator: "create table") "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 61525-2662-004CF800, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'") "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 61525-2662-004CF800, Indicator: "delete from %q.sqlite_stat1 where tbl=%q") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 61525-2310-004C2E90, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 61525-2736-004CD570, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 61525-2649-004CFB70, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q) tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='" (Source: 61525-2734-004CD2C0, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='") "CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)" (Source: 61525-2265-004D6790, Indicator: "create table sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 61525-2265-004D6790, Indicator: "select name rootpage sql from '%q'.%s"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 61525-2708-004D0320, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 61525-2708-004D0320, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 61525-2460-004CF4F0, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d")69:Tf72,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00004048.00000FD0.362862.00050000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00002152-00000C25-37551763] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00002152-00000BC1-37563904] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00002880-00000BC1-38049011] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00001412-00000BC1-38472524] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00004048-00000BC1-38890520] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00001172-00000C25-40622355] Observed system executable string:"%WINDIR%\System32\shdocvw.dll" [Source: 00000000-00001172-00000C25-41671924] Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00001172-00000C25-46455898] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003632-00000C25-63283467] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003632-00000C25-63553529] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003632-00000C25-63610818] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003632-00000C25-63754030] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003632-00000C25-63790019] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003632-00000C25-63931166] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003632-00000C25-64767516] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00003632-00000C25-64821473] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00003632-00000C25-64859758] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00003632-00000C25-64958334] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003632-00000C25-65051073] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00003632-00000C25-65075160] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00003632-00000C25-65125635] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003632-00000C25-65154660] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00003632-00000C25-65270365] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00003632-00000C25-65559814]6a:T7d5,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCHANDLER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCHANDLER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCHANDLER"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCHANDLER"; Key: ""; Value: "")6b:Tb2c,Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D" Found http requests in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDmzKJl66ZMrRKtZxoAGQQd" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D"6c:T34bb,Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:erxgqQeWklmFtYlUj-jtwEyL37qzjA:Jh9PpdE48mqsLhh0Connection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp0i7m3dF0MPIvy1_irpUrItWzfnWB8C1qZjDkFEZip7p75RFvMIom7vYyzNvOQZCCtyr3FTsg HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:erxgqQeWklmFtYlUj-jtwEyL37qzjA:Jh9PpdE48mqsLhh0"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp23a68XhLkUw7miggs9NB6IvJzjqdjzS1K_O_sdUcAkJFdfPm6LL_5P6OU5uDQih6iqdVsb&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1442300537%3A1701236935031953&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:p9OZkvUDykEzgx_8_OgCx-TE71EUGA:47CN18wDybA6euye"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:c2_9SBQoYOFp7yoRjLyssdqemIGDMw:ndtfQfkKmn3GQ4qy"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp1kS4OV6xgVw7rVRuHxpj0DfBU-yCsIVfdT16Atg0MfNFUTNDUGj4G5PdvyPorFIE4axmYLwQ HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:DdBBIZeBgTZbinqyVXm6chw0Fjmv2g:mOQjzmwpNF7nKBw7Connection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2Jq3dnW13Q-g_ADi2XlwINAESnrK7zwI7twh0dlD-uwJnkb6WrO7c6bDEu7Ix_03YlpGZ3kA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-301563732%3A1701236942842231&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:DdBBIZeBgTZbinqyVXm6chw0Fjmv2g:mOQjzmwpNF7nKBw7"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:DdBBIZeBgTZbinqyVXm6chw0Fjmv2g:mOQjzmwpNF7nKBw7"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-8259494059216187010&bl=boq_identityfrontendauthuiserver_20231126.08_p0&hl=en-US&_reqid=24246&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-301563732:1701236942842231",null,null,"ASKXGp2Jq3dnW13Q-g_ADi2XlwINAESnrK7zwI7twh0dlD-uwJnkb6WrO7c6bDEu7Ix_03YlpGZ3kA"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:DdBBIZeBgTZbinqyVXm6chw0Fjmv2g:mOQjzmwpNF7nKBw7; OTZ=7315544_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:DdBBIZeBgTZbinqyVXm6chw0Fjmv2g:mOQjzmwpNF7nKBw7; OTZ=7315544_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:2_Us-O4IWzHPScsAFsa-vLZXTNDg8w:tJzEOFsH8Ap7vL_w; OTZ=7315544_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /generate_204?Uz_Opw HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:4Z3fOphaKnfdbbjpzBtfIdmy4InbqA:Vi-AtKLRL1nYst25; OTZ=7315544_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:4Z3fOphaKnfdbbjpzBtfIdmy4InbqA:Vi-AtKLRL1nYst25; OTZ=7315544_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /generate_204?ygN63Q HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:4Z3fOphaKnfdbbjpzBtfIdmy4InbqA:Vi-AtKLRL1nYst25; OTZ=7315544_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:4Z3fOphaKnfdbbjpzBtfIdmy4InbqA:Vi-AtKLRL1nYst25; OTZ=7315544_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:b2QviqQdAg5DSPFD0BOVnPFedeIrsw:m2CeCPKLbpbzD-oe; OTZ=7315544_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp1Ay9Xh9iFMGxYnviQldK5X0r9xbxsolrkhlEttDIT6qxs1tP59WOZC5oW3nOQCUSjH-VtG HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:b2QviqQdAg5DSPFD0BOVnPFedeIrsw:m2CeCPKLbpbzD-oe; OTZ=7315544_52_52_123900_48_436380Connection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2uah_1JyyKG3nlU6OkF1kRmmUhwF0V8WDqv4Gyr1xXBZdJr8LlKpsTH4HgNVHvGrNv-o81&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S470003641%3A1701236956227213&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:b2QviqQdAg5DSPFD0BOVnPFedeIrsw:m2CeCPKLbpbzD-oe; OTZ=7315544_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:b2QviqQdAg5DSPFD0BOVnPFedeIrsw:m2CeCPKLbpbzD-oe; OTZ=7315544_52_52_123900_48_436380; NID=511=SRfsr-hQvY94qlC5czImJJHQbwU7ksSSx_774e_hN_2AnscB6NYuBSPidEpbjU-iIrNSGfh8Xp8O6t8tbC6_XVLCj81K-xY-fJltXVb6T5r1oFgYC1MuwEC8xWY1WV7WmE7_9xVRffzExfDi90qur9ACDMmPik8yb3Dmi9WKYnk"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:b2QviqQdAg5DSPFD0BOVnPFedeIrsw:m2CeCPKLbpbzD-oe; OTZ=7315544_52_52_123900_48_436380; NID=511=SRfsr-hQvY94qlC5czImJJHQbwU7ksSSx_774e_hN_2AnscB6NYuBSPidEpbjU-iIrNSGfh8Xp8O6t8tbC6_XVLCj81K-xY-fJltXVb6T5r1oFgYC1MuwEC8xWY1WV7WmE7_9xVRffzExfDi90qur9ACDMmPik8yb3Dmi9WKYnk"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-3229017006301009797&bl=boq_identityfrontendauthuiserver_20231112.08_p0&hl=en-US&_reqid=24257&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S470003641:1701236956227213",null,null,"ASKXGp2uah_1JyyKG3nlU6OkF1kRmmUhwF0V8WDqv4Gyr1xXBZdJr8LlKpsTH4HgNVHvGrNv-o81"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 164DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:b2QviqQdAg5DSPFD0BOVnPFedeIrsw:m2CeCPKLbpbzD-oe; OTZ=7315544_52_52_123900_48_436380; NID=511=SRfsr-hQvY94qlC5czImJJHQbwU7ksSSx_774e_hN_2AnscB6NYuBSPidEpbjU-iIrNSGfh8Xp8O6t8tbC6_XVLCj81K-xY-fJltXVb6T5r1oFgYC1MuwEC8xWY1WV7WmE7_9xVRffzExfDi90qur9ACDMmPik8yb3Dmi9WKYnk"; in File: "SSL") Found requests in header "GET /generate_204?GWfQ1Q HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:RO7HRtpvq_ysQXkBZznSO_VU6KQFsQ:OqXxFULysUsYMTlY; OTZ=7315544_52_52_123900_48_436380; NID=511=SRfsr-hQvY94qlC5czImJJHQbwU7ksSSx_774e_hN_2AnscB6NYuBSPidEpbjU-iIrNSGfh8Xp8O6t8tbC6_XVLCj81K-xY-fJltXVb6T5r1oFgYC1MuwEC8xWY1WV7WmE7_9xVRffzExfDi90qur9ACDMmPik8yb3Dmi9WKYnk"; in File: "SSL") Found requests in header "GET /supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/chrome.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: VISITOR_INFO1_LIVE=_MUXc6BdYyE; CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=6obu2UaZfqk; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL") Found requests in header "GET /img/desktop/supported_browsers/edgium.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.youtube.com/supported_browsers?next_url=https%3A%2F%2Fwww.youtube.com%2FAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.youtube.comDNT: 1Connection: Keep-AliveCookie: VISITOR_INFO1_LIVE=_MUXc6BdYyE; CONSENT=WP.2676ba; hideBrowserUpgradeBox=true; YSC=6obu2UaZfqk; VISITOR_PRIVACY_METADATA=CgJVUxICGgA%3D"; in File: "SSL")6d:T8d88,"GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:erxgqQeWklmFtYlUj-jtwEyL37qzjA:Jh9PpdE48mqsLhh0Connection: Keep-AliveDNT: 1" "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp0i7m3dF0MPIvy1_irpUrItWzfnWB8C1qZjDkFEZip7p75RFvMIom7vYyzNvOQZCCtyr3FTsg HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:erxgqQeWklmFtYlUj-jtwEyL37qzjA:Jh9PpdE48mqsLhh0" "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp23a68XhLkUw7miggs9NB6IvJzjqdjzS1K_O_sdUcAkJFdfPm6LL_5P6OU5uDQih6iqdVsb&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1442300537%3A1701236935031953&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:p9OZkvUDykEzgx_8_OgCx-TE71EUGA:47CN18wDybA6euye" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:erxgqQeWklmFtYlUj-jtwEyL37qzjA:Jh9PpdE48mqsLhh0;Path=/;Expires=Fri, 28-Nov-2025 05:48:54 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-iwzHwFaYLi3UE7NajZgnqA' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Wed, 29 Nov 2023 05:48:54 GMTExpires: Wed, 29 Nov 2023 05:48:54 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "0000000100000001�00000001000000010000000100000001000001e6��PAj�0��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R", "HTTP/1.1 302 FoundContent-Type: application/binaryCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Wed 29 Nov 2023 05:48:54 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp0i7m3dF0MPIvy1_irpUrItWzfnWB8C1qZjDkFEZip7p75RFvMIom7vYyzNvOQZCCtyr3FTsgStrict-Transport-Security: max-age=31536000; includeSubDomainsContent-Security-Policy: script-src 'nonce-F1M5HC8YNZLQFvYKBBjHww' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportPermissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factor Sec-CH-UA-Platform Sec-CH-UA-Platform-VersionCross-Origin-Resource-Policy: cross-originCross-Origin-Opener-Policy: unsafe-noneServer: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000", "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Set-Cookie: __Host-GAPS=1:p9OZkvUDykEzgx_8_OgCx-TE71EUGA:47CN18wDybA6euye;Path=/;Expires=Fri 28-Nov-2025 05:48:55 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Wed 29 Nov 2023 05:48:55 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp23a68XhLkUw7miggs9NB6IvJzjqdjzS1K_O_sdUcAkJFdfPm6LL_5P6OU5uDQih6iqdVsb&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1442300537%3A1701236935031953&theme=glifStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk"Content-Security-Policy: script-src 'nonce-O2pRHij7eozU90R11VDuNw' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportContent-Security-Policy: require-trusted-types-for 'script';report-uri /cspreportReport-To: {"group":"coop_gse_qebhlk" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}Content-Encoding: gzipX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�000000010000000100000001000000010000001178�RMo�@��+��U>V��@�?Q�`kOa�U`��䡓Mvv潗��U��[��4�r'�e�s\Àqa��+PrV�[��r��=�f��w۲W�0l�e\s��'�{��jˍ!`�JaV2�G��3^�C��2'/��>��t"��v|�r5��2�q(�t"X��fY��F[�s�O��^��8I��@��g��"��Ml֧^��(��<��1�_a��$X��a:�e*[�VZ��Z�(��1�$�F5�A5��Wd��F'[x)�F��Ρ�N��Ys`Q#Z8B�V@b�y�]�zt'��"� �@P$��R�J�z�r�ޡ�^mm\n~��", "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Frame-Options: DENYVary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Sitex-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/x-ua-compatible: IE=edgeCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 29 Nov 2023 05:48:55 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Resource-Policy: same-siteContent-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreportContent-Security-Policy: script-src 'nonce-tl_mEyNoFlGAjKheoSR3nw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*Content-Encoding: gzipServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�00000001X00000001Y001wb98ں~ﯠ^�)��f�� )d��I��l˶��X6��ep:pz��>mm�Y|z�{Z��q��'��k�vK7c!��@�0`#��'Q@ؐ+}z��4͋ܐ�M�3m\��<�Y�_W�X�W��bڞ�l�m�ɹ��{U8��sb��).�Ki9Ӆ�a_��(��)p��h�%�~P��f�!�j�&08�nOx�`�44��*��Tc ��!�л��0��hr`�`�-}�q6��8U&�M`�p��jA��%�V�TE�^=8�D�Rm��u�*��U��I��bܰ�� P�Yo4ZR(��Hdw��Qןw{��zl�JU�4��3l�j�Lƽp�>��[~xp#�.><�굺ԨK�d��4m�d�A�\<�T��O��Y��*]k��4�]��M-�r�6��Niz��Jj�}m7~�onj|k-�o��{�Y�n�t.��z��2�~�?ح}��[|��V�o�{�o��܉��pV��.sŷh�d��ޤ_��Yg��vK�XV�h��%̈́�ƭ��;��E��V�U��X�VU&�7�t;��B�V�9:��H�L�o�X N�<��L��:�E&v ��|�C.�=�92XL�ٽk_q��"V��X�I�X+B��R�$g��7fgv+4^v{�ٓˊ7��^x��T�-��V,ءz��A0.� ):Km�8��@��$I��T|v�sw<{a?Lݙw�h\�1K�jS�AXC�5O��ֵ��K'�� c.�Ap�(p��d�GA��6�z��xnb��l#�ȔK�h�fT_K�͒�ć��Q��TL�#�ŏ�fήq�m��(ĉ��hx��#LC>'f�6�C�Q��?6,2��Y��j��6W�U��P�*b�6N'f��Ч��v��AC�n��L53^ӷ�8��BU��R)�_�qM�z�sqSΉ��o�̳�@��s�{�7J'��]z��N�䋹ʰ$_!��e��0Xnf�(=��l�F~:4|A�~�4O�^0Y��Doz��"[�̠304��-nC��'��c6O�xl!=U�L'�Kt�ͽ�W8(H��.�DvH��q/��~>��~}��zh�0�J�r��(�u�)]̷Qq�9J�է�rP��TI�h��?�ʑ|�jZ��|.?��:H(��9��4�t��Έ�Q��̋��~��$��7D��";)�Z�dڈ�aW��̮�y ��K�ڲkg�46��;X", "��"��x��(�7b`�͖��.��JB@;{g@mB�a3�7]b�+'61n��+Ї�v�Yq��N�J5�w�pv@�u~��OWO��j �)�o��X7.��p��/7��wE�y֧T��[�J��5��kT��ߛ$�M�梩+�ߝ'}]@uN��9Ӎ=d'��ʆ�p;��O��{��×�?�� ]��g�=Ɗ�ʖq��"��&�]g��ͬ']�v�7��=��M��K ��?92��M�!�Gφ�Z��,y3��}^:S�۵ ��j�)�??i��ac��bRt�o�jO��E^��v�Q|ݔV��p�$��e��[�Ɂw?>��i%�*�kb0��K�y�U��}W{z/>��.��|�u;7�/�E^)j5�b�^kg��bi)d�D��(�y�N�+�k�FJ3"��:�G�� Ӓ=([ʸu��ɕ{|aO��c��F�U\�T��n�(��[f�Β��m׺D_��J��u�Һ�]Ԇ�`0:bv��a��¤��ͱuq��e�غ�}~��0]u��Ƈ��s��>ӽ��O��4��Lވ�$??�9D?��:��)�2*�8`e��-��6tǚ��RI"]��e}oO/�^��x��H\s;*�hNL�N'U�w�v{-^|0��nn�?��.�s=�P��;��N7�/�ȯ��4=��)��2�!f9�c��:��*��h�R��^��}��kNx��5%�e^Q�s��y��C��U��r�@��p�B��j⼐�GM(|��5bS�o��R�e3�3 �C:؀��7gnti�U�6M~ymk귟<��G��k8�MpC��B��ӹ��T��k�]�p�r/��xL��(YaY|#��-�O�6��6S�)��7��=�K��>SB<��g��^=C�aг�_Bu��w�:�{)0CV�:6t�S�c�h�ޞ�,��4��n�5C��Z.