24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 5d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample cd732d10374e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample cd732d10374e…. Malware family: Crifi.Generic. Threat score 100/100. 14/24 AV engines flagged this file. 12 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1"],"about":{"@type":"SoftwareApplication","name":"55c92c9d066595ad73adb426e0e8323b.exe","applicationCategory":["peexe","executable"],"identifier":"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":14,"total":24},"behavioralIndicators":{"malicious":12,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T25c4,Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolder"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBeep"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")26:T484,"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" called "FindResourceA" with parameter "8655568" - (UID: 00000000-00005688) "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" called "FindResourceA" with parameter "8655608" - (UID: 00000000-00005688) "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" called "FindResourceA" with parameter "8655624" - (UID: 00000000-00005688) "VV6sP45.exe" called "FindResourceA" with parameter "3937100" - (UID: 00000000-00005656) "VV6sP45.exe" called "FindResourceA" with parameter "1572208" - (UID: 00000000-00005656) "VV6sP45.exe" called "FindResourceA" with parameter "3936968" - (UID: 00000000-00005656) "VV6sP45.exe" called "FindResourceA" with parameter "3936976" - (UID: 00000000-00005656) "VV6sP45.exe" called "FindResourceA" with parameter "3937004" - (UID: 00000000-00005656) "VV6sP45.exe" called "FindResourceA" with parameter "3937016" - (UID: 00000000-00005656) "VV6sP45.exe" called "FindResourceA" with parameter "3937032" - (UID: 00000000-00005656) "1cA05zG2.exe" called "FindResourceW" with parameter "200" - (UID: 00000000-00005948)27:Ta20,"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8702064'}" (UID: 00000000-00005688) "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8702016'}" (UID: 00000000-00005688) "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8701968'}" (UID: 00000000-00005688) "VV6sP45.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3983328'}" (UID: 00000000-00005656) "VV6sP45.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3983440'}" (UID: 00000000-00005656) "VV6sP45.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3983472'}" (UID: 00000000-00005656) "VV6sP45.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3983456'}" (UID: 00000000-00005656) "VV6sP45.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3983424'}" (UID: 00000000-00005656) "VV6sP45.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '3983376'}" (UID: 00000000-00005656) "1cA05zG2.exe" called "LoadResource with parameter {'hModule': '1114112', 'hResInfo': '1983784'}" (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadResource with parameter {'hModule': '1114112', 'hResInfo': '1983800'}" (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadResource with parameter {'hModule': '1114112', 'hResInfo': '1983624'}" (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadResource with parameter {'hModule': '1114112', 'hResInfo': '1983832'}" (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadResource with parameter {'hModule': '1114112', 'hResInfo': '1983480'}" (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadResource with parameter {'hModule': '1114112', 'hResInfo': '1983816'}" (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadResource with parameter {'hModule': '1114112', 'hResInfo': '1983496'}" (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadResource with parameter {'hModule': '1114112', 'hResInfo': '1983640'}" (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadResource with parameter {'hModule': '1114112', 'hResInfo': '1983848'}" (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadResource with parameter {'hModule': '1114112', 'hResInfo': '1983512'}" (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadResource with parameter {'hModule': '1872101376', 'hResInfo': '1872278024'}" (UID: 00000000-00005948)28:Tb9e,Found reference to "AesGcm256" (Indicator: "Aes"; File: "00000640.00000280.5835460.00402000.wprm") Found reference to "AesGcm256" (Indicator: "AesGcm"; File: "00000640.00000280.5835460.00402000.wprm") Found reference to "AesFastEngine" (Indicator: "Aes"; File: "00000640.00000280.5835460.00402000.wprm") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00000640.00000280.5835460.00402000.wprm") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00000640.00000280.5835460.00402000.wprm") Found reference to "AesGcm256" (Indicator: "Aes"; Source: "00000000-00001384.00000000.75303.00CFD000.00000004.mdmp, 00000000-00001384.00000001.75360.00CFD000.00000004.mdmp") Found reference to "AesGcm256" (Indicator: "AesGcm"; Source: "00000000-00001384.00000000.75303.00CFD000.00000004.mdmp, 00000000-00001384.00000001.75360.00CFD000.00000004.mdmp") Found reference to "AesFastEngine" (Indicator: "Aes"; Source: "00000000-00001384.00000000.75303.00CFD000.00000004.mdmp, 00000000-00001384.00000001.75360.00CFD000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001384.00000000.75303.00CFD000.00000004.mdmp, 00000000-00001384.00000001.75360.00CFD000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00001384.00000000.75303.00CFD000.00000004.mdmp, 00000000-00001384.00000001.75360.00CFD000.00000004.mdmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; Source: "00000000-00005656.00000000.72842.001E0000.00000004.mdmp, 00000000-00005656.00000001.74768.001E0000.00000004.mdmp, 00000000-00005656.00000002.74978.001E0000.00000004.mdmp") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; Source: "00000000-00005656.00000000.72842.001E0000.00000004.mdmp, 00000000-00005656.00000001.74768.001E0000.00000004.mdmp, 00000000-00005656.00000002.74978.001E0000.00000004.mdmp") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>" (Indicator: "SHA384"; Source: "00000000-00005656.00000000.72842.001E0000.00000004.mdmp, 00000000-00005656.00000001.74768.001E0000.00000004.mdmp, 00000000-00005656.00000002.74978.001E0000.00000004.mdmp") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; Source: "00000000-00005656.00000000.72842.001E0000.00000004.mdmp, 00000000-00005656.00000001.74768.001E0000.00000004.mdmp, 00000000-00005656.00000002.74978.001E0000.00000004.mdmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; Source: "00000000-00005656.00000000.72842.001E0000.00000004.mdmp, 00000000-00005656.00000001.74768.001E0000.00000004.mdmp, 