26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 7b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T499,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample ab08505aa422… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ab08505aa422…. Malware family: Crifi.Generic. Threat score 100/100. 12/24 AV engines flagged this file. 27 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92"],"about":{"@type":"SoftwareApplication","name":"c7fffbee15d5fb4fafd44c29466adeae","applicationCategory":["peexe","executable"],"identifier":"ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":12,"total":24},"behavioralIndicators":{"malicious":27,"suspicious":34},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T25c4,Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolder"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBeep"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")28:T77e,"ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "FindResourceA" with parameter "19599992" - (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "FindResourceA" with parameter "19600000" - (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "FindResourceA" with parameter "19600028" - (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "FindResourceA" with parameter "19600240" - (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "FindResourceA" with parameter "19600056" - (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "FindResourceA" with parameter "19600212" - (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "FindResourceA" with parameter "19600224" - (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "FindResourceA" with parameter "850260" - (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "FindResourceA" with parameter "19600108" - (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "FindResourceA" with parameter "19600204" - (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "FindResourceA" with parameter "850256" - (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "FindResourceA" with parameter "19600072" - (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "FindResourceA" with parameter "19600080" - (UID: 00000000-00004392)29:T8ac,"ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19646592'}" (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19646448'}" (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19646608'}" (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19646496'}" (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19646464'}" (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19646512'}" (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19646560'}" (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19646432'}" (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19646544'}" (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19646576'}" (UID: 00000000-00004392) "yI4Yr04.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14010336'}" (UID: 00000000-00004408) "yI4Yr04.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14010448'}" (UID: 00000000-00004408) "yI4Yr04.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14010480'}" (UID: 00000000-00004408) "yI4Yr04.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '14010464'}" (UID: 00000000-00004408)2a:T638,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000292.00000000.74976.00230000.00000004.mdmp, 00000000-00000292.00000000.74976.00A47000.00000002.mdmp, 00000000-00000292.00000001.76898.00230000.00000004.mdmp, 00000000-00000292.00000002.78821.00230000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000292.00000000.74976.00230000.00000004.mdmp, 00000000-00000292.00000000.74976.00A47000.00000002.mdmp, 00000000-00000292.00000001.76898.00230000.00000004.mdmp, 00000000-00000292.00000002.78821.00230000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001704.00000000.79214.00390000.00000004.mdmp, 00000000-00001704.00000001.81135.00390000.00000004.mdmp, 00000000-00001704.00000002.83060.00390000.00000004.mdmp, 00000000-00001704.00000002.83060.00CC7000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001704.00000000.79214.00390000.00000004.mdmp, 00000000-00001704.00000001.81135.00390000.00000004.mdmp, 00000000-00001704.00000002.83060.00390000.00000004.mdmp, 00000000-00001704.00000002.83060.00CC7000.00000002.mdmp")2b:T4ff,"1dS08HT5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}") "1dS08HT5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PROPERTYBAG") "1dS08HT5.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1") "1dS08HT5.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\KNOWNFOLDERS") "1dS08HT5.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "1dS08HT5.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "1dS08HT5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS") "1dS08HT5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}") "1dS08HT5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}")2c:T131e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-15-00D01F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-15-00D01F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-16-00D044B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-16-00D044B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-22-00D0681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-22-00D0681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-26-00D024E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-26-00D024E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-29-00D052B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-29-00D052B6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003260-49957-31-00D02390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003260-49957-31-00D02390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-33-00D02F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-33-00D02F1D Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003260-49957-36-00D03BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003260-49957-36-00D03BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-37-00D03FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-37-00D03FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-40-00D02267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-40-00D02267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-41-00D06495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-41-00D06495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-42-00D0202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00003260-49957-42-00D0202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-42-00D0202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-43-00D01AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-43-00D01AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-44-00D02AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-44-00D02AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-52-00D04EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-52-00D04EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-57-00D06298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-57-00D06298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-59-00D0621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-59-00D0621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-60-00D0597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-60-00D0597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-62-00D055A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-62-00D055A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-63-00D05467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-63-00D05467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-65-00D053A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-65-00D053A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-66-00D02630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-66-00D02630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-71-00D02CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-71-00D02CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-72-00D018A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-72-00D018A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003260-49957-73-00D017EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003260-49957-73-00D017EE2d:Tdddf,Found XOR loop in file "wI7qO24.exe" at offset 183471; code bytes = 30d0 Found XOR loop in file "wI7qO24.exe" at offset 203791; code bytes = 30d0 Found XOR loop in file "wI7qO24.exe" at offset 223379; code bytes = 30d0 Found XOR loop in file "wI7qO24.exe" at offset 358823; code bytes = 30d0 Found XOR loop in file "wI7qO24.exe" at offset 581063; code bytes = 30d0 Found XOR loop in file "wI7qO24.exe" at offset 759419; code bytes = 30d0 Found XOR loop in file "wI7qO24.exe" at offset 816167; code bytes = 30d0 Found XOR loop in file "wI7qO24.exe" at offset 925002; code bytes = 30d0 Found XOR loop in file "wI7qO24.exe" at offset 948022; code bytes = 30d0 Found XOR loop in file "wI7qO24.exe" at offset 967858; code bytes = 30d0 Found XOR loop in file "wI7qO24.exe" at offset 1454379; code bytes = 30d0 Found XOR loop in file "wI7qO24.exe" at offset 1516254; code bytes = 30d0 Found XOR loop in file "wI7qO24.exe" at offset 1539417; code bytes = 30d0 Found XOR loop in file "wI7qO24.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 202618; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 295163; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 308514; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 465940; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 540336; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 567242; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 742106; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 764284; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 871095; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 892125; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 917461; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 979843; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 1023638; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 1183334; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 1234236; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 1257161; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 1278401; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 1322799; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 1454877; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 1463480; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 1491029; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 1546448; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 1547791; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 1553162; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 1618639; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 1647033; code bytes = 33c1 Found XOR loop in file "wI7qO24.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 252274; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 379440; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 388581; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 481709; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 556324; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 556608; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 660316; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 669664; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 684780; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 806586; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 858696; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 915252; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 1027843; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 1133884; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 1176714; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 1181665; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 1223103; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 1264367; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 1280830; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 1281894; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 1299119; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 1305617; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 1427601; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 1461624; code bytes = 8030 Found XOR loop in file "wI7qO24.exe" at offset 1569112; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 1274152; code bytes = 30d0 Found XOR loop in file "1dS08HT5.exe" at offset 1287765; code bytes = 30d0 Found XOR loop in file "1dS08HT5.exe" at offset 1485168; code bytes = 30d0 Found XOR loop in file "1dS08HT5.exe" at offset 1507775; code bytes = 30d0 Found XOR loop in file "1dS08HT5.exe" at offset 1514635; code bytes = 30d0 Found XOR loop in file "1dS08HT5.exe" at offset 1514887; code bytes = 30d0 Found XOR loop in file "1dS08HT5.exe" at offset 1515347; code bytes = 30d0 Found XOR loop in file "1dS08HT5.exe" at offset 1516553; code bytes = 30d0 Found XOR loop in file "1dS08HT5.exe" at offset 1521461; code bytes = 30d0 Found XOR loop in file "1dS08HT5.exe" at offset 1522625; code bytes = 30d0 Found XOR loop in file "1dS08HT5.exe" at offset 1538921; code bytes = 30d0 Found XOR loop in file "1dS08HT5.exe" at offset 688249; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 688345; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 688444; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 688500; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 688526; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 688604; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 688747; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 688843; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 689850; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 690446; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 764137; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 817238; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 817472; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 909588; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 924330; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 942350; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 948128; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 953465; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 953616; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 969842; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 971092; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 983876; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 985045; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 985160; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 989471; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 989786; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 990362; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 992172; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 992479; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 992865; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 992957; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 993612; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 995617; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 999815; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 1000389; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 1001271; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 1001375; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 1002055; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 1002170; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 1006463; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 1007340; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 1027259; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 1033356; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 1034159; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 1289436; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 1441388; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 1505345; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 1507059; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 1513223; code bytes = 33c1 Found XOR loop in file "1dS08HT5.exe" at offset 735579; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 735612; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 735686; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 735764; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 735781; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 735802; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 735842; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 735923; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 735946; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 735963; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 736030; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 736068; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 736997; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 737018; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 833270; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 838380; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 845494; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 845523; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 857223; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 869347; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 869366; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 869863; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 925121; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 925175; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 925196; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 925223; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 925256; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 925280; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 925297; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 925319; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 925429; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 925471; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 1337260; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 1349610; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 1362066; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 1495860; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 1517374; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 1521442; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 1522614; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 1523404; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 1537116; code bytes = 8030 Found XOR loop in file "1dS08HT5.exe" at offset 1538890; code bytes = 8030 Found XOR loop in file "2ve1925.exe" at offset 1171789; code bytes = 30d0 Found XOR loop in file "2ve1925.exe" at offset 1175659; code bytes = 30d0 Found XOR loop in file "2ve1925.exe" at offset 1182055; code bytes = 30d0 Found XOR loop in file "2ve1925.exe" at offset 1185437; code bytes = 30d0 Found XOR loop in file "2ve1925.exe" at offset 1186765; code bytes = 30d0 Found XOR loop in file "2ve1925.exe" at offset 1187511; code bytes = 30d0 Found XOR loop in file "2ve1925.exe" at offset 116114; code bytes = 33c1 Found XOR loop in file "2ve1925.exe" at offset 179700; code bytes = 33c1 Found XOR loop in file "2ve1925.exe" at offset 179872; code bytes = 33c1 Found XOR loop in file "2ve1925.exe" at offset 180165; code bytes = 33c1 Found XOR loop in file "2ve1925.exe" at offset 186052; code bytes = 33c1 Found XOR loop in file "2ve1925.exe" at offset 186224; code bytes = 33c1 Found XOR loop in file "2ve1925.exe" at offset 186517; code bytes = 33c1 Found XOR loop in file "2ve1925.exe" at offset 211271; code bytes = 33c1 Found XOR loop in file "2ve1925.exe" at offset 305533; code bytes = 33c1 Found XOR loop in file "2ve1925.exe" at offset 707193; code bytes = 33c1 Found XOR loop in file "2ve1925.exe" at offset 1168291; code bytes = 33c1 Found XOR loop in file "2ve1925.exe" at offset 1172267; code bytes = 33c1 Found XOR loop in file "2ve1925.exe" at offset 1173607; code bytes = 33c1 Found XOR loop in file "2ve1925.exe" at offset 1174505; code bytes = 33c1 Found XOR loop in file "2ve1925.exe" at offset 825652; code bytes = 8030 Found XOR loop in file "2ve1925.exe" at offset 840522; code bytes = 8030 Found XOR loop in file "2ve1925.exe" at offset 889811; code bytes = 8030 Found XOR loop in file "2ve1925.exe" at offset 1180548; code bytes = 8030 Found XOR loop in file "2ve1925.exe" at offset 1181350; code bytes = 8030 Found XOR loop in file "2ve1925.exe" at offset 1182024; code bytes = 8030 Found XOR loop in file "2ve1925.exe" at offset 1184658; code bytes = 8030 Found XOR loop in file "2ve1925.exe" at offset 1187200; code bytes = 8030 Found XOR loop in file "yI4Yr04.exe" at offset 179961; code bytes = 30d0 Found XOR loop in file "yI4Yr04.exe" at offset 263056; code bytes = 30d0 Found XOR loop in file "yI4Yr04.exe" at offset 485182; code bytes = 30d0 Found XOR loop in file "yI4Yr04.exe" at offset 663456; code bytes = 30d0 Found XOR loop in file "yI4Yr04.exe" at offset 720179; code bytes = 30d0 Found XOR loop in file "yI4Yr04.exe" at offset 828949; code bytes = 30d0 Found XOR loop in file "yI4Yr04.