��c��i�p�=�`�x'�9��/lIf��60�&�k��k��~�ĵ��4�*��L.{wa`��S�}J�#��_�Fh��Tb�]�Ӆ��*S��E�۷��g�Or\:��K�AM�|^��Ӷ�[~��L�yYK��۲�^��e��9��<�7>Qxa��GAbt�-F'��j��U��E��\w�$y|��drI>Ce *I��*��t��0^,I�eYM0䇷8p^��I��k�VQ��0Mq,ߋ,M��%1YA�B4f�)Ge)P��_e�v>�-��PS?�m�cG(��eN�}T��?��R��SlL*AeP��T��ő��e��t��up��I��e�P�%Y}u��jJ/r��B�~�js/�xq�_7w��" "00000001�00000001]0000000100000001s00000001�0000000160000000100000001�00000001+00000001�00000001v00000001200000001c00000001M0101f��f�N�v�I��P"%3:KJ�m��"��m'�Lx��{�jI7sp��1� x^�>-��exp��c��w��S뱇~�S��ן/��s�i_8�͵�.^�?��g�''��O��=��^��O3ǽq��ޅ�'�N��O��5[T�8��r��;H8[�c��;��᧳��߀�`� s�6��˰1wG��j��0BnB�/�棭��8U$yѦ�G��?C��o��o�a�ۆ��yց�Q&�ǟP�ڃ��@�X|�g��f#�f��v�ܖc�[��L�g��2��V�W˕3��Y3h�N0��M$��mzr�A�T!�9��/㏫��ί��m3��P��.�8�_�A��I�oe��vK0��;��6�g1��Nt9��2��@��/�6�7��'��x��Ѓ�z��.�D^��)9�p9��s0�q��q�;�D _>l�C1>$��^8,��|l�21:c��tc茦��R��>��zځ��h3*S2wq��iˍיv"Ŝ��a� �(s��,&�9��yH䯁�vV��=��S�g�/!��DW��[D��eo�q��(b vU}I�k�6RS(�N��6��g��̺��8\hF�<,jNd��yF{З5@�2�GT{2Wqaշ��)��G&. �P�$�O��_f��b��Cdb�8�\��!��Ţ��UF&�u0��mz'�s��sK��)�B�TLG�*0A�s�$�tՙg��rv$�qz�ϳ�?��9�\�0�/�a��R�L/�"��8��}�-/0ɤ&�ϖ��8_-^<ϓ�b��N�쏗#�1g�]�n�Q/f߲��Y�eˤ�`(2TQ�m��u�y��I�ӗY�*�B��y��w�踓��zV�׳`��a��$��g7�e��d�y�1,~HMi�WW�y�{�#�c�y� �[��J<��b��^��tήN6g^�{��ů�W#�[�&C}�;��q5�N~.��圽�!��;`��<��^x��ܹiv�@�1", "�>�t4��GL�Ξ�@%c��kx��O��w��HUu��ঘd#��;�|Be� ��g��TP��WH��Ђ^��9XD 㾱Q��l�m��st��_\x�� /)�7A��?�6!d#�f�hM��\Hjkiv�w��h�x;�H�;I��(��X��h��6�\߁G�y��p{�4�ZH=[s��z�&��%Ej��6�r��^��'��JC�Jo��{�'��W[|&�koR�`��x�]�oµ?��ġB��)j.��6��n��4��]]�6G)c��kc��j�c��H��j��@E��t�Oк3��+"9dv)�O`�8@�j�Ҁ5*��.Ώ5E8}�"\�B.~Tx12�7�:�[W��~��#�"U�h��ew��=ESQK�(&c#� �PQ}��N�5X;+p׎��Ș��$�˔+Zcv��Z�S�Q��1�Ȥp3��m�;�H�A�z�x8��?��w��ڇ�2�k��}ם��>�s�J��_Z��í8��17Q��j��mԿ2#�d��ز��p�n+�ϔ�u�iND2c[]f�Ƃ�9�nϠdo�D�<�g5�ʻ�$)>{|ώߊx��a��ۨ4E6��c3�-k��L��͸�f-Y��QW��R�E�U��y࿎4�"-I�Dr'��D�wa�uF��c�4_�.��38��KNc(�]j��߆��L�^��(ɖ9w�͜��2��?=_.��eM��gq�=�,�>~&��By��JV2희޲�4��+A�v/l��zVӰ�Nߢ��d°��T��:[^��YFm��_�\{�]��P�Y��ț��$�=�M�>��]�|��'n�j)O-O��1-C>��S;l*��G�k�q��1�Z�tE�ږ+ޏ��W�w��=��l��' q�cwҗe�+�ZF4n�<��,�ެd4�,�&rq��?��.��K#�B/�ǃ��=��|��'�5��}��<��-x?�� c�$�Kg�", "Zy�&��hZ�Ŋ|��>!=G�3�Y7��^%'��x<֣��SC�v��s=v��}w��xq!�Pť�t`��{V�v��m>P��k/�bP/�lL@H"ZQ�n�Y�f��./4�(<(�� f��jX�@��l�a6�E�ť�C�:�{Ҡ@$R1>�I�(1/��^$D��Q��d��Q��D�J��SB�*F��8R�R�3T�/sW�J�}�j,��h]=^M�`��T��Y�FQM��0��L�!K��P�!�,��ѝ{f"��G)�:� h��E�y�_8��i/�YaYf��.��y�u)]�{{��B$��:��X��F��6�Vc�ن��Y�̙��ɉ�D�AF��TR�-�`�쎠Pm�u��ˬ&��>��"�L9�dٔ�]*�PMR4�;��"у�Z%�ߓ�S��pP~��9d�b��iE��'��ßI[�^.��#t��Ë6:��x��s��?��L��O��w˄�E��Om;�c��b�"r"��xz�_�7f��̹�T�=�kXVǰ[vS��d��:��wcG�bp�4eԓ� ��_L��\9�M�4�m��۪�2��@��P��6��K��H"��$�A�Ӳ�V�hu5C�K��D�\��=Xf�R5��{~yCƁg�i�چ�`9�.J��1H��?y�74��2R/^�#X�6�#p��B�C�4��D�l�]�'%>�ɓM�̇��{ULْ9�uB8j�;]�٭xXru��}4G>"\�͠d/DK�z�w��x�YM�B�*�F�N_e��Z�*��._P��*�$s��w�x6�gUTdͻ��⚆/��'[9��Ğm��6�v3�⇌(ŒX��2�qܾ'�E�J�ht��'=��vˬ��i��鹤&J�>�&�8?��m(\�rttk]�\��*{�E&�n̯6[�S�7��퉾J&��t�8��r��OݸR��(0PZ\p.��r�^W�*��+I�$�؏�ǩ�c�:��N��X��*j�9+�is�طp�2T2��_h��X��Rla�o��W��^A�X��U5�~`��V)��^\q�ǫ?" "�#i�@��a��#?�6�F�w�.�9��5��3~a|��v��Ĵ�j��djj"�uy^t+ )՜��W8�f��BW�n��FZ�p��m�s�+J�8EUN[Ƕ��%�Ĕh�Zׄ�b��*�3�nWŝ��"Fb��" "00000001�00000001]00000001m00000001o00000001�0000000160000000100000001�00000001+00000001�00000001R00000001�0000000100000001�00000001T00000001�00000001c000001W8ee�1`ɲ"뚶i�vE��M'Nb;��"��EJ")�E�V��/w��,1�Q��s��D��Y��6�g�x�W��V��"'u��F�A�+F�*:�fFWX��c`��ō9��C5B��j��;̑��j�T�͘��j ��|v�b��秈_��a�ϝv��MUE�t��V;(��*�P��r��r��tp�N��vZ�+ƹ�s��:�U��J�� _qk�Z�l�AP�HPŅ�̨+Ԃ#-�:��tR�'�<�cQQ�b�e-��r��X�Q_J��&F�cp��0�j�@(`�"Ȅ��/��`��r3�� \,��l�O"3b��;�\^�o��Y��n��>�{u��ዜE��;��#n٦c)w��K��QH+��֫��Tg�>�t2��s8\�Ug�@�|4[�1p� �HP�E��!t��H��R��;ht�@*�*7�nH��H}w~p;lF�aF�S�TҲz��vvZA�4��-2/��K�p�;�BNڣ�� L��8�.t��[��Ѕz��Z�зtfK��q2N8�j BN��ӯ��9��i;4q��"�]1��#��q�{w��!N8Un��0�^�y�<��=��n��#?��o��$�Hΰ#�3m��"du9�Oh|��]�kɓbO��|�R�]��j{R��Ndn��p �'&��,��+a��!z��4�.6�5�>��p��37�f�iv��qqw�p�/�`�m��E>��>\}�E�՞��ŉ99F�_��Z�4��[A�k��Wj�d��]Sr��1��o@�� ǭ��R��b2K� ׌�]:�+��>��5}L��6�Ο�tV�b�!2P�3��6o,Db��}U�Χ��OW��%�z}|?GL�� x�|~O�<4K��h�~�h�%PA@$��z��a�G��NF1ͯ*H��Iw��On��ke7��De6�� Q��W��t��싲�x��yqR�Bc��+�mBg��o��", "I�8{E)�5��sFqa��e�S��T��x�Z~�>��N��"(]��!`f[�U��<2�cI��+S�Ӌ�磑��A�:�g-s��&&%�hݵhK�6|V��v�b�9��&}��9�XX.�1�e$��nN��83��g��G�a�^*��i�BB,+q;a�t��T�(��h��f)�B�d㶊�#4D��D-��2�Fb�2?�!q� ��x ��*jO1cY��!�ħ��io�/Zr;�sT;β��"�!B��/q�Ύՙ%4$,^��a��ߜM)��|��hp�O�i��0t��x��.'��+�`)��*��պ8B=�hPy��m��a�g��,Vn�Z��(��_r�b��X�d,��uUi�ٶ^&��" "00000001�00000001]00000001Y00000001�00000001�0000000160000000100000001�00000001+00000001�00000001�00000001�00000001U01�cb2�")i$��>��8>��xk�[y��M��sW��"W��hykS�dD��F��@7��|�K<^^��=��Q�訪�aK�D|��F�_�-xi�`e��8΅�gd��~�2�9��Ds��ʀ�,��q��j�G��=��s"��JQ�\��J��Bj�=��8W��fT�H袁s'��u�C'<�b��cA�3��2�YRY�ɑ�W!@��>ت�4��!�{��;��Ɔ�R�u�XXv�Q!=��>c�d�@�~�o��U��a|�Tg4*�qǽ �E�_ҙy�B�Vh(rF�IJq�Jǰ��w��\��bA!D��|W��`�Llgj��e_�㻷��ؐ>=��M��^�@�s.�&�h��:X\Z�XSG]ۉc,b��~y�)CXp�1_��7�GwkG6��/Rn��dI�O�n�]��Ae�'��?� !<�ES�O�9�l�weCTU��?|�bP�ϱk؀�ڔ�v��(W��-�S8��~��`q��SI2��O�A�b�c�c�?�=I:E��V�T��)_e�㝒��?