00000000-00005656.00000002.74978.001E0000.00000004.mdmp")29:T15e0,Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00003840-8696-2701-013C3B50 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00003840-8696-2701-013C3B50 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00003840-8696-2701-013C3B50 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00003840-8696-2701-013C3B50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-8696-2727-013B808E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-8696-2742-013B51A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-8696-2742-013B51A3 Assembly shows XOR instruction xor ebp dword ptr [esp+24h] in Stream UID: 00000000-00003840-8696-2807-013B176E Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00003840-8696-2807-013B176E Assembly shows XOR instruction xor ebp eax in Stream UID: 00000000-00003840-8696-2807-013B176E Assembly shows XOR instruction xor ebx eax in Stream UID: 00000000-00003840-8696-2807-013B176E Assembly shows XOR instruction xor eax ebx in Stream UID: 00000000-00003840-8696-2807-013B176E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-8696-2807-013B176E Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00003840-8696-2903-013B2895 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00003840-8696-2903-013B2895 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00003840-8696-2903-013B2895 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00003840-8696-2903-013B2895 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00003840-8696-2903-013B2895 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-8696-3086-013BB832 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-8696-3086-013BB832 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-8696-3114-013BBE08 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-8696-3114-013BBE08 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-8696-3124-013BC487 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-8696-3124-013BC487 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-8696-3127-013BC08B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-8696-3127-013BC08B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-8696-3140-013BD21F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-8696-3140-013BD21F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-8696-3205-013C256F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-8696-3205-013C256F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-8696-3233-013BE019 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-8696-3233-013BE019 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-8696-3244-013BE4D1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-8696-3244-013BE4D1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-8696-3246-013BE5AC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-8696-3246-013BE5AC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003840-8696-3247-013BE695 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003840-8696-3247-013BE695 Assembly shows XOR instruction xor edx eax in Stream UID: 00000000-00002828-9256-11-004080EE Assembly shows XOR instruction xor edi dword ptr [0042B018h] in Stream UID: 00000000-00002828-9256-11-004080EE Assembly shows XOR instruction xor eax dword ptr [0042B018h] in Stream UID: 00000000-00002828-9256-12-00405FF6 Assembly shows XOR instruction xor esi edx in Stream UID: 00000000-00002828-9256-24-00406CCA Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00002828-9256-24-00406CCA Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00002828-9256-24-00406CCA Assembly shows XOR instruction xor ebx edx in Stream UID: 00000000-00002828-9256-24-00406CCA Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00002828-9256-43-00401810 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002828-9256-43-00401810 Assembly shows XOR instruction xor esi dword ptr [0042C734h] in Stream UID: 00000000-00002828-9256-49-0040A76F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002828-9256-54-0040F498 Assembly shows XOR instruction xor eax esi in Stream UID: 00000000-00002828-9256-87-00401D70 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002828-9256-89-00409461 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002828-9256-89-00409461 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002828-9256-94-00409065 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002828-9256-94-00409065 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002828-9256-96-0040BD14 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002828-9256-96-0040BD142a:T408,Found string "C:\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; File: "00000000-00003840.00000001.74971.000F0000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00001384.00000001.75360.000B0000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003112.00000000.82956.00370000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003840.00000001.74971.000F0000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00005656.00000000.72842.001E0000.00000004.mdmp, 00000000-00005656.00000001.74768.001E0000.00000004.mdmp, 00000000-00005656.00000002.74978.001E0000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00005688.00000001.74689.003D0000.00000004.mdmp, 00000000-00005688.00000002.75367.003D0000.00000004.mdmp")2b:T4096,Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Cache-Control: max-age = 14400Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/oBFYYahzgVI" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/75r4ZyA3vA0" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/9UVbN0w5E6Y" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/we1/pl4XiTjSDSk" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/x6Eg-8TSwUw.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we1/x6Eg-8TSwUw.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/x6Eg-8TSwUw.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/we1/G0k" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /rootg2.cer HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crt.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /rootg2.cer HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crt.rootg2.amazontrust.com" Contains base64 string in header "/we2/yK5nPhtHKQs" in header "GET /we2/yK5nPhtHKQs.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we2/yK5nPhtHKQs.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we2/yK5nPhtHKQs.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we2/yK5nPhtHKQs.