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "yI4Yr04.exe" at offset 181589; code bytes = 33c1 Found XOR loop in file "yI4Yr04.exe" at offset 212763; code bytes = 33c1 Found XOR loop in file "yI4Yr04.exe" at offset 370116; code bytes = 33c1 Found XOR loop in file "yI4Yr04.exe" at offset 444479; code bytes = 33c1 Found XOR loop in file "yI4Yr04.exe" at offset 471361; code bytes = 33c1 Found XOR loop in file "yI4Yr04.exe" at offset 646151; code bytes = 33c1 Found XOR loop in file "yI4Yr04.exe" at offset 668304; code bytes = 33c1 Found XOR loop in file "yI4Yr04.exe" at offset 775075; code bytes = 33c1 Found XOR loop in file "yI4Yr04.exe" at offset 796097; code bytes = 33c1 Found XOR loop in file "yI4Yr04.exe" at offset 821408; code bytes = 33c1 Found XOR loop in file "yI4Yr04.exe" at offset 1087176; code bytes = 33c1 Found XOR loop in file "yI4Yr04.exe" at offset 1138053; code bytes = 33c1 Found XOR loop in file "yI4Yr04.exe" at offset 1156537; code bytes = 33c1 Found XOR loop in file "yI4Yr04.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "yI4Yr04.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "yI4Yr04.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "yI4Yr04.exe" at offset 283657; code bytes = 8030 Found XOR loop in file "yI4Yr04.exe" at offset 292798; code bytes = 8030 Found XOR loop in file "yI4Yr04.exe" at offset 385885; code bytes = 8030 Found XOR loop in file "yI4Yr04.exe" at offset 460459; code bytes = 8030 Found XOR loop in file "yI4Yr04.exe" at offset 460743; code bytes = 8030 Found XOR loop in file "yI4Yr04.exe" at offset 564394; code bytes = 8030 Found XOR loop in file "yI4Yr04.exe" at offset 573742; code bytes = 8030 Found XOR loop in file "yI4Yr04.exe" at offset 588858; code bytes = 8030 Found XOR loop in file "yI4Yr04.exe" at offset 710598; code bytes = 8030 Found XOR loop in file "yI4Yr04.exe" at offset 762676; code bytes = 8030 Found XOR loop in file "yI4Yr04.exe" at offset 931758; code bytes = 8030 Found XOR loop in file "yI4Yr04.exe" at offset 1037759; code bytes = 8030 Found XOR loop in file "yI4Yr04.exe" at offset 1080564; code bytes = 8030 Found XOR loop in file "yI4Yr04.exe" at offset 1085507; code bytes = 8030 Found XOR loop in file "yI4Yr04.exe" at offset 1126937; code bytes = 8030 Found XOR loop in file "zS3mh13.exe" at offset 273895; code bytes = 30d0 Found XOR loop in file "zS3mh13.exe" at offset 329386; code bytes = 30d0 Found XOR loop in file "zS3mh13.exe" at offset 390149; code bytes = 30d0 Found XOR loop in file "zS3mh13.exe" at offset 568326; code bytes = 30d0 Found XOR loop in file "zS3mh13.exe" at offset 625016; code bytes = 30d0 Found XOR loop in file "zS3mh13.exe" at offset 733745; code bytes = 30d0 Found XOR loop in file "zS3mh13.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "zS3mh13.exe" at offset 147919; code bytes = 33c1 Found XOR loop in file "zS3mh13.exe" at offset 349454; code bytes = 33c1 Found XOR loop in file "zS3mh13.exe" at offset 376328; code bytes = 33c1 Found XOR loop in file "zS3mh13.exe" at offset 551029; code bytes = 33c1 Found XOR loop in file "zS3mh13.exe" at offset 573174; code bytes = 33c1 Found XOR loop in file "zS3mh13.exe" at offset 679887; code bytes = 33c1 Found XOR loop in file "zS3mh13.exe" at offset 700901; code bytes = 33c1 Found XOR loop in file "zS3mh13.exe" at offset 726204; code bytes = 33c1 Found XOR loop in file "zS3mh13.exe" at offset 991841; code bytes = 33c1 Found XOR loop in file "zS3mh13.exe" at offset 1030073; code bytes = 33c1 Found XOR loop in file "zS3mh13.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "zS3mh13.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "zS3mh13.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "zS3mh13.exe" at offset 185308; code bytes = 8030 Found XOR loop in file "zS3mh13.exe" at offset 288876; code bytes = 8030 Found XOR loop in file "zS3mh13.exe" at offset 365426; code bytes = 8030 Found XOR loop in file "zS3mh13.exe" at offset 365710; code bytes = 8030 Found XOR loop in file "zS3mh13.exe" at offset 469321; code bytes = 8030 Found XOR loop in file "zS3mh13.exe" at offset 478653; code bytes = 8030 Found XOR loop in file "zS3mh13.exe" at offset 493761; code bytes = 8030 Found XOR loop in file "zS3mh13.exe" at offset 615443; code bytes = 8030 Found XOR loop in file "zS3mh13.exe" at offset 667505; code bytes = 8030 Found XOR loop in file "zS3mh13.exe" at offset 836497; code bytes = 8030 Found XOR loop in file "zS3mh13.exe" at offset 942440; code bytes = 8030 Found XOR loop in file "zS3mh13.exe" at offset 985229; code bytes = 8030 Found XOR loop in file "zS3mh13.exe" at offset 990172; code bytes = 8030 Found XOR loop in file "zS3mh13.exe" at offset 1006330; code bytes = 8030 Found XOR loop in file "5FM8xM9.exe" at offset 947533; code bytes = 30d0 Found XOR loop in file "5FM8xM9.exe" at offset 951403; code bytes = 30d0 Found XOR loop in file "5FM8xM9.exe" at offset 957799; code bytes = 30d0 Found XOR loop in file "5FM8xM9.exe" at offset 961181; code bytes = 30d0 Found XOR loop in file "5FM8xM9.exe" at offset 962509; code bytes = 30d0 Found XOR loop in file "5FM8xM9.exe" at offset 963255; code bytes = 30d0 Found XOR loop in file "5FM8xM9.exe" at offset 116114; code bytes = 33c1 Found XOR loop in file "5FM8xM9.exe" at offset 179700; code bytes = 33c1 Found XOR loop in file "5FM8xM9.exe" at offset 179872; code bytes = 33c1 Found XOR loop in file "5FM8xM9.exe" at offset 180165; code bytes = 33c1 Found XOR loop in file "5FM8xM9.exe" at offset 186052; code bytes = 33c1 Found XOR loop in file "5FM8xM9.exe" at offset 186224; code bytes = 33c1 Found XOR loop in file "5FM8xM9.exe" at offset 186517; code bytes = 33c1 Found XOR loop in file "5FM8xM9.exe" at offset 211271; code bytes = 33c1 Found XOR loop in file "5FM8xM9.exe" at offset 305533; code bytes = 33c1 Found XOR loop in file "5FM8xM9.exe" at offset 707193; code bytes = 33c1 Found XOR loop in file "5FM8xM9.exe" at offset 944035; code bytes = 33c1 Found XOR loop in file "5FM8xM9.exe" at offset 948011; code bytes = 33c1 Found XOR loop in file "5FM8xM9.exe" at offset 949351; code bytes = 33c1 Found XOR loop in file "5FM8xM9.exe" at offset 950249; code bytes = 33c1 Found XOR loop in file "5FM8xM9.exe" at offset 825652; code bytes = 8030 Found XOR loop in file "5FM8xM9.exe" at offset 840522; code bytes = 8030 Found XOR loop in file "5FM8xM9.exe" at offset 889452; code bytes = 8030 Found XOR loop in file "5FM8xM9.exe" at offset 906472; code bytes = 8030 Found XOR loop in file "5FM8xM9.exe" at offset 956292; code bytes = 8030 Found XOR loop in file "5FM8xM9.exe" at offset 957094; code bytes = 8030 Found XOR loop in file "5FM8xM9.exe" at offset 957768; code bytes = 8030 Found XOR loop in file "5FM8xM9.exe" at offset 960402; code bytes = 8030 Found XOR loop in file "5FM8xM9.exe" at offset 962944; code bytes = 8030 Found XOR loop in file "4mK184KA.exe" at offset 72323; code bytes = 30d0 Found XOR loop in file "4mK184KA.exe" at offset 122082; code bytes = 30d0 Found XOR loop in file "4mK184KA.exe" at offset 376916; code bytes = 30d0 Found XOR loop in file "4mK184KA.exe" at offset 376937; code bytes = 30d0 Found XOR loop in file "4mK184KA.exe" at offset 691258; code bytes = 30d0 Found XOR loop in file "4mK184KA.exe" at offset 887915; code bytes = 30d0 Found XOR loop in file "4mK184KA.exe" at offset 888929; code bytes = 30d0 Found XOR loop in file "4mK184KA.exe" at offset 891921; code bytes = 30d0 Found XOR loop in file "4mK184KA.exe" at offset 900833; code bytes = 30d0 Found XOR loop in file "4mK184KA.exe" at offset 913601; code bytes = 30d0 Found XOR loop in file "4mK184KA.exe" at offset 130790; code bytes = 33c1 Found XOR loop in file "4mK184KA.exe" at offset 140043; code bytes = 33c1 Found XOR loop in file "4mK184KA.exe" at offset 140172; code bytes = 33c1 Found XOR loop in file "4mK184KA.exe" at offset 351053; code bytes = 33c1 Found XOR loop in file "4mK184KA.exe" at offset 463773; code bytes = 33c1 Found XOR loop in file "4mK184KA.exe" at offset 463848; code bytes = 33c1 Found XOR loop in file "4mK184KA.exe" at offset 597022; code bytes = 33c1 Found XOR loop in file "4mK184KA.exe" at offset 701978; code bytes = 33c1 Found XOR loop in file "4mK184KA.exe" at offset 709317; code bytes = 33c1 Found XOR loop in file "4mK184KA.exe" at offset 709765; code bytes = 33c1 Found XOR loop in file "4mK184KA.exe" at offset 710341; code bytes = 33c1 Found XOR loop in file "4mK184KA.exe" at offset 710789; code bytes = 33c1 Found XOR loop in file "4mK184KA.exe" at offset 895349; code bytes = 33c1 Found XOR loop in file "4mK184KA.exe" at offset 905289; code bytes = 33c1 Found XOR loop in file "4mK184KA.exe" at offset 1330; code bytes = 8030 Found XOR loop in file "4mK184KA.exe" at offset 1959; code bytes = 8030 Found XOR loop in file "4mK184KA.exe" at offset 232120; code bytes = 8030 Found XOR loop in file "4mK184KA.exe" at offset 356589; code bytes = 8030 Found XOR loop in file "4mK184KA.exe" at offset 674772; code bytes = 8030 Found XOR loop in file "4mK184KA.exe" at offset 687130; code bytes = 8030 Found XOR loop in file "4mK184KA.exe" at offset 887876; code bytes = 8030 Found XOR loop in file "4mK184KA.exe" at offset 890824; code bytes = 8030 Found XOR loop in file "4mK184KA.exe" at offset 894056; code bytes = 8030 Found XOR loop in file "4mK184KA.exe" at offset 913562; code bytes = 8030 Found XOR loop in file "3tM26Fj.exe" at offset 1293; code bytes = 30d0 Found XOR loop in file "3tM26Fj.exe" at offset 1173; code bytes = 8030 Found XOR loop in file "3tM26Fj.exe" at offset 24690; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1274152; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1287765; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1485168; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1507775; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1514635; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1514887; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1515347; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1516553; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1521461; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1522625; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1538921; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 688249; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688345; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688444; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688500; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688526; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688604; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688747; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688843; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 689850; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 690446; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 764137; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 817238; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 817472; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 909588; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 924330; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 942350; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 948128; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 953465; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 953616; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 969842; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 971092; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 983876; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 985045; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 985160; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 989471; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 989786; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 990362; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 992172; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 992479; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 992865; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 992957; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 993612; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 995617; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 999815; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1000389; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1001271; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1001375; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1002055; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1002170; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1006463; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1007340; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1027259; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1033356; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1034159; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1289436; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1441388; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1505345; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1507059; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1513223; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 735579; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735612; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735686; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735764; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735781; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735802; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735842; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735923; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735946; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735963; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 736030; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 736068; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 736997; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 737018; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 833270; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 838380; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 845494; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 845523; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 857223; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 869347; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 869366; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 869863; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925121; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925175; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925196; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925223; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925256; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925280; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925297; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925319; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925429; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925471; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1337260; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1349610; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1362066; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1495860; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1517374; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1521442; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1522614; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1523404; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1537116; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1538890; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1274152; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1287765; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1485168; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1507775; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1514635; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1514887; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1515347; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1516553; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1521461; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1522625; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1538921; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688249; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688345; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688444; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688500; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688526; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688604; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688747; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688843; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 689850; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 690446; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 764137; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 817238; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 817472; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 909588; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 924330; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 942350; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 948128; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 953465; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 953616; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 969842; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 971092; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 983876; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 985045; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 985160; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 989471; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 989786; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 990362; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 992172; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 992479; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 992865; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 992957; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 993612; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 995617; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 999815; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1000389; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1001271; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1001375; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1002055; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1002170; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1006463; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1007340; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1027259; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1033356; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1034159; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1289436; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1441388; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1505345; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1507059; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1513223; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735579; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735612; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735686; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735764; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735781; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735802; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735842; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735923; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735946; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735963; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 736030; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 736068; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 736997; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 737018; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 833270; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 838380; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 845494; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 845523; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 857223; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 869347; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 869366; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 869863; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925121; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925175; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925196; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925223; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925256; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925280; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925297; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925319; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925429; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925471; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1337260; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1349610; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1362066; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1495860; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1517374; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1521442; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1522614; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1523404; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1537116; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1538890; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1274152; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1287765; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1485168; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1507775; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1514635; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1514887; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1515347; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1516553; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1521461; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1522625; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1538921; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688249; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688345; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688444; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688500; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688526; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688604; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688747; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688843; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 