>��R��b��P�^5��r��u��V��Z��1�ZCէȼfQ�@t�Xݬ��D�}��M��2��=�he��o�F�C��`�>��Zx��h}68��T��n��͠�GPJ��h6��)��uUў9U�3Qv�S�NGSܗ�i��x�rR��R�r�#G'�6�N1��1ǧ�I܆��F��8'�BİMn@h4�o1FG%��טk�0��P�i��Ai�f\�'��]��k"�tW3{��R12�.�" "QK_�#k+x#��,*�hP��/��od�k.@#��/4�]uI+:�@��m�^��[f��oژ��%Y��!u��W��EY��΋Z�%K�#5�W��ۈ��:��!#��?=��k��i��"�Yr��b�V�u@�Ӯ$��3�p�3��Ɇܼ��!{�[�I��G��'T^�o��Eq2�6�Z��V�#X��4$%w4��%��8�ռV�>o7R��PZۗL��W�O&7X9՝P�\-aG��@r��"\��6u��8��a�c�f�垌U=|�d�osR�m^��\�=�5?D��uT�5��R��1v]u��7fB��&��6Ҫ.��r�ێl�_?��r��W|��T��U��>b��)F��y��C��ϙ'd�T$�T��T�ͩZG�@�l��E.��u��'��)/׳%*vF��o0@��T��3A#|CYTy�k\'��ױ�6M�P�.��yi�{�gj>oo3l-�Y��|��|��y0}7�:�$��Bޟ�y��]�*��x~�|�z��_��?:J�=�Ӣҳ��H'�z��|��C��YN�]H�]rHР4��s��7%�5�Yf��~�=͹<��A��=b��N��8'P��&��mP��ɵh�J��k��R]P�ozr�n��s;�f��??}��rP=��#k�%Y��hOY�/ ��D�2�s�D�Ն�i��z]!�~��01��W�Ǫ3��*C�7�=Z�7I*��3�a�b0a&�6>�ҽ��酯�ز5�t'=�4P)�cd�r:ȗ�!�Kc� .��<� �f@�J2�.��b֡�d�Ռu��n� ��x��W!�U�@��/�L��2Xo�ߟe�5y�{�\��4��o?��W� ʚ2�8D��0Y?�y��[��z�~\��ZV��d~��\L��Q��xQz?_4{��w?>�WTSSȫäB�z�@��!��޳8W�"��s��raE,|��˧��L7�do�J��t��Q9��'Q�4��OaZ^e@L|#�EQ�¾\w�k҄r�5N��7�;�ϸ��˝id��Yy��m�&�c �RՄ;i��^�GH�5" "Į��ר�s=w�!%��'��S;v�ٱ�-��ޢ��lX��U�4��1+�(^��F�@��};��>ՙ*�t|x��t�u��`N�'��?�p��*�p��U2��[{p��`N�'��˻��Ѓ�oFN�^��c�8��a�%v�o(vv̘��X�_BX>F��.��B�u��X��"�*��;Gx�!< l�τi��m��&��HsS�+��i<��H��N ��4��y#L}�'�t��905�y�Z�B~,Q�ُ�]��گ0��Nڂ��ݵE�.'��w��w8��{��ww��kQ�@�0��", "00000001�00000001]00000001Q00000001O00000001�00000001025f�5>��`��4AB��n(�A��k't�]�ڕWR�k��zW8��pH^�֮B&��m�5JA��W�A)%�x� �1��"��%0�3 E1\�?�dM#�'��(ܾb�b¾R�}��5Z�,ũ�f"0y��Y�q��n�)�?Q�Y� _�/��:�a�B�t��U�k��5r5T�5"�p��G��T!�(��q��̴�[��[��R�v9��sj��-��f�.V#y��l\6�5��_��۪%�7G��F��*w)�|e틴��ɨl�5+��-C�S�,~<|}��V��d�z��:e^��wMP�l}ʊ��KMTr\��ؚX�*��lCA��LK��J��`�gah�>��"�v�Z'�D?�x9��(�f��i��A�q�a�G��X�=p|��ÉN0d��X*r�T�B��]�@kiW��I�z��zTs�Cx�Z�Po�İFaq�3YN:�9�r7�8�*'D��|�ѹt�*�8�;w�h�^�!M!£��)�(4�hyh4ų9N��#��ˎF��", "00000001�00000001]00000001�00000001o00000001�0000000160000000100000001�00000001W00000001�00000001R00000001�0000000100000001f001�707q�&K^�y]�d��6@۽)�<{�!O��n��'��,Jԅy$թOma�ǻOy�Q-�(]�)��o=��)"9,�E��Ô�Z(�E�]�)��A�*K0ŀ�F`�);�ǀCE��0�q??0E䄫(LIK��&U�r��RU��h�L��Ksa��V�v:�SL�a=�]�)��o=��)"w�ϑ��z!�3��UMW�*��"�l�X(X3U�ʈe�;s/P1Li!4�[��L�5�u�v�A�K�b��cõ�ǂ��!��h��`Z��M��S�i�3�i��蘆��.lU#e��q��4�ң��׫��}�V�ɒl��7�@��]QI��R��y��O��Z=I]��d��m��$F�İ&1"'[hQ��??[�r3��ft��q��`+tx�Rkǆ(m��4�b@��a��w��zvU��N��o��^��k�_��_�]��7iߛT�7)��B��Q�i&v�F*��P��a>��D$�Y�h�Oxa~��9??H/K�Gz�yN(̋��a�"?#�@gec��"�H.�4��4�v�z�j��O��iO�р�k�\��0P|��JB��ar��iJ弝~Y|_��؏�s8F��=Ǣ��"�H绘H�ؗ�{�Q��t��O9��@ٿ��O^��X��US?X��<�%�z̖��p��fĶ��/<�|^|�,� ��l�<��Xq��Gp�Դ��/��W4��O.��n��<��8`��G/��>k�/�w�?G�KB�Og�o�Vۗ�0^fak/��p�Iw�v�8��ȉ�Q��n�\��%?I֟Bo=�i[��yS�I;��L�\_��K�|�/��JZ2�7��R�u:�e�M��JҾz�0�~�z}�e�Q|�5q�o�ck�-��o�[�$��_��y?u��M/��ǳ$�˸��p��vu:��.xu�?�?M��>�H��}R&��Y�(&%f�g9��N\�!:ڽ=)C��J'A*��yy/�7s$��E��R��z�/�KJ��DQs�N�Y��u`{�d��L(`9ډ�!�Fo{\Y2", "lŜ/��$w��B.Ir_D��*��,[��#��i��0��Ddp�,rHK��R�K�S��d��O��í�$~BF�[HL�Z��X[+q(�5̲zj��$��4�G>��S��C��V�K��/��)�xy$�g�3ZLp��>8$��T�]��oa"��1_$T�0��V>�;��E��1�ԯ�)��s�*ǘ��\�Bl&E�F�N��ʻ�/G��yCJz��"&Ci��<�^�W�C��8��x��q��t.��<��n�^��5�y��S�XSK'sy�U1�3;=�?gC�@@2*uo�#CH��6�"C`��!Ql�W�5�c"`��ҹ�rZ5�yO2l��Ȑ�>0�߀!e ��75�v��A��evg��n�7��1[��XM��oX�o(�t.�\�oV��@�ӂ�Z:�-~#�;��7`H@�A�o�UX,�*�.��n�7��1[��XM��oX�o(�t.�\�oV��@�c�&(��H��&z��^��vX�Rf1H��~�/��$$GN�pU��$��r*�-��}n��", "00000001�00000001]00000001M00000001o00000001�00000001@0000000100000001�00000001+00000001>00000001&00000001�00000001�00000001�00051bFm%��KU�JI�67l��k��#��Bf��0&=��of�7<��jIĴ$�/��[��%E�@�CkId`�ZRm�իZ3@��0�Z3�%�l�{�t��L��Z�5�f�\��uS��ӓ��U_��D��I��$�/��[��'E�@�#Y[F�-Վ��jK��n�}jK��L�҄I�72��4ܠЖD��iK�r,�/r�"w�%�bڒŗ�ͭSז�n �hKd��R��߫�4@ڨ%�0L��\��n�j�~��C]�''/K�,��I"w��%�b�ŗ�ͭS��n ��Kd��e�a@]j��^�D��e�'�V�a��ƴ��~raY'�s>�v�K�Q�G:Mcb��&��[+h��0�c�ƴw�W�Lc�V��R9��|�Vʆ�H�N�/��K��>��ܧ��Sy�8cO��ؗ��î��;SV})cww�40\�J&#\�X;G��f��%z|��U�i��ЗJ��l�p��5d3޵��s�o�+�3�M�D�yf<|O`ƃ��f��_�(<3��饌�:V��Ydn�z�V4c\�2��>[`�:��C��Y�`j3�Aҍ>{ɜ�0�z�\��M��??�'��N%�_�E�^}��W-��b��&��2;n�e$�Ψ�k��+#?��V�5]Q�~V�:-�v�Z�Vl��>��O1��G(-�V�vCtfs9��%(KU��(0 }Q`X"��F�!ɭ��ü��EA!��BR��d*IT��(,$MQXH��Ki��4Ϩ��p�b��"��E�3��%�F ��u�Tp�-^��%�v�Br�Y�c!�� ݱp�Ƌ��(��GQf��#(��u��ѓY�:C��;�[�3٣��=��w"̱�H��Rv��4��L��p�X��Ӈ��\jn6Q�=�T��d�8\��1��Ժ:/�^��eW��^/5��K��_�e��Fy�E%��v5��&��wE��яW�t_ޕ�Uj�_�`�r��]T-t��T߱�$��(��$zN�Y�U�FN�$��"��%��]fk�V�z��kqÔ��O�Q�H�o��%��O��ya��dӭ��"6e:Taa6,Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Wed, 29 Nov 2023 05:49:10 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Wed, 29 Nov 2023 05:49:13 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Wed, 29 Nov 2023 05:49:20 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: store.steampowered.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Thu, 23 Nov 2023 22:42:38 GMTExpires: Fri, 22 Nov 2024 22:42:38 GMTLast-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Age: 457581Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: twitter.