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/oQ6nyr8F0m0" in header "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "2BsKuKwH5CO65xMY" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com"2c:T30f7,Found XOR loop in file "1cA05zG2.exe" at offset 72323; code bytes = 30d0 Found XOR loop in file "1cA05zG2.exe" at offset 122082; code bytes = 30d0 Found XOR loop in file "1cA05zG2.exe" at offset 376916; code bytes = 30d0 Found XOR loop in file "1cA05zG2.exe" at offset 376937; code bytes = 30d0 Found XOR loop in file "1cA05zG2.exe" at offset 691258; code bytes = 30d0 Found XOR loop in file "1cA05zG2.exe" at offset 887915; code bytes = 30d0 Found XOR loop in file "1cA05zG2.exe" at offset 888929; code bytes = 30d0 Found XOR loop in file "1cA05zG2.exe" at offset 891921; code bytes = 30d0 Found XOR loop in file "1cA05zG2.exe" at offset 900833; code bytes = 30d0 Found XOR loop in file "1cA05zG2.exe" at offset 913601; code bytes = 30d0 Found XOR loop in file "1cA05zG2.exe" at offset 130790; code bytes = 33c1 Found XOR loop in file "1cA05zG2.exe" at offset 140043; code bytes = 33c1 Found XOR loop in file "1cA05zG2.exe" at offset 140172; code bytes = 33c1 Found XOR loop in file "1cA05zG2.exe" at offset 351053; code bytes = 33c1 Found XOR loop in file "1cA05zG2.exe" at offset 463773; code bytes = 33c1 Found XOR loop in file "1cA05zG2.exe" at offset 463848; code bytes = 33c1 Found XOR loop in file "1cA05zG2.exe" at offset 597022; code bytes = 33c1 Found XOR loop in file "1cA05zG2.exe" at offset 701978; code bytes = 33c1 Found XOR loop in file "1cA05zG2.exe" at offset 709317; code bytes = 33c1 Found XOR loop in file "1cA05zG2.exe" at offset 709765; code bytes = 33c1 Found XOR loop in file "1cA05zG2.exe" at offset 710341; code bytes = 33c1 Found XOR loop in file "1cA05zG2.exe" at offset 710789; code bytes = 33c1 Found XOR loop in file "1cA05zG2.exe" at offset 895349; code bytes = 33c1 Found XOR loop in file "1cA05zG2.exe" at offset 905289; code bytes = 33c1 Found XOR loop in file "1cA05zG2.exe" at offset 1330; code bytes = 8030 Found XOR loop in file "1cA05zG2.exe" at offset 1959; code bytes = 8030 Found XOR loop in file "1cA05zG2.exe" at offset 232120; code bytes = 8030 Found XOR loop in file "1cA05zG2.exe" at offset 356589; code bytes = 8030 Found XOR loop in file "1cA05zG2.exe" at offset 674772; code bytes = 8030 Found XOR loop in file "1cA05zG2.exe" at offset 687130; code bytes = 8030 Found XOR loop in file "1cA05zG2.exe" at offset 887876; code bytes = 8030 Found XOR loop in file "1cA05zG2.exe" at offset 890824; code bytes = 8030 Found XOR loop in file "1cA05zG2.exe" at offset 894056; code bytes = 8030 Found XOR loop in file "1cA05zG2.exe" at offset 913562; code bytes = 8030 Found XOR loop in file "VV6sP45.exe" at offset 159610; code bytes = 30d0 Found XOR loop in file "VV6sP45.exe" at offset 205029; code bytes = 30d0 Found XOR loop in file "VV6sP45.exe" at offset 227429; code bytes = 30d0 Found XOR loop in file "VV6sP45.exe" at offset 249204; code bytes = 30d0 Found XOR loop in file "VV6sP45.exe" at offset 429904; code bytes = 30d0 Found XOR loop in file "VV6sP45.exe" at offset 452208; code bytes = 30d0 Found XOR loop in file "VV6sP45.exe" at offset 525780; code bytes = 30d0 Found XOR loop in file "VV6sP45.exe" at offset 543318; code bytes = 30d0 Found XOR loop in file "VV6sP45.exe" at offset 586774; code bytes = 30d0 Found XOR loop in file "VV6sP45.exe" at offset 590949; code bytes = 30d0 Found XOR loop in file "VV6sP45.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "VV6sP45.exe" at offset 243520; code bytes = 33c1 Found XOR loop in file "VV6sP45.exe" at offset 291751; code bytes = 33c1 Found XOR loop in file "VV6sP45.exe" at offset 299787; code bytes = 33c1 Found XOR loop in file "VV6sP45.exe" at offset 342225; code bytes = 33c1 Found XOR loop in file "VV6sP45.exe" at offset 438244; code bytes = 33c1 Found XOR loop in file "VV6sP45.exe" at offset 438699; code bytes = 33c1 Found XOR loop in file "VV6sP45.exe" at offset 503844; code bytes = 33c1 Found XOR loop in file "VV6sP45.exe" at offset 563662; code bytes = 33c1 Found XOR loop in file "VV6sP45.exe" at offset 689081; code bytes = 33c1 Found XOR loop in file "VV6sP45.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "VV6sP45.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "VV6sP45.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "VV6sP45.exe" at offset 200430; code bytes = 8030 Found XOR loop in file "VV6sP45.exe" at offset 381056; code bytes = 8030 Found XOR loop in file "VV6sP45.exe" at offset 610418; code bytes = 8030 Found XOR loop in file "VV6sP45.exe" at offset 614658; code bytes = 8030 Found XOR loop in file "3Yb11Xt.exe" at offset 8228; code bytes = 30d0 Found XOR loop in file "3Yb11Xt.exe" at offset 8493; code bytes = 30d0 Found XOR loop in file "3Yb11Xt.exe" at offset 8511; code bytes = 30d0 Found XOR loop in file "3Yb11Xt.exe" at offset 8541; code bytes = 30d0 Found XOR loop in file "3Yb11Xt.exe" at offset 8588; code bytes = 30d0 Found XOR loop in file "3Yb11Xt.exe" at offset 8606; code bytes = 30d0 Found XOR loop in file "3Yb11Xt.exe" at offset 8629; code bytes = 30d0 Found XOR loop in file "3Yb11Xt.exe" at offset 8663; code bytes = 30d0 Found XOR loop in file "3Yb11Xt.exe" at offset 8756; code bytes = 30d0 Found XOR loop in file "3Yb11Xt.exe" at offset 8805; code bytes = 30d0 Found XOR loop in file "3Yb11Xt.exe" at offset 9414; code bytes = 30d0 Found XOR loop in file "3Yb11Xt.exe" at offset 10184; code bytes = 30d0 Found XOR loop in file "3Yb11Xt.exe" at offset 10304; code bytes = 30d0 Found XOR loop in file "3Yb11Xt.exe" at offset 217147; code bytes = 30d0 Found XOR loop in file "3Yb11Xt.exe" at offset 344121; code bytes = 30d0 Found XOR loop in file "3Yb11Xt.exe" at offset 344383; code bytes = 30d0 Found XOR loop in file "3Yb11Xt.exe" at offset 345319; code bytes = 30d0 Found XOR loop in file "3Yb11Xt.exe" at offset 3026; code bytes = 33c1 Found XOR loop in file "3Yb11Xt.exe" at offset 3131; code bytes = 33c1 Found XOR loop in file "3Yb11Xt.exe" at offset 7390; code bytes = 33c1 Found XOR loop in file "3Yb11Xt.exe" at offset 10954; code bytes = 33c1 Found XOR loop in file "3Yb11Xt.exe" at offset 146; code bytes = 8030 Found XOR loop in file "3Yb11Xt.exe" at offset 178; code bytes = 8030 Found XOR loop in file "3Yb11Xt.exe" at offset 200264; code bytes = 8030 Found XOR loop in file "3Yb11Xt.exe" at offset 221418; code bytes = 8030 Found XOR loop in file "3Yb11Xt.exe" at offset 221432; code bytes = 8030 Found XOR loop in file "3Yb11Xt.exe" at offset 345300; code bytes = 8030 Found XOR loop in file "3Yb11Xt.exe" at offset 347076; code bytes = 8030 Found XOR loop in file "3Yb11Xt.exe" at offset 350341; code bytes = 8030 Found XOR loop in file "3Yb11Xt.exe" at offset 