689850; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 690446; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 764137; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 817238; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 817472; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 909588; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 924330; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 942350; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 948128; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 953465; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 953616; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 969842; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 971092; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 983876; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 985045; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 985160; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 989471; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 989786; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 990362; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 992172; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 992479; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 992865; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 992957; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 993612; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 995617; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 999815; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1000389; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1001271; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1001375; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1002055; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1002170; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1006463; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1007340; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1027259; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1033356; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1034159; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1289436; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1441388; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1505345; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1507059; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1513223; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735579; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735612; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735686; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735764; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735781; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735802; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735842; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735923; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735946; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735963; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 736030; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 736068; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 736997; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 737018; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 833270; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 838380; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 845494; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 845523; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 857223; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 869347; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 869366; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 869863; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925121; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925175; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925196; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925223; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925256; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925280; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925297; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925319; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925429; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925471; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1337260; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1349610; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1362066; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1495860; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1517374; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1521442; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1522614; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1523404; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1537116; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1538890; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 170175; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 236346; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 263466; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 319126; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 454634; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 676980; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 855433; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 912206; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1021089; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1044126; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1063970; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1550728; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1612636; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1635815; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1769634; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1769963; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1920416; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1961113; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 26031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 271011; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 390950; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 404301; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 561800; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 636245; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 663159; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 838112; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 860298; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 967166; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 988204; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1013540; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1075955; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1119783; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1279553; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1330480; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1353413; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1374677; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1419083; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1551226; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1559846; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1587403; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1642854; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1644197; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1649568; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1715078; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1803679; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1813190; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1869056; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1878306; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2026425; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 90891; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 102399; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 103104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 175489; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 185786; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 208237; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 221055; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 241441; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 249516; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 348029; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 475259; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 484400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 577586; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 652233; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 652517; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 756273; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 765637; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 780753; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 902625; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 954751; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1011331; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1123988; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1230087; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1272925; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1277884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1319347; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1360635; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1377106; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1378170; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1395395; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1401893; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1523942; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1557990; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1665518; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1823838; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1852537; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1871261; code bytes = 80302e:Ta2d,Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00000292.00000000.74976.00A47000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00000292.00000000.74976.00A47000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00000292.00000000.74976.00A47000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00000292.00000000.74976.00A47000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00000292.00000000.74976.00A47000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00000292.00000000.74976.00A47000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00000292.00000000.74976.00A47000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00001704.00000002.83060.00CC7000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00001704.00000002.83060.00CC7000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001704.00000002.83060.00CC7000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00001704.00000002.83060.00CC7000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001704.00000002.83060.00CC7000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001704.00000002.83060.00CC7000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00001704.00000002.83060.00CC7000.00000002.mdmp")2f:T56a,Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00000292.00000000.74976.00A47000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00000292.00000000.74976.00A47000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00000292.00000000.74976.00A47000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00000292.00000000.74976.00A47000.00000002.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00001704.00000002.83060.00CC7000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00001704.00000002.83060.00CC7000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00001704.00000002.83060.00CC7000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00001704.00000002.83060.00CC7000.00000002.mdmp")30:T3e59,"ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000c0067e5ef7600001900584b2000000000000000190000000000584b2000000000009004009400000000684b2200c4001900b0021d00002000000000190000000000584b2000b8f70c000464f27638011900e063f2765fc1e7760000000000001900604b200000000000000000000000000000000000000000000000000000000000000000000000000000001900e82f19000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004392) "wI7qO24.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003260) "yI4Yr04.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004408) "yI4Yr04.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004408) "zS3mh13.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000468) "zS3mh13.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000468) "1dS08HT5.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000292) "1dS08HT5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000292) "1dS08HT5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000023ba026b3cce18003cce18001e75dd6a00000000d0512b0074d518007801000000000000000000000000000018d318005ecb30767801000000000000005d2e7674d518000e5d2e760cd11800dcaa3276010000000000000072000000ffffffffffffffff94ce180078020000000000002500000094ce18007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036008bbc246becce18006d820577f45b2b0004010000 (UID: 00000000-00000292) "1dS08HT5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005c0003000000000000000200000080982d00a0312a00e86c23003200020001000000bc0200000e0000000000000000000000a8312a008a0200000d000000b071230005000000000000003200000060a02d000cba1800cc41f37680982d0028000000fc000000ff2bf27685fef376d8eb2375ac012300000023002c002000010000000000ffffa703000004000000010000002d001b000100000031000000010000000000000000000000f86f2300f8070000200000000000000000000000a0312a00e86c2300086e230060992d00b07123000000000088b918000000000008bb1800 (UID: 00000000-00000292) "1dS08HT5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff2d000d0004000000620b307600000000f86f23000000000050000000ac732d0002000000408a2a000000000001000008e8e92d0020742300380b307620cd180002000000d4cd18003f08167502000000408a2a00000000000100001888fb1575c4cd1800c81c32769acf180095fb1575f8ce1800408a2a0000000000000000000000000080ce1800000023007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360067bc246b40ce18006d820577f45b2b0004010000 (UID: 00000000-00000292) "1dS08HT5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036007fb5246b58c718006d8205776c7b2c0004010000 (UID: 00000000-00000292) "1dS08HT5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000e86f2e00c82f2300a61a0000f0c0180067e5ef7600002300408a2c00000000000000230000000000408a2c00000000002c1a003600000000188e2c00e86f2e00007a2c00003b00000000230000000000408a2c000000230000872c0000000000340001356185f3760000000000002300308c2c0000000000000023000000100000872c0018c218000464f2767b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360033b3246b94c118006d820577ac7c2c0004010000 (UID: 00000000-00000292) "1dS08HT5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000180098cf6476a0333076fe573076054000802cdb18000000000043003a005c00550073006500720073005c0048004100500055004200570053000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360017c9246b70bb18006d82057784a82c0004010000 (UID: 00000000-00000292) "1dS08HT5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002e00f83b0000ff07000000002300000000007f070000c4002300c82f23009f810000e0ba180067e5ef7600002300e8822e00000000000000230000000000e8822e00000000004b8100ca8000000090852e00c4002300a0aa2c00003b00000000230000000000e8822e00201f000000002300e07f2e00f83b0000ff07000000002300000000007f070000c40023007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360017c9246b70bb18006d820577f47f2e0004010000 (UID: 00000000-00000292) "1dS08HT5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002e00f83b0000ff07000000002300000000007f070000c4002300c82f23005a810000e0ba180067e5ef760000230010852e0000000000000023000000000010852e00000000000681008780000000b8872e00c4002300c8aa2c00003b0000000023000000000010852e00201f00000000230008822e00f83b0000ff07000000002300000000007f070000c40023007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360017c9246b70bb18006d820577f4802e0004010000 (UID: 00000000-00000292) "1dS08HT5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002e00f83b0000ff07000000002300000000007f070000c4002300c82f23003a810000e0ba180067e5ef760000230010862e0000000000000023000000000010862e0000000000e680006680000000b8882e00c4002300805e2d00003b0000000023000000000010862e00201f00000000230008832e00f83b0000ff07000000002300000000007f070000c40023007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360017c9246b70bb18006d82057794812e0004010000 (UID: 00000000-00000292) "1dS08HT5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002e00f83b0000ff07000000002300000000007f070000c4002300c82f230026810000e0ba180067e5ef7600002300b0862e00000000000000230000000000b0862e0000000000d28000528000000058892e00c4002300d0ab2c00003b00000000230000000000b0862e00201f000000002300a8832e00f83b0000ff07000000002300000000007f070000c40023007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360017c9246b70bb18006d82057794822e0004010000 (UID: 00000000-00000292) "1dS08HT5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002e00f83b0000ff07000000002300000000007f070000c4002300c82f230006810000e0ba180067e5ef7600002300b0872e00000000000000230000000000b0872e0000000000b280003280000000588a2e00c4002300d0ab2c00003b00000000230000000000b0872e00201f000000002300a8842e00f83b0000ff07000000002300000000007f070000c40023007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360017c9246b70bb18006d820577bc832e0004010000 (UID: 00000000-00000292) "1dS08HT5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002e00f83b0000ff07000000002300000000007f070000c4002300c82f2300e1800000e0ba180067e5ef7600002300d8882e00000000000000230000000000d8882e00000000008d80000d80000000808b2e00c4002300d0ab2c00003b00000000230000000000d8882e00201f000000002300d0852e00f83b0000ff07000000002300000000007f070000c40023007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360017c9246b70bb18006d820577ec842e0004010000 (UID: 00000000-00000292) "1dS08HT5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002e00f83b0000ff07000000002300000000007f070000c4002300c82f2300bb800000e0ba180067e5ef7600002300088a2e00000000000000230000000000088a2e0000000000678000e780000000b08c2e00c4002300d0ab2c00003b00000000230000000000088a2e00201f00000000230000872e00f83b0000ff07000000002300000000007f070000c40023007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360017c9246b70bb18006d8205771c862e0004010000 (UID: 00000000-00000292) "1dS08HT5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002e00f83b0000ff07000000002300000000007f070000c4002300c82f230095800000e0ba180067e5ef7600002300388b2e00000000000000230000000000388b2e0000000000418000c180000000e08d2e00c4002300d0ab2c00003b00000000230000000000388b2e00201f00000000230030882e00f83b0000ff07000000002300000000007f070000c40023007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360017c9246b70bb18006d82057744872e0004010000 (UID: 00000000-00000292) "1dS08HT5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002e00f83b0000ff07000000002300000000007f070000c4002300c82f230070800000e0ba180067e5ef7600002300608c2e00000000000000230000000000608c2e00000000001c80009c80000000088f2e00c4002300d0ab2c00003b00000000230000000000608c2e00201f00000000230058892e00f83b0000ff07000000002300000000007f070000c40023007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360017c9246b70bb18006d8205777c882e0004010000 (UID: 00000000-00000292)31:T574,"ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "wI7qO24.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "wI7qO24.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "yI4Yr04.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "yI4Yr04.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "zS3mh13.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "zS3mh13.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1dS08HT5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1dS08HT5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "OfficeTrackerNMP131.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")32:Tfcd,"ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004392) "wI7qO24.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003260) "yI4Yr04.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004408) "zS3mh13.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00000468) "1dS08HT5.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000292) "1dS08HT5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000292) "1dS08HT5.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00000292) "1dS08HT5.