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /demo/home.php?s=67.218.111.202 HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001172.00000001.67061.01D90000.00000004.mdmp") Found string "-iHTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00001172.00000001.67061.01D90000.00000004.mdmp") Found string "HTTP/1.1 403 Forbidden" (Indicator: "HTTP/1.1"; Source: "00000000-00001172.00000001.67061.01D90000.00000004.mdmp") Found string "GET /geoip/v2.1/city/me HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001172.00000001.67061.01D90000.00000004.mdmp")6f:T3bc1,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEATh56TcXPL" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEAx5qUSwjBG" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6U" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 29 Nov 2023 05:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 29 Nov 2023 05:03:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpg" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCLPpgizFvtXApe3cL6kC3u HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZR" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZR" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk4" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "5WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6q" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDmzKJl66ZMrRKtZxoAGQQd HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQDmzKJ" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDmzKJl66ZMrRKtZxoAGQQd HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9J" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCVN9Jf3G%2B1pAqd7QzTt1vx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnx" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffH" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vd" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"70:T51f,"87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00002152) "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002152) "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f.exe" called "FindNextFileW" with parameter 5dD8fu8.exe (UID: 00000000-00002152) "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f.exe" called "FindNextFileW" with parameter Cz3Js38.exe (UID: 00000000-00002152) "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00002152) "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00002152) "Cz3Js38.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00002880) "Cz3Js38.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002880) "Cz3Js38.exe" called "FindNextFileW" with parameter 4Ai174ie.exe (UID: 00000000-00002880) "Cz3Js38.exe" called "FindNextFileW" with parameter we4pZ94.exe (UID: 00000000-00002880) "Cz3Js38.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00002880) "Cz3Js38.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00002880)71:Tc6c,file/memory contains long string with (Indicator: "base64"; File: "shared_responsive_1_.css") file/memory contains long string with (Indicator: "base64"; File: "header_1_.css") file/memory contains long string with (Indicator: "aes"; File: "SSL") Found string "FromBase64" (Indicator: "base64"; File: "00003632.00000E30.1806736.00402000.wprm") Found string "AesGcm256" (Indicator: "aes"; File: "00003632.00000E30.1806736.00402000.wprm") Found string "AesFastEngine" (Indicator: "aes"; File: "00003632.00000E30.1806736.00402000.wprm") Found string "FromBase64String" (Indicator: "base64"; File: "00003632.00000E30.1806736.00402000.wprm") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "00003632.00000E30.1806736.00402000.wprm") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00003632.00000E30.1806736.00402000.wprm") Found string "base64str" (Indicator: "base64"; File: "00003632.00000E30.1806736.00402000.wprm") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "00003632.00000E30.1806736.00402000.wprm") Found string "FromBase64CharArray" (Indicator: "base64"; File: "00003632.00000E30.1806736.00402000.wprm") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00003632.00000E30.1806736.00402000.wprm") file/memory contains long string with (Indicator: "base64"; File: "identifier_1_.htm") file/memory contains long string with (Indicator: "aes"; File: "identifier_2_.htm") file/memory contains long string with (Indicator: "base64"; File: "identifier_2_.htm") Found string "FromBase64" (Indicator: "base64"; Source: "00000000-00000680.00000000.67400.01459000.00000004.mdmp") Found string "AesGcm256" (Indicator: "aes"; Source: "00000000-00000680.00000000.67400.01459000.00000004.mdmp") Found string "AesFastEngine" (Indicator: "aes"; Source: "00000000-00000680.00000000.67400.01459000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00000680.00000000.67400.01459000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00000680.00000000.67400.01459000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00000680.00000000.67400.01459000.00000004.mdmp") Found string "base64str" (Indicator: "base64"; Source: "00000000-00000680.00000000.67400.01459000.00000004.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000680.00000000.67400.01459000.00000004.