353006; code bytes = 8030 Found XOR loop in file "3Yb11Xt.exe" at offset 353253; code bytes = 8030 Found XOR loop in file "2Ig6509.exe" at offset 8228; code bytes = 30d0 Found XOR loop in file "2Ig6509.exe" at offset 8493; code bytes = 30d0 Found XOR loop in file "2Ig6509.exe" at offset 8511; code bytes = 30d0 Found XOR loop in file "2Ig6509.exe" at offset 8541; code bytes = 30d0 Found XOR loop in file "2Ig6509.exe" at offset 8588; code bytes = 30d0 Found XOR loop in file "2Ig6509.exe" at offset 8606; code bytes = 30d0 Found XOR loop in file "2Ig6509.exe" at offset 8629; code bytes = 30d0 Found XOR loop in file "2Ig6509.exe" at offset 8663; code bytes = 30d0 Found XOR loop in file "2Ig6509.exe" at offset 8756; code bytes = 30d0 Found XOR loop in file "2Ig6509.exe" at offset 8805; code bytes = 30d0 Found XOR loop in file "2Ig6509.exe" at offset 9414; code bytes = 30d0 Found XOR loop in file "2Ig6509.exe" at offset 10184; code bytes = 30d0 Found XOR loop in file "2Ig6509.exe" at offset 10304; code bytes = 30d0 Found XOR loop in file "2Ig6509.exe" at offset 304185; code bytes = 30d0 Found XOR loop in file "2Ig6509.exe" at offset 304447; code bytes = 30d0 Found XOR loop in file "2Ig6509.exe" at offset 305383; code bytes = 30d0 Found XOR loop in file "2Ig6509.exe" at offset 3026; code bytes = 33c1 Found XOR loop in file "2Ig6509.exe" at offset 3131; code bytes = 33c1 Found XOR loop in file "2Ig6509.exe" at offset 7390; code bytes = 33c1 Found XOR loop in file "2Ig6509.exe" at offset 10954; code bytes = 33c1 Found XOR loop in file "2Ig6509.exe" at offset 146; code bytes = 8030 Found XOR loop in file "2Ig6509.exe" at offset 178; code bytes = 8030 Found XOR loop in file "2Ig6509.exe" at offset 240557; code bytes = 8030 Found XOR loop in file "2Ig6509.exe" at offset 305364; code bytes = 8030 Found XOR loop in file "2Ig6509.exe" at offset 307140; code bytes = 8030 Found XOR loop in file "2Ig6509.exe" at offset 310405; code bytes = 8030 Found XOR loop in file "2Ig6509.exe" at offset 313070; code bytes = 8030 Found XOR loop in file "2Ig6509.exe" at offset 313317; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6AA5D09F.bin" at offset 76665; code bytes = 30d0 Found XOR loop in file "DISMHOST.EXE.6AA5D09F.bin" at offset 77648; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6AA5D09F.bin" at offset 77788; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6AA5D09F.bin" at offset 78978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 225542; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 251836; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 300832; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 323232; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 345015; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 525813; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 548117; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 621730; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 639284; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 682748; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 686931; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 794906; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 798202; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 800708; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 815328; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 828634; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 26031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 212763; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 284797; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 339331; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 387586; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 395630; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 438093; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 534153; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 534608; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 599786; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 659636; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 820746; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 874034; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 903618; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 938425; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 90891; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 102399; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 103104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 180716; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 201762; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229561; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 278296; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 281039; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 286764; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 294175; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 294324; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 476932; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 706417; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 710657; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 886879; code bytes = 80302d:T425,file/memory contains long string with (Indicator: "youtube.com"; File: "supported_browsers_1_.htm") file/memory contains long string with (Indicator: "youtube.com"; File: "DFAFXI4B.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "APG3OZTF.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "6IQVSJZS.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "BY64ZDQZ.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "SPR550F0.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "7MLNHV8Z.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube.com"; File: "GKQTXF8P.txt") Found string "accounts.youtube.com" (Indicator: "youtube.com"; File: "PCAP") Found string "www.paypal.com" (Indicator: "paypal.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube.com"; File: "PCAP") file/memory contains long string with (Indicator: "youtube.com"; File: "SSL")2e:T5b4,file/memory contains long string with (Indicator: "GetCommandLine"; File: "2Ig6509.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "DISMHOST.EXE.6AA5D09F.bin") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "00002828.00000B0C.6463142.00424000.wprm") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00002828.00000B0C.6463142.00424000.wprm") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "00000640.00000280.5835460.00402000.wprm") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00001384.00000000.75303.00CFD000.00000004.mdmp, 00000000-00001384.00000001.75360.00CFD000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001384.00000001.75360.00CF5000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001384.00000001.75360.00CF5000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003112.00000000.82956.00BB1000.00000020.