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000292) "1dS08HT5.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00000292) "1dS08HT5.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00000292) "1dS08HT5.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00000292) "1dS08HT5.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00000292) "1dS08HT5.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00000292) "1dS08HT5.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000292) "1dS08HT5.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000292) "1dS08HT5.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00000292) "1dS08HT5.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00000292) "1dS08HT5.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00000292) "1dS08HT5.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00000292) "1dS08HT5.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000292) "1dS08HT5.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00000292) "1dS08HT5.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00000292) "1dS08HT5.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00000292) "1dS08HT5.exe" called "LoadLibrary" with a parameter WININET.DLL (UID: 00000000-00000292) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003680) "OfficeTrackerNMP131.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "LoadLibrary" with a parameter WININET.DLL (UID: 00000000-00001704)33:T3a01,"ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004392) "wI7qO24.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003260) "yI4Yr04.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004408) "yI4Yr04.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004408) "yI4Yr04.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004408) "yI4Yr04.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004408) "yI4Yr04.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004408) "zS3mh13.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000468) "zS3mh13.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000468) "zS3mh13.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000468) "zS3mh13.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000468) "zS3mh13.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00000468) "1dS08HT5.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CreateLinkInfoW (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter IsCharAlphaW (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CharPrevW (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter GetNetResourceFromLocalPathW (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter NetShareEnum (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CscNetApiGetInterface (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter SLGetWindowsInformationDWORD (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecW (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CharNextW (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter DestroyLinkInfo (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter O/ (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter O (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter ?/ (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter ? (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00000292) "1dS08HT5.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00000292) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002612) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003680) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter O/ (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter O (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter ?/ (UID: 00000000-00001704) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter ? (UID: 00000000-00001704)34:T1452,"CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)" (Source: 56100-928-00C66790, Indicator: "create table sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 56100-928-00C66790, Indicator: "select name rootpage sql from '%q'.%s"), "SELECT name rootpage sql FROM '%q'.%s WHERE %s" (Source: 56100-973-00C52E90, Indicator: "select name rootpage sql from '%q'.%s where %s"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 56100-1124-00C5F4F0, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "CREATE TABLE" (Source: 56100-1130-00C5F340, Indicator: "create table"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 56100-1313-00C5FB70, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 56100-1326-00C5F800, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 56100-1326-00C5F800, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 56100-1372-00C60320, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 56100-1372-00C60320, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q) tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='" (Source: 56100-1398-00C5D2C0, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='") "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 56100-1400-00C5D570, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 56100-1403-00C6C570, Indicator: "update %q.%s set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d"), "CREATE TABLE sqlite_master(" (Source: 00000000-00000292.00000000.74976.00A47000.00000002.mdmp, Indicator: "create table sqlite_master(") "CREATE TABLE" (Source: 00000000-00000292.00000000.74976.00A47000.00000002.mdmp, Indicator: "create table") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 00000000-00000292.00000000.74976.00A47000.00000002.mdmp, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00000292.00000000.74976.00A47000.00000002.mdmp, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 00000000-00000292.00000000.74976.00A47000.00000002.mdmp, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00000292.00000000.74976.00A47000.00000002.mdmp, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 00000000-00000292.00000000.74976.00A47000.00000002.mdmp, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 00000000-00000292.00000000.74976.00A47000.00000002.mdmp, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 00000000-00000292.00000000.74976.00A47000.00000002.mdmp, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 00000000-00000292.00000000.74976.00A47000.00000002.mdmp, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 00000000-00000292.00000000.74976.00A47000.00000002.mdmp, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 00000000-00000292.00000000.74976.00A47000.00000002.mdmp, Indicator: "select name rootpage sql from '%q'.%s")35:T9f5,":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00000292.00000000.74976.00230000.00000004.mdmp 00000000-00000292.00000001.76898.00230000.00000004.mdmp 00000000-00000292.00000002.78821.00230000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000292.00000000.74976.00230000.00000004.mdmp 00000000-00000292.00000001.76898.002AD000.00000004.mdmp 00000000-00000292.00000002.78821.002AD000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000292.00000000.74976.00230000.00000004.mdmp 00000000-00000292.00000000.74976.004E0000.00000002.mdmp 00000000-00000292.00000001.76898.002AD000.00000004.mdmp 00000000-00000292.00000002.78821.002AD000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000292.00000000.74976.00230000.00000004.mdmp 00000000-00000292.00000001.76898.002AD000.00000004.mdmp 00000000-00000292.00000002.78821.002AD000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000292.00000000.74976.00230000.00000004.mdmp 00000000-00000292.00000000.74976.004E0000.00000002.mdmp 00000000-00000292.00000001.76898.002AD000.00000004.mdmp 00000000-00000292.00000002.78821.002AD000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\fanbooster131.lnk") in Source: 00000000-00000292.00000000.74976.00230000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001704.00000000.79214.00390000.00000004.mdmp 00000000-00001704.00000001.81135.00390000.00000004.mdmp 00000000-00001704.00000002.83060.00390000.00000004.mdmp36:T455,"ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "wI7qO24.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "2ve1925.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "yI4Yr04.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "zS3mh13.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "5FM8xM9.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE37:T570,Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36" (Indicator: "mozilla/5.0 ("; File: "00000000-00001704.00000002.83060.00B91000.00000020.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" (Indicator: "mozilla/5.0 ("; File: "00000000-00001704.00000002.83060.00B91000.00000020.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00000292.00000000.74976.00A47000.00000002.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00000292.00000000.74976.00A47000.00000002.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00001704.00000002.83060.00CC7000.00000002.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00001704.00000002.83060.00CC7000.00000002.mdmp")38:T130c,"Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00000292.00000000.74976.00230000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00000292.00000000.74976.00230000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00000292.00000000.74976.00230000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00000292.00000000.74976.00230000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00000292.00000001.76898.00230000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00000292.00000001.76898.00230000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00000292.00000001.76898.00230000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00000292.00000001.76898.00230000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00000292.00000002.78821.00230000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00000292.00000002.78821.00230000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00000292.00000002.78821.00230000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00000292.00000002.78821.00230000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00000468.00000000.74930.00311000.00000020.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001704.00000000.79214.00390000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001704.00000000.79214.00390000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001704.00000000.79214.00390000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001704.00000000.79214.00390000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001704.00000001.81135.00390000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001704.00000001.81135.00390000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001704.00000001.81135.00390000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001704.00000001.81135.00390000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001704.00000002.83060.00390000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001704.00000002.83060.00390000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001704.00000002.83060.00390000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001704.00000002.83060.00390000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003260.00000000.74843.00D01000.00000020.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004392.00000001.76665.00190000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00004392.00000002.78587.012B1000.00000020.mdmp "-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004408.00000001.76812.001A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00004408.00000002.78734.00D51000.00000020.mdmp39:T1210,"ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" loaded module "KERNEL32.DLL" at base 75110000 "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75ba0000 "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" loaded module "FECLIENT.DLL" at base 71e90000 "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 70f10000 "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c80000 "wI7qO24.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 70df0000 "wI7qO24.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c80000 "yI4Yr04.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6ad60000 "yI4Yr04.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 71f80000 "yI4Yr04.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c80000 "zS3mh13.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 71f50000 "zS3mh13.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c80000 "1dS08HT5.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6ad60000 "1dS08HT5.exe" loaded module "ADVAPI32.DLL" at base 75ba0000 "1dS08HT5.exe" loaded module "KERNEL32.DLL" at base 75110000 "1dS08HT5.exe" loaded module "CRYPTBASE.DLL" at base 74cd0000 "1dS08HT5.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73b20000 "1dS08HT5.exe" loaded module "CLBCATQ.DLL" at base 759b0000 "1dS08HT5.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76280000 "1dS08HT5.exe" loaded module "PROPSYS.DLL" at base 73b60000 "1dS08HT5.exe" loaded module "OLE32.DLL" at base 75a40000 "1dS08HT5.exe" loaded module "COMCTL32.DLL" at base 73cd0000 "1dS08HT5.exe" loaded module "OLEAUT32.DLL" at base 75630000 "1dS08HT5.exe" loaded module "SETUPAPI.DLL" at base 75c50000 "1dS08HT5.exe" loaded module "RPCRT4.DLL" at base 75900000 "1dS08HT5.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73b60000 "1dS08HT5.exe" loaded module "NTMARTA.DLL" at base 74240000 "1dS08HT5.exe" loaded module "SHELL32.DLL" at base 76280000 "1dS08HT5.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77020000 "1dS08HT5.exe" loaded module "PROFAPI.DLL" at base 74de0000 "1dS08HT5.exe" loaded module "APPHELP.DLL" at base 74c80000 "1dS08HT5.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6dde0000 "1dS08HT5.exe" loaded module "LINKINFO.DLL" at base 6f000000 "1dS08HT5.exe" loaded module "USER32.DLL" at base 75490000 "1dS08HT5.exe" loaded module "NTSHRUI.DLL" at base 71fd0000 "1dS08HT5.exe" loaded module "SRVCLI.DLL" at base 749d0000 "1dS08HT5.exe" loaded module "CSCAPI.DLL" at base 6ff40000 "1dS08HT5.exe" loaded module "SLC.DLL" at base 73180000 "1dS08HT5.exe" loaded module "SHLWAPI.DLL" at base 77040000 "1dS08HT5.exe" loaded module "SSPICLI.DLL" at base 74c60000 "1dS08HT5.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c80000 "1dS08HT5.exe" loaded module "WINHTTP.DLL" at base 70bf0000 "1dS08HT5.exe" loaded module "WININET.DLL" at base 75fd0000 "1dS08HT5.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 747a0000 "1dS08HT5.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74300000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 74c60000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77020000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 736a0000 "OfficeTrackerNMP131.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70320000 "OfficeTrackerNMP131.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 75070000 "OfficeTrackerNMP131.exe" loaded module "KERNEL32" at base 75110000 "OfficeTrackerNMP131.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75070000 "OfficeTrackerNMP131.exe" loaded module "OLE32.DLL" at base 75a40000 "OfficeTrackerNMP131.exe" loaded module "ADVAPI32.DLL" at base 75ba0000 "OfficeTrackerNMP131.exe" loaded module "KERNEL32.DLL" at base 75110000 "OfficeTrackerNMP131.exe" loaded module "WINHTTP.DLL" at base 70bf0000 "OfficeTrackerNMP131.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 74e20000 "OfficeTrackerNMP131.exe" loaded module "WININET.DLL" at base 75fd0000 "OfficeTrackerNMP131.exe" loaded module "CRYPTBASE.DLL" at base 74cd0000 "OfficeTrackerNMP131.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 747a0000 "OfficeTrackerNMP131.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 743000003a:Te37,"ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92" was detected as "Microsoft Cabinet" and name: "sfx" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92" was detected as "Microsoft Cabinet File" and name: "Archive" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92" was detected as "Microsoft Linker" and name: "Linker" "wI7qO24.exe" was detected as "Microsoft Cabinet" and name: "sfx" "wI7qO24.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "wI7qO24.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "wI7qO24.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "wI7qO24.exe" was detected as "Microsoft Linker" and name: "Linker" "1dS08HT5.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1dS08HT5.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1dS08HT5.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1dS08HT5.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1dS08HT5.exe" was detected as "Microsoft Linker" and name: "Linker" "2ve1925.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2ve1925.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2ve1925.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2ve1925.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2ve1925.exe" was detected as "Microsoft Linker" and name: "Linker" "yI4Yr04.exe" was detected as "Microsoft Cabinet" and name: "sfx" "yI4Yr04.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "yI4Yr04.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "yI4Yr04.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "yI4Yr04.exe" was detected as "Microsoft Linker" and name: "Linker" "zS3mh13.exe" was detected as "Microsoft Cabinet" and name: "sfx" "zS3mh13.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "zS3mh13.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "zS3mh13.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "zS3mh13.exe" was detected as "Microsoft Linker" and name: "Linker" "5FM8xM9.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5FM8xM9.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5FM8xM9.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5FM8xM9.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5FM8xM9.exe" was detected as "Microsoft Linker" and name: "Linker" "4mK184KA.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4mK184KA.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4mK184KA.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4mK184KA.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4mK184KA.exe" was detected as "Microsoft Linker" and name: "Linker" "3tM26Fj.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3tM26Fj.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3tM26Fj.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3tM26Fj.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3tM26Fj.exe" was detected as "Microsoft Linker" and name: "Linker"3b:T131f,"ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "wI7qO24.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "1dS08HT5.exe" file has an entrypoint instructions - "call 0x4e6d12,jmp 0x4e64df,cmp ecx, dword ptr [0x56d048],jne 0x4e666e,ret ,jmp 0x4e6e45,push ebp,mov ebp, esp,and dword ptr [0x56f3d0], 0,sub esp, 0x24,or dword ptr [0x56d050], 1,push 0xa,call dword ptr [0x5370d8],test eax, eax,je 0x4e6843,and dword ptr [ebp - 0x10], 0,xor eax, eax,push ebx,push esi,push edi,xor ecx, ecx,lea edi, [ebp - 0x24],push ebx,cpuid ,mov esi, ebx,pop ebx,nop ,mov dword ptr [edi], eax,mov dword ptr [edi + 4], esi,mov dword ptr [edi + 8], ecx,xor ecx, ecx,mov dword ptr [edi + 0xc], edx,mov eax, dword ptr [ebp - 0x24],mov edi, dword ptr [ebp - 0x20]," "2ve1925.exe" file has an entrypoint instructions - "jmp 0x41c9a0,jmp 0x472cc9,jmp 0x450f20,jmp 0x43d857,jmp 0x428398,jmp 0x4af8e0,jmp 0x43ddc6,jmp 0x473a6a,jmp 0x4aa59a,jmp 0x423a5d,jmp 0x420090,jmp 0x41d364,jmp 0x4598b7,jmp 0x43387b,jmp 0x46024c,jmp 0x424665,jmp 0x41ed3b,jmp 0x49a29b,jmp 0x40f960,jmp 0x46e20c," "yI4Yr04.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "zS3mh13.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "5FM8xM9.exe" file has an entrypoint instructions - "jmp 0x41c9a0,jmp 0x472cc9,jmp 0x450f20,jmp 0x43d857,jmp 0x428398,jmp 0x4af8e0,jmp 0x43ddc6,jmp 0x473a6a,jmp 0x4aa59a,jmp 0x423a5d,jmp 0x420090,jmp 0x41d364,jmp 0x4598b7,jmp 0x43387b,jmp 0x46024c,jmp 0x424665,jmp 0x41ed3b,jmp 0x49a29b,jmp 0x40f960,jmp 0x46e20c," "4mK184KA.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "3tM26Fj.exe" file has an entrypoint instructions - "call 0x4032e6,jne 0x4032ed,je 0x4032ed,test eax, 0xeb5b9ba5,or al, byte ptr [ecx + eax*4 - 0x15],out 0x32, al,add byte ptr [eax], al,jmp 0x4032fe,and ch, bl,cmc ,inc esp,and dh, byte ptr [esi + eax + 0x75],add al, 0x94,push ss,xor dword ptr [ecx - 0x3dbbb39], ebx,xor byte ptr [eax], al,add byte ptr [eax], al,sub esp, 4,jne 0x403317,je 0x403317,dec ebp,lahf ,mov edx, dword ptr [esp],add esp, 4,jmp 0x403325,mov byte ptr [ecx], ch,shr bl, 5,test al, 0xeb,stc ,mov byte ptr [eax - 0x4373fa15], ch,shr bl, 1,pop es,add eax, dword ptr fs:[edx],je 0x40333c,jne 0x40333c,jb 0x40337c,and dh, byte ptr [esi],in eax, dx,push dword ptr [eax + 0xa4],jne 0x403349,"3c:T4ce,"ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "wI7qO24.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "wI7qO24.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "yI4Yr04.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "yI4Yr04.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "zS3mh13.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "zS3mh13.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1dS08HT5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1dS08HT5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "OfficeTrackerNMP131.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "OfficeTrackerNMP131.