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; Source: "00000000-00000680.00000000.67400.01459000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000680.00000000.67400.01459000.00000004.mdmp") Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000784.00000000.69204.000A0000.00000004.mdmp, 00000000-00000784.00000001.69227.000A0000.00000004.mdmp")72:T75c,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "00003632.00000E30.1806736.00402000.wprm") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; File: "00003632.00000E30.1806736.00402000.wprm") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "00003632.00000E30.1806736.00402000.wprm") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "00003632.00000E30.1806736.00402000.wprm") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00000680.00000000.67400.01459000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00000680.00000000.67400.01459000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00000680.00000000.67400.01459000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00000680.00000000.67400.01459000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001172.00000000.66012.001E7000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001172.00000000.66012.001E7000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001172.00000000.66012.001E7000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001172.00000000.66012.001E7000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00001172.00000000.66012.001E7000.00000002.mdmp")73:T48d,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "87252d3c1de3dcefbd12de44b7345b00b9bdace2e4b5f.exe") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00000680.00000000.67407.01437000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00000680.00000000.67407.01437000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00000784.00000000.69204.00C07000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00000784.00000000.69204.00C07000.00000002.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00001172.00000000.66012.001E7000.00000002.mdmp")74:T128d,Found string "ZIndicates if the text in the edit control should appear as the default password character." (Indicator: "password"; File: "00003632.00000E30.1806736.00402000.wprm") Found string "ZIndicates if the text in the edit control should appear as the default password character." (Indicator: "password"; Source: "00000000-00000680.00000000.67400.01459000.00000004.mdmp") Found string "passwords.txt" (Indicator: "password"; Source: "00000000-00001172.00000001.67061.01D90000.00000004.mdmp") Found string "socks5_password" (Indicator: "password"; Source: "00000000-00001172.00000001.67061.01D90000.00000004.mdmp") Found string "mark_check_passwords" (Indicator: "password"; Source: "00000000-00001172.00000001.67061.01D90000.00000004.mdmp") Found string "No Caps LockHCaps Lock is on, which may cause you to enter your password incorrectly." (Indicator: "password"; Source: "00000000-00001172.00000001.67061.02800000.00000002.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00001172.00000001.67061.02800000.00000002.mdmp") Found string "Use Internet connection: {0}/Dial-up or broadband with username and password" (Indicator: "password"; Source: "00000000-00001172.00000001.67061.02800000.00000002.mdmp") Found string "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password, and be available to all users." (Indicator: "password"; Source: "00000000-00001172.00000001.67061.02800000.00000002.mdmp") Found string "Enter Your Dial-Up PassworddEnter the password for the connection you selected. You must use the keyboard to enter the password.P" (Indicator: "password"; Source: "00000000-00001172.00000001.67061.02800000.00000002.mdmp") Found string "Confirm Password5These passwords do not match. Re-enter the passwords./Manually Download the TV Program Guide listings" (Indicator: "password"; Source: "00000000-00001172.00000001.67061.02800000.00000002.mdmp") Found string "Windows Media Center requires an Internet connection with a saved password for all users to automatically download TV Program Guide listings." (Indicator: "password"; Source: "00000000-00001172.00000001.67061.02800000.00000002.mdmp") Found string "This feature is not compatible with password-protected screen savers. To use this feature, disable the password protection on your Windows screen saver." (Indicator: "password"; Source: "00000000-00001172.00000001.67061.02800000.00000002.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00001172.00000001.67061.02800000.00000002.mdmp") Found string "Username or password error" (Indicator: "password"; Source: "00000000-00001172.00000001.67061.02800000.00000002.mdmp") Found string "The username or password entered does not appear to be correct. Verify that the username and password are valid for the shared folder on the other computer.P" (Indicator: "password"; Source: "00000000-00001172.00000001.67061.02800000.00000002.mdmp") Found string "No username entered0A password cannot be entered without a username." (Indicator: "password"; Source: "00000000-00001172.00000001.67061.02800000.00000002.mdmp") Found string "Remember my password" (Indicator: "password"; Source: "00000000-00001172.00000001.67061.02800000.00000002.mdmp") file/memory contains long string with (Indicator: "secret"; Source: "00000000-00001172.00000001.67061.02800000.00000002.mdmp") Found string "Windows Media Center is unable to connect to the internet. Please check your username and password for your default Internet connection.