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003840.00000001.74971.013C5000.00000002.mdmp, 00000000-00003840.00000001.74971.013CD000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003840.00000001.74971.013C5000.00000002.mdmp, 00000000-00003840.00000001.74971.013CD000.00000004.mdmp")2f:T3442,"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005688) "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005688) "VV6sP45.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005656) "1cA05zG2.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005948) "1cA05zG2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005948) "1cA05zG2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000003000000a4e0cb02b0e0cb0278e2cb0292e066718a573406fefffffff8e1cb0216bc6571f4c7752e030000002ce1cb02f8e1cb0220bc65710600000000008c68010000002fbc65712a00000006000000f4c7752e03000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005948) "1cA05zG2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000034e2cb02000000007600000084e2cb02feffffff0ce2cb02cf001a77d6001a772226fb75760000003b00000084e2cb0200000000e0e1cb020000000048e2cb0295e1157736c22900feffffffd6001a772f7b0d750100000059005806167b0d75409fac75 (UID: 00000000-00005948) "1cA05zG2.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005948) "1cA05zG2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000034e2d00240e2d00208e4d00292e066718a573406feffffff88e3d00216bc6571d4b26b0805000000bce2d00288e3d00220bc65718205000000008c68010000002fbc65712a00000082050000d4b26b0805000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005948) "1cA05zG2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000003000000b4e0cb03c0e0cb0388e2cb0392e066718a573406feffffff08e2cb0316bc6571d0c7fe76060000003ce1cb0308e2cb0320bc65718205000000008c68010000002fbc65712a00000082050000d0c7fe7606000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005948) "1cA05zG2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000054e4d30260e4d30228e6d30292e066718a573406feffffffa8e5d30216bc6571fe089ee907000000dce4d302a8e5d30220bc65718205000000008c68010000002fbc65712a00000082050000fe089ee907000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005948) "1cA05zG2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000084dfcd0390dfcd0358e1cd0392e066718a573406feffffffd8e0cd0316bc65719ae62285090000000ce0cd03d8e0cd0320bc65718205000000008c68010000002fbc65712a000000820500009ae6228509000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005948) "1cA05zG2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000003000000d4e2be02e0e2be02a8e4be0292e066718a573406feffffff28e4be0216bc65717a9da5530b0000005ce3be0228e4be0220bc65718205000000008c68010000002fbc65712a000000820500007a9da5530b000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005948) "1cA05zG2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000003000000b4e1d803c0e1d80388e3d80392e066718a573406feffffff08e3d80316bc65716a5a23ea0c0000003ce2d80308e3d80320bc65718205000000008c68010000002fbc65712a000000820500006a5a23ea0c000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005948) "1cA05zG2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000003000000d4dcc902e0dcc902a8dec90292e066718a573406feffffff28dec90216bc657186970d630e0000005cddc90228dec90220bc65718205000000008c68010000002fbc65712a0000008205000086970d630e000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005948) "1cA05zG2.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000003000000b4e1dd03c0e1dd0388e3dd0392e066718a573406feffffff08e3dd0316bc6571408c4313100000003ce2dd0308e3dd0320bc65718205000000008c68010000002fbc65712a00000082050000408c431310000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005948) "2Ig6509.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003840) "2Ig6509.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003840) "3Yb11Xt.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001384) "3Yb11Xt.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001384) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000640)30:T468,"1cA05zG2.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005948) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000640) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000000000000000000000000000000000000000000b2f41977449b27770ceb170000007d7100007d710000000000000000f0000000f0007d710000000078ea1700000000000cec17000000000001000000dcea170040f519770000000000000000c8ea1700 (UID: 00000000-00000640)31:T4f5,"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "VV6sP45.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "VV6sP45.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1cA05zG2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1cA05zG2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "2Ig6509.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2Ig6509.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "3Yb11Xt.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3Yb11Xt.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")32:T655,Found reference to API "GetWindowText" (Indicator: "GetWindowText"; File: "00000640.00000280.5835460.00402000.wprm") Found reference to API "FindWindow" (Indicator: "FindWindow"; File: "00000640.00000280.5835460.00402000.wprm") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00001384.00000000.75303.00CFD000.00000004.mdmp, 00000000-00001384.00000001.75360.00CFD000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "FindWindow"; Source: "00000000-00001384.00000000.75303.00CFD000.00000004.mdmp, 00000000-00001384.00000001.75360.00CFD000.00000004.mdmp")33:T4b7,"AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00000640-0000010C-595953 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00000640-0000010C-2546146 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00000640-0000010C-2550929 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00000640-0000010C-3155154 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00000640-0000010C-3159349 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000640-0000010C-350098134:T2bf6,"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005688) "VV6sP45.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005656) "1cA05zG2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter %TEMP%\IXP001.TMP\1cA05zG2.exe (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00005948) "1cA05zG2.