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")3d:T4ce,Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00004392-00000C2B-175869224] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00004392-00000C2B-176508213] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00004392-00000BC1-176652039] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00003260-00000BC1-177360513] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00004408-00000BC1-178004409] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00000468-00000BC1-178694089] Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00003260.00000CBC.1607773.00050000.wprm] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00000292-00000C2B-179414535] Observed system executable string:"%WINDIR%\System32\shdocvw.dll" [Source: 00000000-00000292-00000C2B-182519204]3e:Ta43,"wI7qO24.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\wI7qO24.exe]- [targetUID: 00000000-00004392] "1dS08HT5.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1dS08HT5.exe]- [targetUID: 00000000-00000468] "2ve1925.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 7 sections"- Location: [%TEMP%\IXP003.TMP\2ve1925.exe]- [targetUID: 00000000-00000468] "yI4Yr04.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\yI4Yr04.exe]- [targetUID: 00000000-00004408] "zS3mh13.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\zS3mh13.exe]- [targetUID: 00000000-00004408] "5FM8xM9.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 7 sections"- Location: [%TEMP%\IXP000.TMP\5FM8xM9.exe]- [targetUID: 00000000-00004392] "4mK184KA.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4mK184KA.exe]- [targetUID: 00000000-00003260] "3tM26Fj.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\3tM26Fj.exe]- [targetUID: 00000000-00004408] "FANBooster131.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Unicoded MachineID hapubws-pc KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive NeedIndexed ctime=Mon Sep 7 03:34:44 2026 atime=Mon Sep 7 03:34:44 2026 mtime=Sun Nov 26 06:57:04 2023 length=1539687 window=normal IDListSize 0x01f6 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00001704] "rise131M9Asphalt.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\rise131M9Asphalt.tmp]- [targetUID: 00000000-00001704] "FANBooster131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00001704] "OfficeTrackerNMP131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00001704] "MaxLoonaFest131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00001704]3f:Tb94,"ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")40:T10d8,"ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "AB08505AA422514C152884D9348303C29C91C5191A3E77EA146CFC90EA542B92"; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "")41:T4e3,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to retrieve information set for devices (API string) Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Reference to an external IP address lookup service identified Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to query volume size Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to detect presence of virtualization software Matched sigs: Checks a device property (often used to detect VM artifacts)42:Tc9a,"ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe.Local\" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\Cabinet.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\VERSION.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\SspiCli.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\WINSPOOL.DRV" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\MPR.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\Windows\system32\MPR.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\UxTheme.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\WINMM.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\samcli.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\Windows\system32\samcli.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\MSACM32.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to touch file "C:\Windows\system32\MSACM32.dll"43:Tcf4,"ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\Cabinet.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\VERSION.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\SspiCli.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\MPR.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\UxTheme.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\WINMM.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\samcli.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\MSACM32.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\sfc.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\sfc_os.DLL" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\dwmapi.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\FLTLIB.DLL" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\MSVCP140.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\ucrtbase.DLL" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll"44:T87a,"ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe.Local\" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe.Config" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\AB08505AA422514C152884D9348303C29C91C5191A3E77EA146CFC90EA542B92.EXE.LOCAL" "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" trying to access non-existent file "C:\AB08505AA422514C152884D9348303C29C91C5191A3E77EA146CFC90EA542B92.EXE.CONFIG" "wI7qO24.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\wI7qO24.exe.Local\" "wI7qO24.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "wI7qO24.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\wI7qO24.exe.Config" "wI7qO24.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "wI7qO24.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WI7QO24.EXE.LOCAL" "wI7qO24.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WI7QO24.EXE.CONFIG" "yI4Yr04.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\yI4Yr04.exe.Local\" "yI4Yr04.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "yI4Yr04.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\yI4Yr04.exe.Config" "yI4Yr04.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"45:T487,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92")46:T9a9,Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "gethostname" (Indicator: "gethostname"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00000292.00000000.74976.00BA0000.00000002.mdmp, 00000000-00000292.00000001.76898.00BA0000.00000002.mdmp, 00000000-00000292.00000002.78821.00BA0000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00000468.00000000.74930.00EA0000.00000002.mdmp, 00000000-00000468.00000001.76855.00EA0000.00000002.mdmp, 00000000-00000468.00000002.78777.00EA0000.00000002.mdmp") Found reference to API "Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement." (Indicator: " accept "; Source: "00000000-00000468.00000002.78777.0031A000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00001704.00000000.79214.00D10000.00000002.mdmp, 00000000-00001704.00000001.81135.00D10000.00000002.mdmp, 00000000-00001704.00000002.83060.00D10000.00000002.mdmp") Found reference to API "Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement." (Indicator: " accept "; Source: "00000000-00003260.00000000.74843.00D0A000.00000002.mdmp")47:T9ca,Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localp70vtemp=c:\users\hapubws\appdata\local\temp1spsuxo/p70vp70vp70v5?k@certdllverifycertificatechainpolicy5?@acryptmsgdllcnggencontentencryptkey5?@acryptmsgdllcngimportcontentencryptkey50@a50oa58oa5/ga5/pa1" - Source: "00000000-00000292.00000000.74976.00230000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00000292.00000000.74976.00230000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00000292.00000000.74976.00A47000.00000002.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00000292.00000000.74976.00A47000.00000002.mdmp") Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localp70vtemp=c:\users\hapubws\appdata\local\tempuxo/p70vhb" - Source: "00000000-00000292.00000001.76898.00230000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00000292.00000001.76898.00230000.00000004.mdmp") Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localp70vtemp=c:\users\hapubws\appdata\local\tempuxo/p70vhb" - Source: "00000000-00000292.00000002.78821.00230000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00000292.00000002.78821.00230000.00000004.mdmp") Found URL "https://t.me/riseprosupportp70vhb" - Source: "00000000-00001704.00000000.79214.00390000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00001704.00000000.79214.00390000.00000004.mdmp") Found URL "https://t.me/riseprosupportp70vhb" - Source: "00000000-00001704.00000001.81135.00390000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00001704.00000001.81135.00390000.00000004.mdmp") Found URL "https://t.me/riseprosupportp70vhb" - Source: "00000000-00001704.00000002.83060.00390000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00001704.00000002.83060.00390000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00001704.00000002.83060.00CC7000.00000002.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00001704.00000002.83060.00CC7000.00000002.mdmp")48:T488,Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92")49:Ta4c,"ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "FindNextFileW" with parameter 5FM8xM9.exe (UID: 00000000-00004392) "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" called "FindNextFileW" with parameter wI7qO24.exe (UID: 00000000-00004392) "wI7qO24.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00003260) "wI7qO24.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003260) "wI7qO24.exe" called "FindNextFileW" with parameter 4mK184KA.exe (UID: 00000000-00003260) "wI7qO24.exe" called "FindNextFileW" with parameter yI4Yr04.exe (UID: 00000000-00003260) "yI4Yr04.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00004408) "yI4Yr04.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004408) "yI4Yr04.exe" called "FindNextFileW" with parameter 3tM26Fj.exe (UID: 00000000-00004408) "yI4Yr04.exe" called "FindNextFileW" with parameter zS3mh13.exe (UID: 00000000-00004408) "zS3mh13.exe" called "FindFirstFileW" with parameter %TEMP%\IXP003.TMP\*.* (UID: 00000000-00000468) "zS3mh13.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000468) "zS3mh13.exe" called "FindNextFileW" with parameter 1dS08HT5.exe (UID: 00000000-00000468) "zS3mh13.exe" called "FindNextFileW" with parameter 2ve1925.exe (UID: 00000000-00000468) "1dS08HT5.exe" called "FindFirstFileW" with parameter %WINDIR%\System32\*.* (UID: 00000000-00000292) "1dS08HT5.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000292) "1dS08HT5.exe" called "FindNextFileW" with parameter 0409 (UID: 00000000-00000292) "1dS08HT5.exe" called "FindNextFileW" with parameter 12520437.cpx (UID: 00000000-00000292) "1dS08HT5.exe" called "FindNextFileW" with parameter 12520850.cpx (UID: 00000000-00000292) "1dS08HT5.exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00000292) "1dS08HT5.exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00000292) "1dS08HT5.exe" called "FindNextFileW" with parameter aaclient.dll (UID: 00000000-00000292) "1dS08HT5.exe" called "FindNextFileW" with parameter accessibilitycpl.dll (UID: 00000000-00000292)4a:T6a8,"Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00000292.00000000.74976.00230000.00000004.mdmp 00000000-00000292.00000001.76898.00230000.00000004.mdmp 00000000-00000292.00000002.78821.00230000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00000292.00000000.74976.00230000.00000004.mdmp 00000000-00000292.00000001.76898.00230000.00000004.mdmp 00000000-00000292.00000002.78821.00230000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00000292.00000000.74976.00230000.00000004.mdmp 00000000-00000292.00000001.76898.00230000.00000004.mdmp 00000000-00000292.00000002.78821.00230000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001704.00000000.79214.00390000.00000004.mdmp 00000000-00001704.00000001.81135.00390000.00000004.mdmp 00000000-00001704.00000002.83060.00390000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001704.00000000.79214.00390000.00000004.mdmp 00000000-00001704.00000001.81135.00390000.00000004.mdmp 00000000-00001704.00000002.83060.00390000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001704.00000000.79214.00390000.00000004.mdmp 00000000-00001704.00000001.81135.00390000.00000004.mdmp 00000000-00001704.00000002.83060.00390000.00000004.mdmp4b:T10c6,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000292.00000000.74976.00230000.00000004.mdmp, 00000000-00000292.00000001.76898.00230000.00000004.mdmp, 00000000-00000292.00000002.78821.00230000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000292.00000000.74976.00230000.00000004.mdmp, 00000000-00000292.00000001.76898.00230000.00000004.mdmp, 00000000-00000292.00000002.78821.00230000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000292.00000000.74976.00230000.00000004.mdmp, 00000000-00000292.00000001.76898.00230000.00000004.mdmp, 00000000-00000292.00000002.78821.00230000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000292.00000000.74976.00230000.00000004.mdmp, 00000000-00000292.00000001.76898.00230000.00000004.mdmp, 00000000-00000292.00000002.78821.00230000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000292.00000000.74976.00230000.00000004.mdmp, 00000000-00000292.00000001.76898.00230000.00000004.mdmp, 00000000-00000292.00000002.78821.00230000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000292.00000000.74976.00230000.00000004.mdmp, 00000000-00000292.00000001.76898.00230000.00000004.mdmp, 00000000-00000292.00000002.78821.00230000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP003.TMP\1dS08HT5.exe" (Indicator: "\Device\"; Source: "00000000-00000292.00000000.74976.00230000.00000004.mdmp, 00000000-00000292.00000001.76898.00230000.00000004.mdmp, 00000000-00000292.00000002.78821.00230000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}] DATAGRAM 2" (Indicator: "\Device\"; Source: "00000000-00000292.00000002.78821.002AD000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001704.00000000.79214.00390000.00000004.mdmp, 00000000-00001704.00000001.81135.00390000.00000004.mdmp, 00000000-00001704.00000002.83060.00390000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001704.00000000.79214.00390000.00000004.mdmp, 00000000-00001704.00000001.81135.00390000.00000004.mdmp, 00000000-00001704.00000002.83060.00390000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001704.00000000.79214.00390000.00000004.mdmp, 00000000-00001704.00000001.81135.00390000.00000004.mdmp, 00000000-00001704.00000002.83060.00390000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001704.00000000.79214.00390000.00000004.mdmp, 00000000-00001704.00000001.81135.00390000.00000004.mdmp, 00000000-00001704.00000002.83060.00390000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001704.00000000.79214.00390000.00000004.mdmp, 00000000-00001704.00000001.81135.00390000.00000004.mdmp, 00000000-00001704.00000002.83060.00390000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001704.00000000.79214.00390000.00000004.mdmp, 00000000-00001704.00000001.81135.00390000.00000004.mdmp, 00000000-00001704.00000002.83060.00390000.00000004.mdmp") Found string "\Device\HarddiskVolume2\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" (Indicator: "\Device\"; Source: "00000000-00001704.00000000.79214.00390000.00000004.mdmp, 00000000-00001704.00000001.81135.00390000.00000004.mdmp, 00000000-00001704.00000002.83060.00390000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}] DATAGRAM 2" (Indicator: "\Device\"; Source: "00000000-00001704.00000001.81135.00390000.00000004.mdmp, 00000000-00001704.00000002.83060.00390000.00000004.mdmp")4c:T14d9,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: wI7qO24.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: wI7qO24.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: wI7qO24.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: wI7qO24.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: wI7qO24.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: yI4Yr04.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: yI4Yr04.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: yI4Yr04.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: yI4Yr04.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: yI4Yr04.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: zS3mh13.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: zS3mh13.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: zS3mh13.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: zS3mh13.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: zS3mh13.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 4mK184KA.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 4mK184KA.exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: 4mK184KA.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: 4mK184KA.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: 4mK184KA.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: 4mK184KA.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 4mK184KA.exe] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 4mK184KA.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: 4mK184KA.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: 4mK184KA.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 4mK184KA.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 4mK184KA.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: 4mK184KA.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: 4mK184KA.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 4mK184KA.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: 4mK184KA.exe]4d:T9ba,"1dS08HT5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "1dS08HT5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "1dS08HT5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "1dS08HT5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "1dS08HT5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "1dS08HT5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "1dS08HT5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "1dS08HT5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "1dS08HT5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "1dS08HT5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "1dS08HT5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "1dS08HT5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "1dS08HT5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "1dS08HT5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")4e:T45c,"ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "wI7qO24.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "yI4Yr04.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "zS3mh13.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "1dS08HT5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "MAXLOONAFEST131"; Value: "%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe")4f:T5db,"wI7qO24.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\wI7qO24.exe]- [targetUID: 00000000-00004392] "1dS08HT5.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1dS08HT5.exe]- [targetUID: 00000000-00000468] "2ve1925.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 7 sections"- Location: [%TEMP%\IXP003.TMP\2ve1925.exe]- [targetUID: 00000000-00000468] "yI4Yr04.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\yI4Yr04.exe]- [targetUID: 00000000-00004408] "zS3mh13.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\zS3mh13.exe]- [targetUID: 00000000-00004408] "5FM8xM9.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 7 sections"- Location: [%TEMP%\IXP000.TMP\5FM8xM9.exe]- [targetUID: 00000000-00004392] "4mK184KA.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4mK184KA.exe]- [targetUID: 00000000-00003260] "3tM26Fj.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\3tM26Fj.exe]- [targetUID: 00000000-00004408] "FANBooster131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00001704]50:T76e,"wI7qO24.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\wI7qO24.exe]- [targetUID: 00000000-00004392] "1dS08HT5.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1dS08HT5.exe]- [targetUID: 00000000-00000468] "2ve1925.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 7 sections"- Location: [%TEMP%\IXP003.TMP\2ve1925.exe]- [targetUID: 00000000-00000468] "yI4Yr04.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\yI4Yr04.exe]- [targetUID: 00000000-00004408] "zS3mh13.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\zS3mh13.exe]- [targetUID: 00000000-00004408] "5FM8xM9.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 7 sections"- Location: [%TEMP%\IXP000.TMP\5FM8xM9.exe]- [targetUID: 00000000-00004392] "4mK184KA.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4mK184KA.exe]- [targetUID: 00000000-00003260] "3tM26Fj.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\3tM26Fj.exe]- [targetUID: 00000000-00004408] "FANBooster131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00001704] "OfficeTrackerNMP131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00001704] "MaxLoonaFest131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00001704]51:T631,"ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "wI7qO24.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "wI7qO24.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "yI4Yr04.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "yI4Yr04.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "zS3mh13.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "zS3mh13.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "1dS08HT5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "MAXLOONAFEST131"; Value: "%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe")52:Tce8,"ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\wI7qO24.