%0" (Indicator: "password"; Source: "00000000-00001172.00000001.67061.02800000.00000002.mdmp") Found string "Windows Update was unable to connect to proxy server %1 because valid credentials (user name and password) were required, but were either not available or were incorrect. Please check your proxy credentials, and then try searching again for updates." (Indicator: "password"; Source: "00000000-00001172.00000001.67061.02800000.00000002.mdmp") Found string "Ask for password (NTLM)P" (Indicator: "password"; Source: "00000000-00001172.00000001.67061.02800000.00000002.mdmp") Found string "You have chosen to make this site available offline and add it to your Active Desktop interface. If this site needs a password, please choose Customize and enter it." (Indicator: "password"; Source: "00000000-00001172.00000001.67061.02800000.00000002.mdmp") Found string "Type your user name and password for this site." (Indicator: "password"; Source: "00000000-00001172.00000001.67061.02800000.00000002.mdmp") Found string "If the site requires a user name and password:" (Indicator: "password"; Source: "00000000-00001172.00000001.67061.02800000.00000002.mdmp")75:T516,"%TEMP%\grandUIA7jny9bXVG7b3K\Files\AppData\Local\Microsoft\Credentials" (Indicator: "\microsoft\credentials"; File: "00000000-00001172-00000C38-25375781553") "%TEMP%\grandUIA7jny9bXVG7b3K\Files\AppData\Local\Microsoft\Vault" (Indicator: "\microsoft\vault"; File: "00000000-00001172-00000C38-26591809599") "%TEMP%\grandUIA7jny9bXVG7b3K\Files\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28" (Indicator: "\microsoft\vault"; File: "00000000-00001172-00000C38-26594204283") "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIA7jny9bXVG7b3K\Files\Microsoft\Vault" (Indicator: "\microsoft\vault"; File: "00000000-00001172.00000001.67061.004C0000.00000004.mdmp") "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIA7jny9bXVG7b3K\Files\AppData\Local\Microsoft\Vault" (Indicator: "\microsoft\vault"; File: "00000000-00001172.00000001.67061.004C0000.00000004.mdmp") "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIA7jny9bXVG7b3K\Files\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28" (Indicator: "\microsoft\vault"; File: "00000000-00001172.00000001.67061.01D90000.00000004.mdmp") "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIA7jny9bXVG7b3K\Files\AppData\Local\Microsoft\Credentials" (Indicator: "\microsoft\credentials"; File: "00000000-00001172.00000001.67061.01D90000.00000004.mdmp")76:T956,"new_login_bg_strong_mask_1_.jpg" has type "JPEG image data Exif standard: [TIFF image data little-endian direntries=0] baseline precision 8 1920x1080 components 3" and extension "jpg" "dinosaur_1_.png" has type "PNG image data 1200 x 800 8-bit/color RGBA non-interlaced" and extension "png" "header_logo_2_.png" has type "PNG image data 744 x 171 8-bit/color RGBA non-interlaced" and extension "png" "firefox_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "yt_logo_rgb_light_1_.png" has type "PNG image data 1588 x 356 8-bit colormap non-interlaced" and extension "png" "edgium_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "chrome_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "header_menu_hamburger_2_.png" has type "PNG image data 244 x 212 8-bit/color RGBA non-interlaced" and extension "png" "footerLogo_valve_1_.png" has type "PNG image data 96 x 26 8-bit/color RGBA non-interlaced" and extension "png" "logo_steam_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png" "footerLogo_valve_new_1_.png" has type "PNG image data 176 x 50 8-bit/color RGBA non-interlaced" and extension "png" "opera_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced" and extension "png" "logo_valve_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png" "ico_twitter_1_.gif" has type "GIF image data version 89a 16 x 16" and extension "gif" "ico_facebook_1_.gif" has type "GIF image data version 89a 16 x 16" and extension "gif" "logo46x38_1_.png" has type "PNG image data 46 x 38 8-bit/color RGBA non-interlaced" and extension "png" "btn_header_installsteam_download_1_.png" has type "PNG image data 15 x 13 8-bit/color RGBA non-interlaced" and extension "png" "btn_arrow_down_padded_1_.png" has type "PNG image data 19 x 12 8-bit/color RGBA non-interlaced" and extension "png" "header_logo_1_.png" has type "PNG image data 744 x 171 8-bit/color RGBA non-interlaced" and extension "png" "header_menu_hamburger_1_.png" has type "PNG image data 244 x 212 8-bit/color RGBA non-interlaced" and extension "png" "logo_valve_footer_2_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png"77:T1000a,"initAft()