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00005948) "2Ig6509.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003840) "3Yb11Xt.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001384) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00000640) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00000640)35:T853d,"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005688) "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005688) "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005688) "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005688) "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005688) "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005688) "VV6sP45.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005656) "VV6sP45.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005656) "1cA05zG2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter SendMessageTimeoutW (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00005948) "1cA05zG2.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005948) "2Ig6509.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003840) "2Ig6509.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003840) "2Ig6509.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003840) "2Ig6509.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003840) "2Ig6509.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003840) "3Yb11Xt.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001384) "3Yb11Xt.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001384) "3Yb11Xt.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001384) "3Yb11Xt.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001384) "3Yb11Xt.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001384) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00000640) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00000640)36:T542,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "00002828.00000B0C.6463142.00424000.wprm") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00002828.00000B0C.6463142.00424000.wprm") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001384.00000001.75360.00CF5000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001384.00000001.75360.00CF5000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003112.00000000.82956.00BB1000.00000020.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00003112.00000000.82956.00BB1000.00000020.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003840.00000001.74971.013C5000.00000002.mdmp, 00000000-00003840.00000001.74971.013CD000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003840.00000001.74971.013C5000.00000002.mdmp, 00000000-00003840.00000001.74971.013CD000.00000004.mdmp")37:T77a,Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\UpdatingNewTabPageData" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1634_IESQMMUTEX_0_519" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_5684" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1634_IE_EarlyTabStart_0x1664_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1634_ConnHashTable<5684>_HashTable_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1634_IESQMMUTEX_0_303" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1634_IESQMMUTEX_0_331" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\MSIMGSIZECacheMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1634_IESQMMUTEX_0_274"38:T89a,"1cA05zG2.exe" failed to load missing module "api-ms-win-core-sysinfo-l1-2-1" - [base:0; Status:c0000135] "1cA05zG2.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "1cA05zG2.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "2Ig6509.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "3Yb11Xt.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135]39:T7ab,Found string "paypalcomsignin" (Indicator: "paypal"; File: "screen_3.png") file/memory contains long string with (Indicator: "youtube"; File: "DFAFXI4B.txt") file/memory contains long string with (Indicator: "youtube"; File: "APG3OZTF.txt") file/memory contains long string with (Indicator: "youtube"; File: "6IQVSJZS.txt") file/memory contains long string with (Indicator: "youtube"; File: "BY64ZDQZ.txt") file/memory contains long string with (Indicator: "youtube"; File: "SPR550F0.txt") file/memory contains long string with (Indicator: "youtube"; File: "7MLNHV8Z.txt") Found string "0pfh1LzGnl9xsZ2KA..BqpazX..AAA.0.0.BqpazX.AWe-8ZEjvOtese7m-CpXBJGI6DYfacebook.com/921732915060483129591236502846993127780716ylaqVqgNeVgmobDF7T1FYHfacebook.com/921754099289631358274365044070031277807" (Indicator: "facebook.com"; File: "OE1YVOS8.txt") Found string "0pfh1LzGnl9xsZ2KA..BqpazX..AAA.0.0.BqpazX.AWe-8ZEjvOtese7m-CpXBJGI6DYfacebook.com/9217329150604831295912365028469931277807" (Indicator: "facebook.com"; File: "2V1EGRWW.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "GKQTXF8P.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "twitter.com" (Indicator: "twitter"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.paypal.com" (Indicator: "paypal"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive" (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "youtube"; File: "SSL")3a:T694,"REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00001384.00000001.75360.000B0000.00000004.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003112.00000000.82956.00BB1000.00000020.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005656.00000001.74768.003C1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005688.00000000.72764.00841000.00000020.mdmp "Software\Microsoft\Windows " in Source: 00000000-00005688.00000001.74689.003D0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00005688.00000001.74689.003D0000.00000004.mdmp "7-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00005688.00000002.75367.003D0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{871c5380-42a0-1069-a2ea-08002b30309d}\InProcServer32" in Source: 00000000-00005948.00000000.72882.007F0000.00000004.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00005948.00000001.74540.001AC000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005948.00000001.74540.001AC000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00005948.00000001.74540.001AC000.00000002.mdmp3b:T4a29,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.cn" Response ==> HTTP/1.1 200 OK Server: Tengine Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Date: Sat 12 Sep 2026 19:36:30 GMT Cache-Control: max-age=7200 X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-DC-POP: dub-003 Via: ens-cache24.l2us5[187 186 200-0 M] ens-cache11.l2us5[187 0] ens-cache10.us37[0 0 200-0 H] ens-cache10.us37[1 0] Age: 793 Ali-Swift-Global-Savetime: 1789241790 X-Cache: HIT TCP_MEM_HIT dirn:-2:-2 X-Swift-SaveTime: Sat 12 Sep 2026 19:36:30 GMT X-Swift-CacheTime: 3600 Timing-Allow-Origin: * EagleId: 9b66829e17892425835336020e with response body ==>30C28201C3930A0100C2A0C28201C38C30C28201C38806092B060105050730010104C28201C2B930C28201C2B530C281C29EC2A2160414C2B13EC3836903C3B8....