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "ab08505aa422514c152884d9348303c29c91c5191a3e77ea146cfc90ea542b92.exe" wrote 23040 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5FM8xM9.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "wI7qO24.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\yI4Yr04.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "wI7qO24.exe" wrote 22016 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4mK184KA.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "yI4Yr04.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\zS3mh13.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "yI4Yr04.exe" wrote 17408 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3tM26Fj.exe": 4d5aff000100000004001000ffff00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0a240000000000000000 ... "zS3mh13.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1dS08HT5.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000300100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "zS3mh13.exe" wrote 409 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2ve1925.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...53:T84b,RegOpenKeyExA OpenProcessToken RegCreateKeyExA RegDeleteValueA RegCloseKey LoadLibraryExA GetModuleFileNameA GetTempPathA GetVersionExA FindNextFileA FindFirstFileA GetProcAddress GetTickCount GetStartupInfoW TerminateProcess DeleteFileA CreateDirectoryA FindResourceA CreateProcessA GetDriveTypeA LockResource GetSystemInfo GetFileAttributesA CreateFileA CreateThread GetTempFileNameA UnhandledExceptionFilter GetModuleHandleW GetSystemDirectoryA WriteFile LoadLibraryA Sleep RegEnumKeyExA RegEnumKeyA CredEnumerateA GetUserNameA CreateFileW FindNextFileW GetTickCount64 GetFileAttributesExW GetCommandLineW GetModuleHandleExA FindFirstFileW CreateToolhelp32Snapshot WriteProcessMemory GetFileAttributesW CreateRemoteThread FindFirstFileExW VirtualAllocEx DeleteFileW Process32First GetCommandLineA GetFileSizeEx CopyFileA GetComputerNameA GetModuleHandleA LoadLibraryExW GetTempPathW GetModuleHandleExW Process32Next GetModuleFileNameW IsDebuggerPresent GetFileSize OpenProcess ShellExecuteA socket send closesocket connect WSAStartup recv GetNativeSystemInfo CreateThreadpoolWait SleepConditionVariableCS ExitThread CreateThreadpoolTimer OutputDebugStringW SleepConditionVariableSRW CreateThreadpoolWork RegOpenKeyExW SetSecurityDescriptorDacl RegEnumKeyExW RegCreateKeyExW CreateProcessWithLogonW CreateProcessAsUserW RegDeleteValueW RegDeleteKeyW GetUserNameW IcmpSendEcho GetDriveTypeW FindResourceExW CreateDirectoryW CopyFileW GetComputerNameW GetVersionExW GetTempFileNameW GetSystemDirectoryW ReadProcessMemory Process32FirstW DeviceIoControl CopyFileExW VirtualAlloc LoadLibraryW CreateProcessW Process32NextW ShellExecuteExW ShellExecuteW SetKeyboardState GetWindowThreadProcessId GetCursorPos FindWindowExW FindWindowW GetClipboardData InternetOpenUrlW HttpQueryInfoW HttpSendRequestW FtpGetFileSize InternetQueryDataAvailable InternetReadFile FtpOpenFileW InternetConnectW InternetCrackUrlW InternetQueryOptionW InternetCloseHandle InternetOpenW listen sendto accept bind recvfrom54:T898,"1dS08HT5.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "1dS08HT5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1dS08HT5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1dS08HT5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "1dS08HT5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "1dS08HT5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "1dS08HT5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "1dS08HT5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "1dS08HT5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "1dS08HT5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "1dS08HT5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "1dS08HT5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "1dS08HT5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")55:T4f7,"1dS08HT5.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")56:T7ec,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "c7fffbee15d5fb4fafd44c29466adeae") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003908.00000000.66643.00BC0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003908.00000000.66643.00BC0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003908.00000000.66643.00BC0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003908.00000000.66643.00BC0000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00003908.00000000.66643.0113A000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005388.00000001.69916.03020000.00000004.mdmp, 00000000-00005388.00000002.71836.03020000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005388.00000001.69916.03020000.00000004.mdmp, 00000000-00005388.00000002.71836.03020000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005388.00000001.69916.03020000.00000004.mdmp, 00000000-00005388.00000002.71836.03020000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005388.00000001.69916.03020000.00000004.mdmp, 00000000-00005388.00000002.71836.03020000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00005672.00000000.66588.0021A000.00000002.mdmp")57:T559,"c7fffbee15d5fb4fafd44c29466adeae.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74D70000 "c7fffbee15d5fb4fafd44c29466adeae.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73610000 "wI7qO24.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74D70000 "wI7qO24.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73610000 "yI4Yr04.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74D70000 "yI4Yr04.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73610000 "zS3mh13.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74D70000 "zS3mh13.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73610000 "1dS08HT5.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74D70000 "1dS08HT5.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73610000 "schtasks.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74D70000 "2ve1925.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74D70000 "2ve1925.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73610000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74D70000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73610000 "3tM26Fj.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74D70000 "3tM26Fj.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 7361000058:T9dd,"DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 37951-2662-004CF800, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'") "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 37951-2662-004CF800, Indicator: "delete from %q.sqlite_stat1 where tbl=%q") "UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d" (Source: 37951-2460-004CF4F0, Indicator: "update %q.%s set type='%s', name=%q, tbl_name=%q, rootpage=#%d, sql=%q where rowid=#%d") "UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d" (Source: 37951-2739-004DC570, Indicator: "update %q.%s set type='table', name=%q, tbl_name=%q, rootpage=0, sql=%q where rowid=#%d") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 37951-2310-004C2E90, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "CREATE TABLE" (Source: 37951-2466-004CF340, Indicator: "create table") "CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)" (Source: 37951-2265-004D6790, Indicator: "create table sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 37951-2265-004D6790, Indicator: "select name rootpage sql from '%q'.%s"), "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q) tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='" (Source: 37951-2734-004CD2C0, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='") "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 37951-2736-004CD570, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 37951-2649-004CFB70, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 37951-2708-004D0320, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 37951-2708-004D0320, Indicator: "delete from %q.sqlite_stat1 where idx=%q")59:Tfff,Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00007764-00000C25-34309277] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00007764-00000C25-34393631] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00007764-00000BC1-34408530] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00005672-00000BC1-34827411] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00006640-00000BC1-35240275] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00003908-00000BC1-35700990] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007308-00000C25-56597557] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007308-00000C25-56990628] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007308-00000C25-57064306] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007308-00000C25-57110498] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00007308-00000C25-57192712] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007308-00000C25-57222092] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007308-00000C25-57254431] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007308-00000C25-57387771] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00007308-00000C25-57506893] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00007308-00000C25-57565914] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00007308-00000C25-57688909] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00007308-00000C25-57845206] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00007308-00000C25-57920348] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00007308-00000C25-58002305] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00007308-00000C25-58108404] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00007308-00000C25-58354177] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll" [Source: 00000000-00007308-00000C25-58428572] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll" [Source: 00000000-00007308-00000C25-58486180] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" [Source: 00000000-00007308-00000C25-58561387]5a:T520,"c7fffbee15d5fb4fafd44c29466adeae.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\wI7qO24.exe" (UID: 7764) "wI7qO24.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\yI4Yr04.exe" (UID: 5672) "yI4Yr04.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\zS3mh13.exe" (UID: 6640) "yI4Yr04.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3tM26Fj.exe" (UID: 6640) "zS3mh13.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1dS08HT5.exe" (UID: 3908) "zS3mh13.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2ve1925.exe" (UID: 3908) "1dS08HT5.exe" queries basic process information of the "C:\Windows\SysWOW64\schtasks.exe" (UID: 7264) "1dS08HT5.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1dS08HT5.exe" (UID: 7264) "2ve1925.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 2340) "AppLaunch.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 7308)5b:T54a,"zS3mh13.exe" called "FindFirstFileA" with parameter %TEMP%\IXP003.TMP\* (UID: 00000000-00003908) "zS3mh13.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003908) "1dS08HT5.exe" called "FindFirstFileA" with parameter %TEMP%\grandUIA5m_IU6rtfm_sK\Autofill\*.* (UID: 00000000-00007264) "1dS08HT5.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00007264) "1dS08HT5.exe" called "FindFirstFileA" with parameter %USERPROFILE%\Desktop/\* (UID: 00000000-00007264) "1dS08HT5.exe" called "FindNextFileA" with parameter desktop.ini (UID: 00000000-00007264) "1dS08HT5.exe" called "FindFirstFileA" with parameter %USERPROFILE%\Documents/\* (UID: 00000000-00007264) "1dS08HT5.exe" called "FindNextFileA" with parameter Database1.accdb (UID: 00000000-00007264) "1dS08HT5.exe" called "FindNextFileA" with parameter My Music (UID: 00000000-00007264) "1dS08HT5.exe" called "FindNextFileA" with parameter My Pictures (UID: 00000000-00007264) "1dS08HT5.exe" called "FindNextFileA" with parameter My Videos (UID: 00000000-00007264) "1dS08HT5.exe" called "FindNextFileA" with parameter OneNote Notebooks (UID: 00000000-00007264) "1dS08HT5.exe" called "FindNextFileA" with parameter Outlook Files (UID: 00000000-00007264) "1dS08HT5.exe" called "FindFirstFileA" with parameter %USERPROFILE%\Documents/\My Music\* (UID: 00000000-00007264)5c:T9f3,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "c7fffbee15d5fb4fafd44c29466adeae") Found reference to API "GetDC" (Indicator: "GetDC"; File: "c7fffbee15d5fb4fafd44c29466adeae") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003908.00000000.66643.0113A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003908.00000000.66643.0113A000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005388.00000001.69916.03020000.00000004.mdmp, 00000000-00005388.00000002.71836.03020000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005388.00000001.69916.03020000.00000004.mdmp, 00000000-00005388.00000002.71836.03020000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005388.00000001.69916.03020000.00000004.mdmp, 00000000-00005388.00000002.71836.03020000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005388.00000001.69916.03020000.00000004.mdmp, 00000000-00005388.00000002.71836.03020000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005388.00000001.69916.03020000.00000004.mdmp, 00000000-00005388.00000002.71836.03020000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005388.00000001.69916.03020000.00000004.mdmp, 00000000-00005388.00000002.71836.03020000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005388.00000001.69916.03020000.00000004.mdmp, 00000000-00005388.00000002.71836.03020000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005388.00000001.69916.03020000.00000004.mdmp, 00000000-00005388.00000002.71836.03020000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00005672.00000000.66588.0021A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005672.00000000.66588.0021A000.00000002.mdmp")5d:T7b4,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "c7fffbee15d5fb4fafd44c29466adeae") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "c7fffbee15d5fb4fafd44c29466adeae") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "c7fffbee15d5fb4fafd44c29466adeae") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00003908.00000000.66643.00BC0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00003908.00000000.66643.00BC0000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00003908.00000000.66643.0113A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00003908.00000000.66643.0113A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00003908.00000000.66643.0113A000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00005388.00000001.69916.03020000.00000004.mdmp, 00000000-00005388.00000002.71836.03020000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00005388.00000001.69916.03020000.00000004.mdmp, 00000000-00005388.00000002.71836.03020000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00005672.00000000.66588.0021A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00005672.00000000.66588.0021A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00005672.00000000.66588.0021A000.00000002.mdmp")5e:T4b7,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "c7fffbee15d5fb4fafd44c29466adeae") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "c7fffbee15d5fb4fafd44c29466adeae") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "c7fffbee15d5fb4fafd44c29466adeae") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00003908.00000000.66643.0113A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003908.00000000.66643.0113A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003908.00000000.66643.0113A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00005672.00000000.66588.0021A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005672.00000000.66588.0021A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005672.00000000.66588.0021A000.00000002.mdmp")5f:T4c8,Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "c7fffbee15d5fb4fafd44c29466adeae") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00003908.00000000.66643.00BC0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00003908.00000000.66643.00BC0000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00003908.00000000.66643.0113A000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00005388.00000001.69916.03020000.00000004.mdmp, 00000000-00005388.00000002.71836.03020000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00005388.00000001.69916.03020000.00000004.mdmp, 00000000-00005388.00000002.71836.03020000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00005672.00000000.66588.0021A000.00000002.mdmp")60:T41e,"c7fffbee15d5fb4fafd44c29466adeae.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "wI7qO24.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "yI4Yr04.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "zS3mh13.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1dS08HT5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "2ve1925.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "3tM26Fj.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK")61:Te13,"1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "80000000088e3d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "90000000088e3d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "a0000000088e3d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "b0000000088e3d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "c0000000088e3d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "d0000000088e3d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "e0000000088e3d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "f0000000088e3d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "00010000088e3d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "10010000088e3d06" "pDataOut": "2000000078413606" "$dataout": "b41f53fd7c91eeb41677c8b431507aa71d8a8df3f42de5625b7d75a16322b842"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "8000000068923d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "9000000068923d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "a000000068923d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "b000000068923d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "c000000068923d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "d000000068923d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "e000000068923d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "f000000068923d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "0001000068923d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "1001000068923d06" "pDataOut": "20000000f8423606" "$dataout": "b41f53fd7c91eeb41677c8b431507aa71d8a8df3f42de5625b7d75a16322b842"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "80000000d88b3d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "90000000d88b3d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "a0000000d88b3d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "b0000000d88b3d06" "pDataOut": "0000000000000000" "$error": "d"} "1dS08HT5.exe" called "CryptUnprotectData" with parameters {"pDataIn": "c0000000d88b3d06" "pDataOut": "0000000000000000" "$error": "d"}62:T7d0,"zS3mh13.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2ve1925.exe" for deletion "zS3mh13.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1dS08HT5.exe" for deletion "1dS08HT5.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox5m_IU6rtfm_sK\8ghN89CsjOW1formhistory.sqlite" for deletion "1dS08HT5.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox5m_IU6rtfm_sK\D87fZN3R3jFeplaces.sqlite" for deletion "1dS08HT5.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox5m_IU6rtfm_sK\02zdBXl47cvzcookies.sqlite" for deletion "1dS08HT5.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox5m_IU6rtfm_sK\Ei8DrAmaYu9KLogin Data" for deletion "1dS08HT5.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox5m_IU6rtfm_sK\D87fZN3R3jFeWeb Data" for deletion "1dS08HT5.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox5m_IU6rtfm_sK\02zdBXl47cvzHistory" for deletion "1dS08HT5.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox5m_IU6rtfm_sK\3b6N2Xdh3CYwWeb Data" for deletion "1dS08HT5.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox5m_IU6rtfm_sK\oOPEmFmu_xsJCookies" for deletion "1dS08HT5.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBox5m_IU6rtfm_sK\IWPfiAXUTJTSHistory" for deletion "1dS08HT5.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\OMsUcx3upXJL7S7JO5xBc1V60B9iC61f.zip" for deletion "1dS08HT5.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIA5m_IU6rtfm_sK\Cookies\Edge_Default.txt" for deletion "1dS08HT5.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIA5m_IU6rtfm_sK\Cookies\Firefox_ywzu7870.default.txt" for deletion "1dS08HT5.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIA5m_IU6rtfm_sK\Downloads\Edge_Default.txt" for deletion "1dS08HT5.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIA5m_IU6rtfm_sK\information.txt" for deletion "1dS08HT5.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIA5m_IU6rtfm_sK\passwords.txt" for deletion63:T615,"c7fffbee15d5fb4fafd44c29466adeae.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\wI7qO24.exe" (Handle: 644) "wI7qO24.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\yI4Yr04.exe" (Handle: 656) "yI4Yr04.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\zS3mh13.exe" (Handle: 652) "yI4Yr04.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3tM26Fj.exe" (Handle: 684) "zS3mh13.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1dS08HT5.exe" (Handle: 656) "zS3mh13.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2ve1925.exe" (Handle: 648) "1dS08HT5.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 752) "1dS08HT5.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 1088) "2ve1925.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 140) "2ve1925.exe" wrote 00000200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 140) "2ve1925.exe" wrote 0002C000 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 140) "2ve1925.exe" wrote 0000AA00 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 140)64:T46c,"1dS08HT5.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\BITCOIN" "1dS08HT5.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\ANONCOIN" "1dS08HT5.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\BBQCOIN" "1dS08HT5.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\FLORINCOIN" "1dS08HT5.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\GOLDCOIN (GLD)" "1dS08HT5.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\IOCOIN" "1dS08HT5.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\INFINITECOIN" "1dS08HT5.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\IXCOIN" "1dS08HT5.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\MEGACOIN" "1dS08HT5.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\MINCOIN" "1dS08HT5.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\YACOIN" "1dS08HT5.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\DIGITALCOIN"65:T404,"1dS08HT5.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\ATOMIC\LOCAL STORAGE" "1dS08HT5.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\ELECTRUM\WALLETS" "1dS08HT5.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\EXODUS\EXODUS.WALLET" "1dS08HT5.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\MONERO\WALLETS" "1dS08HT5.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COINOMI\COINOMI\WALLETS" "1dS08HT5.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\ELECTRONCASH\WALLETS" "1dS08HT5.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\BINANCE\APP-STORE.JSON" "1dS08HT5.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\ETHEREUM\WALLETS" "1dS08HT5.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\MULTIDOGE\MULTIDOGE.WALLET"66:T420,"1dS08HT5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "EMAIL") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "1dS08HT5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "EMAIL")67:T26d9,"1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Kids Mode\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Kids Mode\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Travel\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Travel\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\hyphen-data\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\hyphen-data\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Nurturing\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Nurturing\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\OptimizationGuidePredictionModels\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\OptimizationGuidePredictionModels\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\OriginTrials\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\OriginTrials\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SafetyTips\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SafetyTips\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\ShaderCache\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\ShaderCache\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SmartScreen\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SmartScreen\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Speech Recognition\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Speech Recognition\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1dS08HT5.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT"68:T29f9,1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Kids Mode\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Kids Mode\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Travel\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Travel\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\hyphen-data\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\hyphen-data\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Nurturing\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Nurturing\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\OptimizationGuidePredictionModels\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\OptimizationGuidePredictionModels\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\OriginTrials\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\OriginTrials\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SafetyTips\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SafetyTips\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\ShaderCache\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\ShaderCache\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SmartScreen\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SmartScreen\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Speech Recognition\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Speech Recognition\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1dS08HT5.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask69:T53c,Spawned process "c7fffbee15d5fb4fafd44c29466adeae.exe" (UID: 00000000-00007764) Spawned process "wI7qO24.exe" (UID: 00000000-00005672) Spawned process "yI4Yr04.exe" (UID: 00000000-00006640) Spawned process "zS3mh13.exe" (UID: 00000000-00003908) Spawned process "1dS08HT5.exe" (UID: 00000000-00007264) Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\OfficeTrackerNMP131\\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST" (UID: 00000000-00007536) Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\OfficeTrackerNMP131\\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST" (UID: 00000000-00002348) Spawned process "WerFault.exe" with commandline "-pss -s 440 -p 7264 -ip 7264" (UID: 00000000-00002544) Spawned process "WerFault.exe" with commandline "-u -p 7264 -s 2028" (UID: 00000000-00006840) Spawned process "2ve1925.exe" (UID: 00000000-00002340) Spawned process "AppLaunch.exe" (UID: 00000000-00007308) Spawned process "3tM26Fj.exe" (UID: 00000000-00005388) Spawned process "WerFault.exe" with commandline "-pss -s 468 -p 7784 -ip 7784" (UID: 00000000-00006984) Spawned process "WerFault.exe" with commandline "-u -p 7784 -s 828" (UID: 00000000-00007340)6a:T6862,Contains base64 string in header "Keep" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "User" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "digicert" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 26 Nov 2023 09:13:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Modified" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 26 Nov 2023 09:13:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2023" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 26 Nov 2023 09:13:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 26 Nov 2023 09:13:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 26 Nov 2023 09:13:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BWU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAOtt1sP7kgbe0cTbeFlMvU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAOtt1sP7kgbe0cTbeFlMvU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAOtt1sP7kgbe0cTbeFlMvU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAOtt1sP7kgbe0cTbeFlMvU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAOtt1sP7kgbe0cTbeFlMvU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/gtsr1/gtsr1" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "Keep" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "User" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base64 string in header "Keep" in header "GET /r.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: s.ss2.us" Contains base64 string in header "User" in header "GET /r.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: s.ss2.us" Contains base64 string in header "Keep" in header "GET /rootg2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /rootg2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "2BsKuKwH5CO65xMY" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "/rootca1" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "2Bmc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "2BXrrguICEAxnRZO2jQMmUC0dFSq96X0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base64 string in header "Keep" in header "GET /r2m02.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.r2m02.amazontrust.com" Contains base64 string in header "User" in header "GET /r2m02.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.r2m02.amazontrust.com"6b:Tc65,Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "5FM8xM9.exe.3240183890") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "5FM8xM9.exe.3240183890") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "5FM8xM9.exe.3240183890") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "5FM8xM9.exe.3240183890") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "5FM8xM9.exe.3240183890") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00001160.00000000.72673.012AE000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00001160.00000000.72673.012AE000.00000002.mdmp, 00000000-00001160.00000001.73250.012D9000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001160.00000000.72673.012AE000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001160.00000001.73250.012D9000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001160.00000001.73250.012D9000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00001160.00000001.73250.012D9000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001608.00000000.67749.003A0000.00000004.mdmp, 00000000-00001608.00000000.67749.00E97000.00000002.mdmp, 00000000-00001608.00000001.69700.003A0000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00001608.00000000.67749.003A0000.00000004.mdmp, 00000000-00001608.00000000.67749.00E97000.00000002.mdmp, 00000000-00001608.00000001.69700.003A0000.00000004.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00001608.00000000.67749.003A0000.00000004.mdmp, 00000000-00001608.00000000.67749.00E97000.00000002.mdmp, 00000000-00001608.00000001.69700.003A0000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001608.00000000.67749.003A0000.00000004.mdmp, 00000000-00001608.00000000.67749.00E97000.00000002.mdmp, 00000000-00001608.00000001.69700.003A0000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001608.00000000.67749.003A0000.00000004.mdmp, 00000000-00001608.00000000.67749.00E97000.00000002.mdmp, 00000000-00001608.00000001.69700.003A0000.00000004.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00001608.00000000.67749.003A0000.00000004.mdmp, 00000000-00001608.00000000.67749.00E97000.00000002.mdmp, 00000000-00001608.00000001.69700.003A0000.00000004.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00001608.00000000.67749.00E97000.00000002.mdmp")6c:T536,"AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")6d:T3159,"GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 73594 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Sun 26 Nov 2023 09:15:49 GMT Etag: "614b5ba7-243" expires: Tue 28 Nov 2023 09:15:49 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 73595 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Sun 26 Nov 2023 09:15:50 GMT Etag: "614b5ba7-243" expires: Tue 28 Nov 2023 09:15:50 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 169 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 26 Nov 2023 09:15:50 GMT Last-Modified: Sun 26 Nov 2023 09:13:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 73597 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Sun 26 Nov 2023 09:15:52 GMT Etag: "614b5ba7-243" expires: Tue 28 Nov 2023 09:15:52 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 73598 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Sun 26 Nov 2023 09:15:53 GMT Etag: "614b5ba7-243" expires: Tue 28 Nov 2023 09:15:53 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Sun, 26 Nov 2023 09:13:01 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 178 Cache-Control: max-age=7200 Date: Sun 26 Nov 2023 09:15:59 GMT Last-Modified: Sun 26 Nov 2023 09:13:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4751 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 26 Nov 2023 09:15:59 GMT Last-Modified: Sun 26 Nov 2023 07:56:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 73604 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Sun 26 Nov 2023 09:15:59 GMT Etag: "614b5ba7-243" expires: Tue 28 Nov 2023 09:15:59 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 26 Nov 2023 08:30:56 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2703 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Sun, 26 Nov 2023 09:13:01 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 179 Cache-Control: max-age=7200 Date: Sun 26 Nov 2023 09:16:00 GMT Last-Modified: Sun 26 Nov 2023 09:13:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Sun, 26 Nov 2023 09:13:01 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 181 Cache-Control: max-age=7200 Date: Sun 26 Nov 2023 09:16:02 GMT Last-Modified: Sun 26 Nov 2023 09:13:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT with response body ==>....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 26 Nov 2023 08:30:56 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2709 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gsr1/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1739 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun 26 Nov 2023 09:02:42 GMT Expires: Sun 26 Nov 2023 09:52:42 GMT Cache-Control: public max-age=3000 Age: 807 Last-Modified: Mon 09 Oct 2023 07:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308206C7308205AF020101300D06092A864886F70D01010B05003057310B300906035504061302424531193017060355040A1310476C6F62616C5369676E206E....... "GET /gsr1/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1739 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun 26 Nov 2023 09:02:42 GMT Expires: Sun 26 Nov 2023 09:52:42 GMT Cache-Control: public max-age=3000 Age: 811 Last-Modified: Mon 09 Oct 2023 07:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308206C7308205AF020101300D06092A864886F70D01010B05003057310B300906035504061302424531193017060355040A1310476C6F62616C5369676E206E....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4548 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 26 Nov 2023 09:16:16 GMT Last-Modified: Sun 26 Nov 2023 08:00:28 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 313 with response body ==>308201350A0100A082012E3082012A06092B06010505073001010482011B3082011730819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4549 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 26 Nov 2023 09:16:17 GMT Last-Modified: Sun 26 Nov 2023 08:00:28 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 313 with response body ==>308201350A0100A082012E3082012A06092B06010505073001010482011B3082011730819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4550 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 26 Nov 2023 09:16:18 GMT Last-Modified: Sun 26 Nov 2023 08:00:28 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 313 with response body ==>308201350A0100A082012E3082012A06092B06010505073001010482011B3082011730819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 26 Nov 2023 09:04:50 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 689 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4551 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 26 Nov 2023 09:16:19 GMT Last-Modified: Sun 26 Nov 2023 08:00:28 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 313 with response body ==>308201350A0100A082012E3082012A06092B06010505073001010482011B3082011730819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32.......6e:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")6f:T24a1,Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:GzS2HFRHnduCy1Hq8a2qLP6XSg4qbQ:iTezX-QtwSBr-G8oConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp15yZkTQ5z0ALsWGuScnNz_U06s2Ur91iq3bOmedcW29WAtvJeuJgRipU4GZSs8oI4EZy76KA HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:WJJJDunqKls-u-xG0eGhMRoeZXDTqA:6UYLaJiJxaPRAThSConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2z4gbGaKKkjDXlAR8e0XaX3H0ffRCBZSKgqRq3zL6G-GhUmXkbnbVc3Tf5HF80XDI_FA0k&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-754081415%3A1700990195236619&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:713lhuWvTAKkcINxFZ5dN33uf5cidw:ALHEDJFHhBfEjTOzConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:713lhuWvTAKkcINxFZ5dN33uf5cidw:ALHEDJFHhBfEjTOz"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:713lhuWvTAKkcINxFZ5dN33uf5cidw:ALHEDJFHhBfEjTOz; OTZ=7311524_52_52_123900_48_436380"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: store.steampowered.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /openid/loginform HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: steamcommunity.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: twitter.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /rsrc.php/y1/r/4lCu2zih0ca.svg HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/ya/l/0,cross/EQ0cyse2DGv.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yk/l/0,cross/_sJ1OtKPi6T.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yg/l/0,cross/2ZiBH0EC-Zq.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yu/r/ADqsJHQAVIy.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yc/l/0,cross/1FPNULrhhBJ.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yJ/l/0,cross/FzXL11-8Cqh.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yi/l/0,cross/yotEdcUw9Gj.css?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /security/hsts-pixel.gif HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: connect.facebook.netConnection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3i7M54/yk/l/en_US/0nf6U82YoV-.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yP/r/BS9N3H07MFM.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yK/r/UEVArDLqD6J.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yt/r/v75M7CPu9-P.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yT/r/0ZOQmhGCKxB.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/yY/r/ZYrw1loZ3fN.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v3/y7/r/uI48pQbdqMg.js?_nc_x=Ij3Wp8lg5Kz HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL")70:T906d,"0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�00000001P00000001A00000001j00000001�10dd��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R", "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:GzS2HFRHnduCy1Hq8a2qLP6XSg4qbQ:iTezX-QtwSBr-G8oConnection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 302 FoundContent-Type: application/binarySet-Cookie: __Host-GAPS=1:WJJJDunqKls-u-xG0eGhMRoeZXDTqA:6UYLaJiJxaPRAThS; Expires=Tue 25-Nov-2025 09:16:26 GMT; Path=/; Secure; HttpOnly; Priority=HIGHCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Sun 26 Nov 2023 09:16:26 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp15yZkTQ5z0ALsWGuScnNz_U06s2Ur91iq3bOmedcW29WAtvJeuJgRipU4GZSs8oI4EZy76KAStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Opener-Policy: unsafe-noneCross-Origin-Resource-Policy: cross-originAccept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factor Sec-CH-UA-Platform Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-j7pTukklbnu-TTIT-VJv2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportServer: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000", "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp15yZkTQ5z0ALsWGuScnNz_U06s2Ur91iq3bOmedcW29WAtvJeuJgRipU4GZSs8oI4EZy76KA HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:WJJJDunqKls-u-xG0eGhMRoeZXDTqA:6UYLaJiJxaPRAThSConnection: Keep-AliveAccept-Language: en-US", "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2z4gbGaKKkjDXlAR8e0XaX3H0ffRCBZSKgqRq3zL6G-GhUmXkbnbVc3Tf5HF80XDI_FA0k&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-754081415%3A1700990195236619&theme=glif HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:713lhuWvTAKkcINxFZ5dN33uf5cidw:ALHEDJFHhBfEjTOzConnection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Set-Cookie: __Host-GAPS=1:713lhuWvTAKkcINxFZ5dN33uf5cidw:ALHEDJFHhBfEjTOz;Path=/;Expires=Tue 25-Nov-2025 09:16:35 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Sun 26 Nov 2023 09:16:35 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp2z4gbGaKKkjDXlAR8e0XaX3H0ffRCBZSKgqRq3zL6G-GhUmXkbnbVc3Tf5HF80XDI_FA0k&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-754081415%3A1700990195236619&theme=glifStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk"Report-To: {"group":"coop_gse_qebhlk" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}Content-Security-Policy: require-trusted-types-for 'script';report-uri /cspreportContent-Security-Policy: script-src 'nonce-kuoXKmz8XVhE5Kem9f8FJQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportContent-Encoding: gzipX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "99{聤�JZq+i#H3��$O��Ӫ�<�Fq^�!��E��Uο�k�$��d!>k�8[u'ASu�M�4%�H�¼ ��Jo��4e8J:]Z��3[�M��;�ȗ�!�6y�iI*֢�t��E#UV�S3��tD�-6��R�8T��=7��u�`��#� ͓�p�:ßVT8�N%a�뛤�ֵ��ұ�n�H��]�^�Ty��Yw�0ս][�`""��'�J�^��14K��HU�Xv��6C�Ǜ^f��j��CىRĔ��+5c`��8ʗ��s9��0��@ ;8S��)�.a��oL2tÄ́��̏.�+?>�H�.�Aՙ��y P��z=��z�~��J_OSS9u�� p�盐Y�ڬ+GB%��I:��-�`�1��V�EuǄ��H��.ɬ4�)[A$'�R�A4�A��y0E��ϩ��5ZZ�Y�.�7�{9�Ժk4�;�_�tJ��I��3�J! ��|ثTW(��IҼʺ�dٸ��%"YKg�D׈�P��1ď��0��Dyz^M�)-�v)�I~z$p��EG�G\�Jn�Y��_�t�Х�ڣ��û#��%�^�a��ʾg��4��1��v�W�T��QOS��rz�ϻ�,9��_�`wX/�.�� hP{��n��p�hO��-��$��ZA#$C�*��Y�Rj�H�G��)߾$��f�ۖ��ߋ�>�`!^��~��?8B�Ý��O.