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/sytroprc:52:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=sytroprc:52:0 Report-To: {"group":"sytroprc:52:0" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/sytroprc:52:0"}] } Server: scaffolding on HTTPServer2 Content-Length: 1446 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 12 Sep 2026 17:31:12 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 8314 with response body ==>30C28205C2A20A0100C2A0C28205C29B30C28205C29706092B060105050730010104C28205C28830C28205C28430C281C29EC2A2160414C3BCC2B709C3AA4D79....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Cache-Control: max-age = 14400 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/sytroprc:52:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=sytroprc:52:0 Report-To: {"group":"sytroprc:52:0" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/sytroprc:52:0"}] } Server: scaffolding on HTTPServer2 Content-Length: 1446 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 12 Sep 2026 17:31:12 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 8315 with response body ==>30C28205C2A20A0100C2A0C28205C29B30C28205C29706092B060105050730010104C28205C28830C28205C28430C281C29EC2A2160414C3BCC2B709C3AA4D79....... "GET /r/r1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 993 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat 12 Sep 2026 19:04:03 GMT Expires: Sat 12 Sep 2026 19:54:03 GMT Cache-Control: public max-age=3000 Age: 2744 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C28203C39D30C28201C385020101300D06092AC28648C286C3B70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C....... "GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 61128 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat 12 Sep 2026 19:15:37 GMT Expires: Sat 12 Sep 2026 20:05:37 GMT Cache-Control: public max-age=3000 Last-Modified: Sat 12 Sep 2026 17:01:09 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 2050 with response body ==>30C282C3AEC38430C282C3ADC2AC020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F....... "GET /r/r1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Sat 12 Sep 2026 19:04:03 GMT Expires: Sat 12 Sep 2026 19:54:03 GMT Age: 2744 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 62082 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat 12 Sep 2026 19:19:27 GMT Expires: Sat 12 Sep 2026 20:09:27 GMT Cache-Control: public max-age=3000 Age: 1821 Last-Modified: Sat 12 Sep 2026 15:48:52 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282C3B27E30C282C3B166020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F676C....... "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 59609 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat 12 Sep 2026 19:24:41 GMT Expires: Sat 12 Sep 2026 20:14:41 GMT Cache-Control: public max-age=3000 Last-Modified: Sat 12 Sep 2026 18:44:32 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 1509 with response body ==>30C282C3A8C39530C282C3A7C2BD020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F....... "GET /r/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1871 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat 12 Sep 2026 19:05:51 GMT Expires: Sat 12 Sep 2026 19:55:51 GMT Cache-Control: public max-age=3000 Age: 2646 Last-Modified: Mon 31 Aug 2026 08:08:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282074B30C2820633020101300D06092AC28648C286C3B70D01010B05003057310B300906035504061302424531193017060355040A1310476C6F62616C53....... "GET /we1/pl4XiTjSDSk.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 455 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat 12 Sep 2026 19:47:06 GMT Expires: Sat 12 Sep 2026 20:37:06 GMT Cache-Control: public max-age=3000 Last-Modified: Sat 12 Sep 2026 17:29:39 GMT Content-Type: application/pkix-crl Age: 171 with response body ==>30C28201C38330C2820168020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C6520547275....... "GET /r/r4.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 528 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat 12 Sep 2026 19:46:17 GMT Expires: Sat 12 Sep 2026 20:36:17 GMT Cache-Control: public max-age=3000 Age: 220 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282020C30C28201C293020101300A06082AC28648C38E3D0403033047310B300906035504061302555331223020060355040A1319476F6F676C6520547275....... "GET /we1/x6Eg-8TSwUw.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 309 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat 12 Sep 2026 19:43:41 GMT Expires: Sat 12 Sep 2026 20:33:41 GMT Cache-Control: public max-age=3000 Age: 376 Last-Modified: Sat 12 Sep 2026 17:22:59 GMT Content-Type: application/pkix-crl with response body ==>30C282013130C281C398020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C652054727573....... "GET /we1/G0k-BqpOX8k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 347 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat 12 Sep 2026 19:31:07 GMT Expires: Sat 12 Sep 2026 20:21:07 GMT Cache-Control: public max-age=3000 Age: 1130 Last-Modified: Sat 12 Sep 2026 16:13:49 GMT Content-Type: application/pkix-crl with response body ==>30C282015730C281C3BE020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C652054727573....... "GET /rootg2.cer HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crt.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 1145 Connection: keep-alive Last-Modified: Fri 11 Sep 2026 01:18:20 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: Lv9t7Qwuz1t60a5irHqs9RMrlIG0r7Xw Accept-Ranges: bytes Server: AmazonS3 Date: Sat 12 Sep 2026 18:17:30 GMT ETag: "c6150925cfea5941ddc7ff2a0a506692" X-Cache: Hit from cloudfront Via: 1.1 4b70da48eda82f2df6875ba8bf8f89ba.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P5 X-Amz-Cf-Id: lkO4w3vRVHrZePzRYuSkBP16GEyfdHZxgvPj-mgrUIU0jRxppZNDog== Age: 5549 with response body ==>30C282047530C282035DC2A003020102020900C2A70E4A4C34C282C2B77F300D06092AC28648C286C3B70D01010B05003068310B300906035504061302555331....... "GET /rootg2.cer HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crt.