��G=��?M��@�i��vR�>[�Q��ϓE<�B��ǔO˥��@*��ҏm�,� ��"K bvDoo�+wh�`�a�n츳��/8mq@Ne,[Җ�F��", "00000001�cc7]Y��6�+�ڗU��")i$��>��8>��xk�[y��M��sW��"W��hykS�dD��F��@7��y�m��|�?^^��=��Q�訪�aK�D|��F�_�-xi�`e��8΅�gd��~�2�9��Ds��ʀ�,��q��j�G��=��s"��JQ�\��J��Bj�=��8W��fT�H袁s'��u�C'<�b��cA�3��2�YRY�ɑ�W!@��>ت�4��!�{��;��Ɔ�R�u�XXv�Q!=��>c�d�@�~�o��U��a|�Tg4*�qǽ �E�_ҙy�B�Vh(rF�IJq�Jǰ��w��\��bA!D��|W��`�Llgj��e_�㻷��ؐ>=��M��^�@�s.�&�h��:X\Z�XSG]ۉc,b��~y�)CXp�1_��7�GwkG6��/Rn��dI�O�n�]��Ae�'��?� !<�ES�O�9�l�weCTU��?|�bP�ϱk؀�ڔ�v��(W��-�S8��~��`q��SI2��O�A�b�c�c�?�=I:E��V�T��)_e�㝒��?>��R��b��P�^5��r��u��V��Z��1�ZCէȼfQ�@t�Xݬ��D�}��M��2��=�he��o�F�C��`�>��Zx��h}68��T��n��͠�GPJ��h6��)��uUў9U�3Qv�S�NGSܗ�i��x�rR��R�r�#G'�6�N1��1ǧ�I܆��F��8'�BİMn@h4�o1FG%��טk�0��P�i��Ai�f\�'��]��k"�tW3{��R12�.�QK_�#k+x#��,*�hP��/��od�k.@#��/4�]uI+:�@��m�^��[f��oژ��%Y��!u��W��EY��΋Z�%K�#5�W��ۈ��:��!#��?=��k��" "�i��"�Yr��b�V�u@�Ӯ$��3�p�3��Ɇܼ��!{�[�I��G��'T^�o��Eq2�6�Z��V�#X��4$%w4��%��8�ռV�>o7R��PZۗL��W�O&7X9՝P�\-aG��@r��"\��6u��8��a�c�f�垌U=|�d�osR�m^��\�=�5?D��uT�5��R��1v]u��7fB��&��6Ҫ.��r�ێl�_?��r��W|��T��U��>b��)F��y��C��ϙ'd�T$�T��T�ͩZG�@�l��E.��u��'��)/׳%*vF��o0@��T��3A#|CYTy�k\'��ױ�6M�P�.��yi�{�gj>oo3l-�Y��|��|��y0}7�:�$��Bޟ�y��]�*��x~�|�z��_��?:J�=�Ӣҳ��H'�z��|��C��YN�]H�]rHР4��s��7%�5�Yf��~�=͹<��A��=b��N��8'P��&��mP��ɵh�J��k��R]P�ozr�n��s;�f��??}��rP=��#k�%Y��hOY�/ ��D�2�s�D�Ն�i��z]!�~��01��W�Ǫ3��*C�7�=Z�7I*��3�a�b0a&�6>�ҽ��酯�ز5�t'=�4P)�cd�r:ȗ�!�Kc� .��<� �f@�J2�.��b֡�d�Ռu��n� ��x��W!�U�@��/�L��2Xo�ߟe�5y�{�\��4��o?��W� ʚ2�8D��0Y?�y��[��z�~\��ZV��d~��\L��Q��xQz?_4{��w?>�WTSSȫäB�z�@��!��޳8W�"��s��raE,|��˧��L7�do�J��t��Q9��'Q�4��OaZ^e@L|#�EQ�¾\w�k҄r�5N��7�;�ϸ��˝id��Yy��m�&�c �RՄ;i��^�GH�5Į��ר�s=w�!%��'��S;v�ٱ�-��ޢ��lX��U�4��1+�(^��F�@��};��>ՙ*�t|x��t�u��`N�'��?�p��*�p��U2��[{p��`" "N�'��˻��Ѓ�oFN�^��c�8��a�%v�o(vv̘��X�_BX>F��.��B�u��X��"�*��;Gx�!< l�τi��m��&��HsS�+��i<��H��N ��4��y#L}�'�t��905�y�Z�B~,Q�ُ�]��گ0��Nڂ��ݵE�.'��w��w8��{��ww��kQ�(��/��", "00000001�00000001]00000001Q00000001O00000001�0000000100000000100000001�00000001500000001>00000001�00000001�00000001�00000001`00000001�00000001�00000001�00000001000000010000000100002514AB��n(�A��k't�]�ڕWR�k��zW �1%��,X�]'�L(+��>k��!E�H�RJ$��dA2c%�E��K`$1f@�b$��ɚFPO4Q�}�ń}��88�k�\Y�S/R�D`�ͳ��lq�(Sf�,�~Y�*^t�u��O��U��k�j��kD��f��彩6B�=Pn�j��i��7�r��Q8�6��O�1ك��h�t��z=z��v9��`�>�T��o��0�Ү��1��d�<��~�a��g��t�s��n�q�UN��C/�=��s�8U�q"�w�j�H��C�B�G�sqOS�Qh��h�gs�zUG4�j/4ŗ�>��" "00000001�00000001]00000001�00000001o00000001�0000000160000000100000001�70eW�R�f�q�&K^�y]�d��6@۽)�<{�!O��n��'��,Jԅy$թOma�ǻOy�Q-�(]�)��o=��)"9 �E��Ô�Z(�E�]�)��A�*K0ŀ�F`�);�ǀCE��0�q??0E䄫(LIK��&U�r��RU��h�L��Ksa��V�v:�SL�a=�]�)��o=��)"w�ϑ��z!�3��UMW�*��"�l�X(X3U�ʈe�;s/P1Li!4�[��L�5�u�v�A�K�b��cõ�ǂ��!��h��`Z��M��S�i�3�i��蘆��.lU#e��q��4�ң��׫��}�V�ɒl��7�@��]QI��R��y��O��Z=I]��d��m��$F�İ&1"'[hQ��??[�r3��ft��q��`+tx�Rkǆ(m��4�b@��a��w��zvU��N��o��^��k�_��_�]��7iߛT�7)��B��Q�i&v�F*��P��a>��D$�Y�h�Oxa~��9??H/K�Gz�yN(̋��a�"?#�@gec��"�H.�4��4�v�z�j��O��iO�р�k�\��0P|��JB��ar��iJ弝~Y|_��؏�s8F��=Ǣ��"�H绘H�ؗ�{�Q��t��O9��@ٿ��O^��X��US?X��<�%�z̖��p��fĶ��/<�|^|�,� ��l�<��Xq��Gp�Դ��/��W4��O.��n��<��8`��G/��>k�/�w�?G�KB�Og�o�Vۗ�0^fak/��p�Iw�v�8��ȉ�Q��n�\��%?I֟Bo=�i[��yS�I;��L�\_��K�|�/��JZ2�7��R�u:�e�M��JҾz�0�~�z}�e�Q|�5q�o�ck�-��o�[�$��_��y?u��M/��ǳ$�˸��p��vu:��.xu�?�?M��>�H��}R&��Y�(&%f�g9��N\�!:ڽ=)C��J'A*��yy/�7s$��E��R��z�/�KJ��DQs�N�Y��u`{�d��L(`9ډ�!�Fo{\Y2lŜ/��$w��B.Ir_D��*��,[��#��i��0��Ddp�,rHK��R�K�S��d��O��í�$~BF", "�[HL�Z��X[+q(�5̲zj��$��4�G>��S��C��V�K��/��)�xy$�g�3ZLp��>8$��T�]��oa"��1_$T�0��V>�;��E��1�ԯ�)��s�*ǘ��\�Bl&E�F�N��ʻ�/G��yCJz��"&Ci��<�^�W�C��8��x��q��t.��<��n�^��5�y��S�XSK'sy�U1�3;=�?gC�@@2*uo�#CH��6�"C`��!Ql�W�5�c"`��ҹ�rZ5�yO2l��Ȑ�>0�߀!e ��75�v��A��evg��n�7��1[��XM��oX�o(�t.�\�oV��@�ӂ�Z:�-~#�;��7`H@�A�o�UX,�*�.��n�7��1[��XM��oX�o(�t.�\�oV��@�c�&(��H��&z��^��vX�Rf1H��~�/��$$GN�pU��$��r*�-��}n��", "00000001�00000001]00000001M00000001o00000001�00000001@0000000100000001�00000001+00000001>00000001&00000001�00000001�00000001�00000001F00000001m00000001%00000001�00000001�00000001K01510U�JI�67l��~��X��C*�f�}�3;ޙ��$p�MK��2��5v-��XKՒb�A՚�$P�a�Ԛj/�v+�c�S�f,{��G��ʯ��M�|LA��OO8��WI|�{�#�ç'`ӓ$�Lnn�]O��5��2T[�]ՖH��~�Ԗ��kod"m��A#ЖH��iK�r,�/|�$w��%�lڒė�ͭ�kKV�&��P�%0�Pm)��T[* MԒb"m�l.AU��5װu��[D�.��㓗��Y_�$�;|��6yI��%�[�{(�dcy�l��.��L/�"��2ߓF*�MO0]Z�c�J>��l�:��QD/��F�4"NHi��|��ޭwV�LSa�ʎi�t_�0�@:X9�J�H.��ְ�7�'"7��7.:��|��v��z8�N�-�=)/�;�ovw�ldٙ��K��+��e�h2¶��w�j֫�D��P#W�R��C!��vqڌ��f�+�J��x$RGl��0㵗��f��_�(43^��襌�8V��H�n��l�ĸ��d��}��} �x�d��ng��Ħ�n��D�<�qL��fn�$��P��:�~|�6u_x�s&^��?�Z��.��m~Ώ�U$�Ψ�k��+#?��N�U]Q�~R�:.�t�\�Vl��>��O1��G(.�T��C�fu9��=��%(JU�� 0(}A`P"��-��ü�L�A��R�d*HT�� , MAX@��5��:��<��Z(�>W��"��F(�>�z�CP�-�hE�=��Ubl��/��ǂq.~��j_k$E��5��ĺ�FOb�k#��i�Ҟ��p��̾I`��B�|��u��|�eeg�U��Ś�w�>\y�?}�R�ǁ�<�D��b�:\��1��Թ�(\^t��eW��y�n%�ΗK��_Te��;�y�"��&�d��b^�;_��<��[ʻ��J-��,�R��H�z�k>��U�", "~YX��(xμU�U�FA��">��4�5�+n�G뵼a��tV,�ɼ��U��?��ޟ|��;��US�:1�8�5q_j��-p��/��y��ߍ��$�Y��y@�ma�ֻE�:�?�o��(O�~��xf��W��=�>?8/ky��", "00000001�00000001]00000001[00000001�00000001�0000000160000000100000001�00000001+0001�7f6t:��1��,,˾4��$M7Is�$y3Xt��Kl �L�{%߰��%��>-�ҹ��|G>��ϕ8Q��fh�ͮ��ݑ7��1�f��_ޙ�E�AG��̦��pLW��7�\�7��Z�~��,֫NO�1��@0u�qJG��S�M�-�^;��M�*l;#P;+4{@0��I�76?��}�wE�*�m�TmF��˖:f�<�F��98��S�&fG�I4��~QU~��끙��k��bC��jS%��$�f�߅�0��yO��y�H�Ц&O^��I��r��-N��t1Y��պ�:8v��=M?n}��*��2��!�J�*IG�demr�#)p��X:�-q0��M��UN�3��'��.r��uPM�N��6]~��jb�8!�z�F�fy��3d�C�]�"`�זܓskf8?��1�`M�^��Bà6(Ӻ^j$ܠ��$S'(�7l">P�EI�@%��܁�|�Zu�չ�Ts��|��r��o��wb[��m��L8�T�uK^J�a�j��y��_�ed|I,-)�KU��Z�k�^ߺ%^�0A�x� [I�o!^�T�Pͅ��ŤƂ��P[�ո�^�U��)� �=��B-��r؂7��\��u>U�<�E��C8X�u�k��H�K;ZS�x��4q�̲��3X�v`��ZzD�=R�D��~\i��ņ��z��i�Z�6�:�ĵ�Ÿ-p��@|��=FeJy��T�s�u)Ix~�g�'��P�$Ʊ��ӭ>7�{~�pw�.��UY -SHP h`�D]��:�:�N�/f��Y��e��+Qb�kA�f��z��/��h0�?F��i��J��ի7��̚w�ޚ��댾�-3#�u7��5�H:Rz}yk1��ӫ��'��r`oxu��51�լ;�޾��<�y��s)�� 8��u=f��~}z;~�7�o��V�}vG�5��B"E��)D4i��-{��Tb�/�&7��#m��PZ��p�DKTu��=q�U��δy�ی��q'!�17;��^n�/v%X&��g�|c��v��.�R��_�[a�v�.��'�~L� C��ʻ��q�^��*F�#<��+]�$-[�R��" "��Ip+j��ҩe�#��gl��{d�{�z_�Xq�|��wR�3�~��_��\kl�,@g".��T&??b�� EKg�$�0"��]��R&a�i�c�.{�_��r�W*�%��/-�[��hS�~��4+�}��Ni�z��[�^��nK�o�_ҿ?��Lg��}�_�ݔF��ԘY��ѻ�x�Z(O˰��ǚr�8k=v��6Y��2<�s��6��T՛X/��W�tݵ35&$��z�B��9�|��4�͕�ȷeN#��9��Q�l�OZ]��kEcջl��Ћ��tG�ϡ��!��.�;��;�*�{��E��E��=sr�y��σ��gƜ��??�g��??�g"D�Q�x�QT�ǀo�*�KepU��1G�s��GD��R��g�R�_Ó??D��\$��\$�/��x��O�\$��\$<5�"�%�"�!�.>�z��"M{�R`b�Г�58zB�I�7=!��g*��|�sGOH>�耣'$�t\��Έ�W�a�$A5�dQ�6A5�dQ�$A��AU��8/'`�L�R�s'qr��S�+��}��QKo'��aa�$t��@�$4� �$4D��$4p��$4�Ò��G@f�hZ_�Xs!�E8�N/��2[��>0��X�e(��X�e(HI�$c�5�h&c(c�5��'c(c�5��(c(c�5�/ O}�k!��" "00000001�00000001]00000001�00000001j000000010000000110000000100000001�0000000100000001�0000000100000001.00000001�00000001�00000001_00000001�00000001�0000000100000001�00000001H001�1bbq�b�`ۃ��.�5t��s�ʚ�y��#��f°�CX�2k&+>0��-�'�Rk3aX�!,e=7�U9�R�|3aX!��Ҥ��U��׺V0�W/��ʐ\;F�мC��D��D��L4��DdL4ͣ�D��O��{�Q.?��#6�T�8�1�>�ァ5��χΌ�Z�ή~(?>��|,p�g�.��CǞ}~�س�{��cO��{<�ǪCJ��d��3��,Z:�&(�y�E�`L��aq�"��kP#��ླ٦�m��Ӡ��F�sG��&�I{WbV��;n�}�|��F��|ʌk�LjgJ�y9��b�2��L��j��䤹L�wM��6�66��"S,�,��Ik�a`��5�:�HDG��e�i�h�|��" "00000001�00000001]00000001�00000001r00000001�0000000180000000100000001�0000000100000001U00000001R00000001�00000001�00000001v0001Hd3e��q��3I�ı=�gkH��K��|�+U��_�$�@@R��&yHD��ht�1��]"��?�0�8��_��J?�fFݚ4#>��R��2�z%ACz]}G`�o��N��uR��ϧ��Su6��r&`8��d6��'��-��`�qK�yw|�ٔo<��S3Vr��P��4i,�P� �|pX�T��H8;�?�z��O�믺^�҂��v.��K�(��!��A#�#�)ȗ��;1f�£�$�mK�b#��f0��|_�"fSت�Go�\sE�yn7�J#ye�׸�̷�-F�u�̮rm�=�^T��۠��U(3��#g�#1��~��o��|�r�3G��qp��]�yMZ7��q��r��z��U}�]-�~{Sw��ҹZG�,^[vtmM4�#��uF'�/�� ??K�1��*?H�e�:��B��"N�8�|��/��\��ފ�[hX��(�c)�BJz��%�R��ķ�XP��wK*�ڽ�?�DV��@�PH��C�c��cT�, �YJ/��ҾW��h^n�3� &�c�@�P��R��"e4�1�:��}�qF��6L�d�(�BUқܘ&�Nܻ�C�D��C�QeM��P�C�l�y��yg1 �`��Ov5�$�RX�B��8u��0K��k��&ϔR&^��*/��o�� /M��R�|��j�3�͇C�:FP�t �U(&`�S��P�TL�ߗ:�:,��qj0Ja��Ɨ�U�.a�Ai�~��"�H��}`��6��R��p:�ps��ig�OkP�G)*�\5~��T(��Q�L��$�{�]��F��xoaM�Ap�]nW�n�{��H��3ED.&�o��Ҟy��rm��GƑ��q�.�d��P�p�h��cqJ�|U��8��"�82��&KW��v]BN2B�mƁ6�?'�\L1�i1�8��G߶~�,��1\F]{��&�%�g�Ez�[��\ᯰ��['7�0�f�iGq�r_��?�W�8��:�^��t�j��v��x��_XtY�D�|��(��桙�O�QN�b��%�� ljm=��^��"%��GN��^��r�vU�G�;ۼq��lBލ��&l$h�f��ק�m��"��9$@��7O9�k�sb[Օ�]u�{��\7��<��{�XN8(�=�2Ws9��-X7$��~P��8��ܫ��J�6��!��D��X��$�柕��^U��<��W��j��;��2>��=��@�ۖ'5�FTx^B{]�ab��C��<��x:�˥��zwΟ��Q7��cE��ͥk��]4ʉ��`~MbO%߭��̻ȁ��2ý��xȚ�c�8T��q�[tY>[]$��Ҝ^J+k�v�]��Ut�X��dd��C�ܷB,g��O1�g̝��v��}|�hZ� ��/��y��X�>H'��c�S��3/�C|��]B��B�H��u�ES��vu�%7s5Y�1a�d��W�|�� El7M��-��:%��a��7�1�z�t@�VП��#��q֒zwz��JE#f;��9��o��qdd�:A��Ffo�GyWk�&r�uw�Yv�jgz��2)W]��z��t��>�kiP(��96��8�j6v��]�Ź�֘\7 p�ɼBf�[ d\�!�q�A[��'��'��V(�Ƌ�6IQd+eE��%��@K��w2��(�&,5\��y��B�U4M��[rXrY��(:�y�B�p��b-��:�y#�i�gg}3˷�_j��&vp{��:;�]-u;[�͓�}8��I�"�p�@<-a2@.��x"�g��^ ��{��mO�s\��w6r��B�i7ߎ�d�٫�v2d�8w��<�c�x#�GS�S>��do'@]G��]Ag�8.ٜ(=$��e�N��تzcK%�\�WahHY9$`�+Dz7S�QMR��]�9v��{�5�H)��#�[WS�Q|�2L��{��`g��Ac >bO��r��4۞��s�A�밙�99iC6iJ:�ʸW�o�p��%��[ǖ��7v�D��e�!�� @��c5b/R�){F�*��y�Ԥ'�`nP��_�6SRU��2E�v�Ȕ�7&�2�JX��QĊ��Ż��jd�xij��d�`i{��)q��JO/OƱ�LT7��W��ዸ�R��!n�1��S�<�荒�Gi]��%>��^l�嫅�AѠ6}X� "�>B�2βXc-�Q�i", "~3��c��Ý9ӿ_<�П��e��$�i/�U��Z��j[��Ո�V�;�[��_o쇅g�l�%��z$�z��ڭ|�w��p\Κ��*"�خ��X�iwlo�3�|��z��M�1��UNy8��Ӻ��@��zo��)�6P��d��tɝ�:~��戤E��0�I��}�]!�\�"��L��pd̓��W6)�˄�ͫ�y��AY�D�M��P��^O?c��ß��d�� 6nD��wb)�y�=��zhK(��^YRNU�2�|��6[��F��&�>��-.LZ��e��w�*�$X'�m��??V��`��", "00000001�00000001]00000001Y00000001o0000000100000001775f�+B�J��F� M��F�(T�A�a�H��M��%��]��k)��y��3??�YA2f�!}·��y��B�\��l1��j�Y��+�n�T}��[��>(��و��5Tk��LX��1�I/o��V��T�=.S1Gm*��>Z=Kd�H��W�9s��`�%{��j�R�z��b=��W�ǠN�RJ�f��#3 *�'��U��f��*�J�.p�-�u��N�.*f�SEޖ��f�J&B��i˪;W��!�U=n�ǘ�oֲ��/ė�)? ��f�O��k�]+�!�N��ƈ��D�&�i��٭�Vkr^�Ꭽ4��N~}��o�B��o^ވ7�UC�kӻq6�?.?/'�T�~+]#<��h��*��{ E�FϽ�?� ��ӻ��%��߲τt,1�S�W:�ی;��*Rt7�E�Pj5|�o��^�6W3O��P�\�TȖq�\0��)Ȇ/�=^H�lD+*�U6�r�y��j�*�ܓ��KR��'+;~��b�ˌ��׶G�\��n��%f=T��Æ�Ӏ��j��r�n��}&��I�!ζҖ��&��d�TL֭J+�y�c*�M��l��2�1v�)��̀�(9�:1�iA�ʒg�@e��tZz��f��W��X��x�aO�h�e�Uo��v��Ѳ��ޗ��K��Q�YiO�H�3��xa��k�-H�0��>�,�.��"P��r�ʲ��-��r�l\��t0Y�ӋW�"㯛�%>v��ez�g��G{�@��,�$�[G֔�X1�&�!��U|O�9[�;k��E^�bЩ�}�I-iKdK��?�Y�FjԷ�E��B4OGێ�� HU�|#=+�!)C�h�M8or��E�J�y(��̼��]&�i��Y�Oä�|?3-��ԅ�8J@{��F�8,�dM�9��Ш��wc��X,��$`�L#��U��N�.:-j�0(c�[ޙ!i2�� >�W2=�,�%ǝם��ͱ�/�n=J��G�ws5� �}��GN�t��?K:��?�a��C��삤�b��ܦ;s/��" "�t,ބ]�^��j��wd��Mn�4݉ۈϓd��j�6L��_TY�˕��(�!�P'�b��Im�}r:�� Gb��ni�>zyz�'�].u նy��s��!k�VG��q��ܛ�L$��*w q�\Z�c�вj3ۃ��HҘ�؇�^sFX�x�P��XO��䚳c��G�6�yġO*Z/~�C�b�#��;l�C��F��<�T�K?��m��v�U`(чњQ�6A�T�W��n��Iՠ��$oPH{z\��v� G�M�q�d2-��щ�3�,�v�9Gؼ�q�t��g��7�zQ -�9�&.��Qp~�3��e0�b�>��4��ty�I�e�m��kܩ�v�m�6ʕ��a��z��Gǖ��^{�Vd�w�Ts�g2��(�{�O�ߧ�o��W��>셯Ľ6��gr�ǜ�S&�v�l ��f=�l`(��"��c�ulXZ?!�k�~ҍ�R�=��ޭ�Mpu�@碤/�`�vukj��u��~��}5:Z�[�^b��D��", "00000001�0000000100000001�00000001o00000001�00000001�00000001�00d88_�t5i�B�3�T��Vuk��k��Ґ�+��/o��y��{'m��?�nsmS��-��~v6��?>��R��C��o32ݕy��x��"��D�C��C�,��̀��=]�"��jw(��`�m��p{�C��۽V��_��k��|΋�En̋B�W�@��U��g�&��Zx�?�C(�cA�XK"w"^�F�c�N-v��LR�)̍7�F��(��`/��_D�pX��A�(��6MIF�l�Uz�#�Lǂ8��M��ɓ`��&z��s�1/q�~�К�N͌x]�E�n`Ω�/��Դ�۰Z�n��vGImz��v��#rhѵH*�c�cЕ��m<�o��U�Tۗ�03�E$4Y]K��O)IZ�e�p�"�ք��,��\Q)�Zl7�%�g�e��E?9�I��U��KfFU%�j��^�u��v��H;��/��شz�c��#��o��8A��]��&��B׶�ꕘ�r�� &Z:�2;]S{�uǢ=F��R�ӥ�P��ӳ(�:=1��)�od�(�ݎ.�X�a�u�6�H�O�|c5��u��û�=��bj�au��Ƽ��7�&�:�؛�V�;5R��aC�A�p�=Ąc��$`��9�n�)lG�66�(Y��s+�E�;Lh�#9Ht_��:��.��%C��]oݚ4��'��nI��$�I��Ȧ:ǿ5]��P��IR.�޻�n��YXm��K�d��`�[ն�A��bj�)�[urm�b�/��g'��҄�x��/,��%%��B̺�ތ�eY ��+:��G��m�m��%vT9�c8��*�4��0��iӴ��la-��1�ez>߄3۴�{�a�^z��8S׾��o>��S:+�O��C�xܠ'qr5��R�o�4�Y�-��ұ[*�\C�ʵ<¢��JyH�Je��z?�f��o��[_iI� �e_d�e��'�r��L�@�m�,�һզ��[�m??L��X�ed�iaJWt:Y,;- ��Dc< �!!�;�D^��ɑ�aB �#�T�Z��d4��!TIL�ڦ9��%iee�Z7u�ʈ�� n%4�z�i�W1�>t�\�O��-2�k�7��@��G��ؾ�b��^h�", "��>@f`��(_�u��Tr��G�:��=!��B��ٴt�8㴪%��o�'��T�iʸ��\�f�$�M�!0�ъJ�?1Q��Ig�b4�Cr[O�`غ��M��/Ł��հ�:)�"RѠcL!�#�+Da#DT&FU�{��z�P�4 GrXP2�b?#�Q}�(!��O�~��A�ZO!��C�O��2��K��!237X��"NM�YQ� }��@�tj�犪�N+)��B��H]ީ^�h-�B##c�ƭ7�3��g��t��[�1�� \�.�c�zhnU��}��y8�2�P0��l�MPGuR+V �%X��B�"�d1��:��_$�1�-Ou�z%.6�"�Q�a�3�w� �!�|�aB�#$��O�?s� �ԑp��?�È�&��f�u�Ø��C҇d�.@��egM9�#��"�[��rU�s��㫾�R�t��Ȼ1�_�l��"(��L��@ R�A��9��Џb\I:_��@�#��w��)�>�kx��r��W'�׻��s��&�l��ce��M��ik`p��}c<��zkx��˹��׶��vȏH;�"��Φ�0��v�{��м��a�8��X�y�K~��0E�ٸ��"^Jb�w��;��}��2��x1�jh��@+�h�0\��׍@{�`�oL׹�?�P�H.��O[l"�HK��}�$#L�Q q`k��D�Ȃ�a�S��55"��IA60v��}@�Y1ֲ�L��F�uڱ��(�"��`HTd]!�v�7�K��(�/��y�o�n!��IP6�G��u��\��l\ʼ�h#�#�~�>��vyy�Z��i�*��4m��!g�؃h�:z6��6L�S��[tLtWx�`�&�s��z�4=��ӥ�b��W�{��\�Y+!w �C7@\�KŨZ��0��':�l��Ò�˨1�Oﮯ挡��K��% �ux*��)c��_�W2p\� �:�F#]��R�'��f3��E�� F�.^q��D��WD��N��G�Ҵ��`��AE|#Ix�q�1#m�9��>}��5�br�˧�S�p��N9wC��>�s��M��˷�}�ON�ۧ�繸E�Wp�^z\Wz�*�d��w�)�W�y��g�G�߽��DmE�o�~3I\ ��.�aS�N��M��+Ȯ��;L7"��Psk�� H�s[�,jnc�Bͭ�isvc[�,jnc�Bͭ ��$��m=��=s�C!��\�k��"71:T877,file/memory contains long string with (Indicator: "HTTP/1.1"; File: "~DF00400B27B413A4A7.TMP") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: store.steampowered.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: twitter.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /rsrc.php/yb/r/hLRJ1GG_y0J.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Thu, 23 Nov 2023 22:42:38 GMTExpires: Fri, 22 Nov 2024 22:42:38 GMTLast-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Age: 210863Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /geoip/v2.1/city/me HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001608.00000001.69700.003A0000.00000004.mdmp") Found string "GET /demo/home.php?s=67.218.111.202 HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001608.00000001.69700.02410000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00001608.00000001.69700.02410000.00000004.mdmp") Found string "HTTP/1.1 403 Forbidden" (Indicator: "HTTP/1.1"; Source: "00000000-00001608.00000001.69700.02410000.00000004.mdmp")72:T31c9,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 26 Nov 2023 09:13:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 26 Nov 2023 09:13:01 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEATh56TcXPL" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrj" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdi" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "uNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0B" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZR" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAOtt1sP7kgbe0cTbeFlMvU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEAOtt1s" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAOtt1sP7kgbe0cTbeFlMvU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEAx5qUSwjBG" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnx" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffH" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk4" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "5WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6q" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLw" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base62 string in header "2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDk" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: o.ss2.us" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPW" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "IWZzHshBOCggCEwdzEkpLy9ROx7U76vGU" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIf" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "aREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmb" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAxnRZO2jQMmUC0dFSq96X0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m02.amazontrust.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"73:T1172,Found string "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIAznGSfBTGoj6KW\Files\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00001608.00000001.69700.02410000.00000004.mdmp") Found string "\Users\HAPUBWS\AppData\Local\Temp\grandUIAznGSfBTGoj6KW\Files\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\*.*" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00001608.00000001.69700.02410000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIAznGSfBTGoj6KW\Files\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Document Themes" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00001608.00000001.69700.02410000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIAznGSfBTGoj6KW\Files\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\SmartArt Graphics" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00001608.00000001.69700.02410000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIAznGSfBTGoj6KW\Files\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Document Themes\1033" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00001608.00000001.69700.02410000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIAznGSfBTGoj6KW\Files\AppData\Roaming\Microsoft\Templates\LiveContent\User\Document Themes" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00001608.00000001.69700.02410000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIAznGSfBTGoj6KW\Files\AppData\Roaming\Microsoft\Templates\LiveContent\User\SmartArt Graphics" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00001608.00000001.69700.02410000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIAznGSfBTGoj6KW\Files\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\SmartArt Graphics\1033" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00001608.00000001.69700.02410000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIAznGSfBTGoj6KW\Files\AppData\Roaming\Microsoft\Templates\LiveContent\User\Document Themes\1033" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00001608.00000001.69700.02410000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIAznGSfBTGoj6KW\Files\AppData\Roaming\Microsoft\Templates\LiveContent\User\SmartArt Graphics\1033" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00001608.00000001.69700.02410000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIAznGSfBTGoj6KW\Files\AppData\Roaming\Microsoft\Templates\LiveContent\Managed" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00001608.00000001.69700.02410000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIAznGSfBTGoj6KW\Files\AppData\Roaming\Microsoft\Templates\LiveContent\User" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00001608.00000001.69700.02410000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIAznGSfBTGoj6KW\Files\AppData\Roaming\Microsoft\Templates" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00001608.00000001.69700.02410000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIAznGSfBTGoj6KW\Files\AppData\Roaming\Microsoft\Templates\LiveContent" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00001608.00000001.69700.02410000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIAznGSfBTGoj6KW\Files\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\1033" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00001608.00000001.69700.02410000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIAznGSfBTGoj6KW\Files\AppData\Roaming\Microsoft\Templates\LiveContent\User\Word Document Building Blocks" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00001608.00000001.69700.02410000.00000004.mdmp") Found string "C:\Users\HAPUBWS\AppData\Local\Temp\grandUIAznGSfBTGoj6KW\Files\AppData\Roaming\Microsoft\Templates\LiveContent\User\Word Document Building Blocks\1033" (Indicator: "\roaming\microsoft\templates"; Source: "00000000-00001608.00000001.69700.02410000.00000004.mdmp")74:T5d0,"CabC33D.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\CabC33D.tmp]- [targetUID: 00000000-00004020] "CabD781.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00004020] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00000920] "CabAE00.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\CabAE00.tmp]- [targetUID: 00000000-00000920] "CabD8DB.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\CabD8DB.tmp]- [targetUID: 00000000-00003140]75:T814,"new_login_bg_strong_mask_1_.jpg" has type "JPEG image data Exif standard: [TIFF image data little-endian direntries=0] baseline precision 8 1920x1080 components 3" and extension "jpg" "header_logo_1_.png" has type "PNG image data 744 x 171 8-bit/color RGBA non-interlaced" and extension "png" "Y0L6f5sxdIV_1_.png" has type "PNG image data 283 x 315 8-bit colormap non-interlaced" and extension "png" "header_menu_hamburger_1_.png" has type "PNG image data 244 x 212 8-bit/color RGBA non-interlaced" and extension "png" "footerLogo_valve_2_.png" has type "PNG image data 96 x 26 8-bit/color RGBA non-interlaced" and extension "png" "code_box_1_.png" has type "PNG image data 222 x 28 8-bit/color RGBA non-interlaced" and extension "png" "friendlyname_box_1_.png" has type "PNG image data 222 x 28 8-bit/color RGBA non-interlaced" and extension "png" "footerLogo_valve_new_1_.png" has type "PNG image data 176 x 50 8-bit/color RGBA non-interlaced" and extension "png" "logo_valve_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png" "ico_twitter_1_.gif" has type "GIF image data version 89a 16 x 16" and extension "gif" "ico_facebook_1_.gif" has type "GIF image data version 89a 16 x 16" and extension "gif" "logo46x38_1_.png" has type "PNG image data 46 x 38 8-bit/color RGBA non-interlaced" and extension "png" "btn_header_installsteam_download_1_.png" has type "PNG image data 15 x 13 8-bit/color RGBA non-interlaced" and extension "png" "btn_arrow_down_padded_1_.png" has type "PNG image data 19 x 12 8-bit/color RGBA non-interlaced" and extension "png" "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced" and extension "png" "header_menu_hamburger_2_.png" has type "PNG image data 244 x 212 8-bit/color RGBA non-interlaced" and extension "png" "footerLogo_valve_1_.png" has type "PNG image data 96 x 26 8-bit/color RGBA non-interlaced" and extension "png" "logo_valve_footer_2_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png"76:T8004,"initAft()