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 1145 Connection: keep-alive Last-Modified: Fri 11 Sep 2026 01:18:20 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: Lv9t7Qwuz1t60a5irHqs9RMrlIG0r7Xw Accept-Ranges: bytes Server: AmazonS3 Date: Sat 12 Sep 2026 18:17:30 GMT ETag: "c6150925cfea5941ddc7ff2a0a506692" X-Cache: Hit from cloudfront Via: 1.1 f5c697bd298aa5fde836b2908d51005c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P5 X-Amz-Cf-Id: eTAaRIGsBQb75q1Rc2-01S50YDdMW5XgcO1JhufH7E1UepvU4Yj1-Q== Age: 5549 with response body ==>30C282047530C282035DC2A003020102020900C2A70E4A4C34C282C2B77F300D06092AC28648C286C3B70D01010B05003068310B300906035504061302555331....... "GET /we2/yK5nPhtHKQs.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 48424 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat 12 Sep 2026 19:02:18 GMT Expires: Sat 12 Sep 2026 19:52:18 GMT Cache-Control: public max-age=3000 Age: 2866 Last-Modified: Sat 12 Sep 2026 15:02:50 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282C2BD2430C282C2BCC38A020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C652054....... "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 62951 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat 12 Sep 2026 19:20:13 GMT Expires: Sat 12 Sep 2026 20:10:13 GMT Cache-Control: public max-age=3000 Last-Modified: Sat 12 Sep 2026 19:09:17 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 1791 with response body ==>30C282C3B5C3A330C282C3B4C38B020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1560 Connection: keep-alive Date: Sat 12 Sep 2026 19:13:54 GMT x-amzn-RequestId: 0f605714-09f6-4218-89a8-fd97846e23a7 Last-Modified: Sat 12 Sep 2026 19:13:41 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Expires: Sat 19 Sep 2026 18:13:41 GMT ETag: c537e1fc7449390c69071af626df84b3a980eae7 X-Cache: Hit from cloudfront Via: 1.1 100ce1d37f67e6c59753cd4c9c473afc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P7 X-Amz-Cf-Id: 1gnkhe7WzUsIKycpunFlYh8clorQwPJzlJVtoI5sarTr658ooKPJMQ== Age: 2170 with response body ==>30C28206140A0100C2A0C282060D30C282060906092B060105050730010104C28205C3BA30C28205C3B630C281C3A1C2A1563054310B30090603550406130255....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1438 Connection: keep-alive Date: Sat 12 Sep 2026 19:21:16 GMT x-amzn-RequestId: 3d76381a-357d-4867-a793-5ce650273e29 Last-Modified: Sat 12 Sep 2026 19:20:35 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Expires: Sat 19 Sep 2026 18:20:35 GMT ETag: e208e8069c1e762b9369374d1bc63ef211026479 X-Cache: Hit from cloudfront Via: 1.1 909ec3586e2eba60d35c2f3468905558.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P7 X-Amz-Cf-Id: g4eF_3MSXRYuPB7Cc3Rdb1kcP38QII86GmERvzOTsi6lXN0MhwpLsQ== Age: 1729 with response body ==>30C28205C29A0A0100C2A0C28205C29330C28205C28F06092B060105050730010104C28205C28030C282057C30C281C394C2A1493047310B3009060355040613....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.r2m04.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Date: Sat 12 Sep 2026 19:38:00 GMT CF-RAY: a3a15ebb69979c11-IAD Cache-Control: max-age=7200 Accept-Ranges: bytes Last-Modified: Sat 12 Sep 2026 19:11:04 GMT cf-cache-status: HIT Server: cloudflare X-Cache: Hit from cloudfront Via: 1.1 7f901df87689f6a6f8ea2a5f3bff24ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P16 X-Amz-Cf-Id: iJW7uB8JJvET1ECf247-nQYOz3rUZ3dHe-Z7hf-c5tnlzWhs_K61QA== Age: 2341 with response body ==>30C28201C3930A0100C2A0C28201C38C30C28201C38806092B060105050730010104C28201C2B930C28201C2B530C281C29EC2A21604141F52C2926156C28254.......3c:T1e0c,"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b4f0000 "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 72060000 "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ef0000 "VV6sP45.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6b4c0000 "VV6sP45.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ef0000 "1cA05zG2.exe" loaded module "CRYPTBASE.DLL" at base 74f40000 "1cA05zG2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d90000 "1cA05zG2.exe" loaded module "KERNEL32.DLL" at base 772b0000 "1cA05zG2.exe" loaded module "DWMAPI.DLL" at base 73a00000 "1cA05zG2.exe" loaded module "COMCTL32.DLL" at base 73f40000 "1cA05zG2.exe" loaded module "UXTHEME.DLL" at base 73d90000 "1cA05zG2.exe" loaded module "IMM32.DLL" at base 75c20000 "1cA05zG2.exe" loaded module "COMCTL32" at base 73f40000 "1cA05zG2.exe" loaded module "SHELL32.DLL" at base 76340000 "1cA05zG2.exe" loaded module "OLE32.DLL" at base 76050000 "1cA05zG2.exe" loaded module "ADVAPI32.DLL" at base 75e50000 "1cA05zG2.exe" loaded module "PROPSYS.DLL" at base 73dd0000 "1cA05zG2.exe" loaded module "OLEAUT32.DLL" at base 762a0000 "1cA05zG2.exe" loaded module "APPHELP.DLL" at base 74ef0000 "1cA05zG2.exe" loaded module "CLBCATQ.DLL" at base 761b0000 "1cA05zG2.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 688c0000 "1cA05zG2.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75120000 "1cA05zG2.exe" loaded module "URLMON.DLL" at base 75470000 "1cA05zG2.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72b90000 "1cA05zG2.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73dd0000 "1cA05zG2.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 72ba0000 "1cA05zG2.exe" loaded module "IERTUTIL.DLL" at base 758c0000 "1cA05zG2.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76340000 "1cA05zG2.exe" loaded module "USER32.DLL" at base 753a0000 "1cA05zG2.exe" loaded module "SETUPAPI.DLL" at base 75c50000 "1cA05zG2.exe" loaded module "RPCRT4.DLL" at base 76ff0000 "1cA05zG2.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ef0000 "2Ig6509.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b4f0000 "2Ig6509.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ef0000 "3Yb11Xt.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ef0000 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 77290000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 76ff0000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 772b0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 61220000 "AppLaunch.exe" loaded module "OLE32.DLL" at base 76050000 "AppLaunch.exe" loaded module "CRYPTBASE.DLL" at base 74f40000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d90000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 72b10000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6a270000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 607c0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 69750000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 5f950000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 75e50000 "AppLaunch.exe" loaded module "UXTHEME.DLL" at base 73d90000 "AppLaunch.exe" loaded module "USER32.DLL" at base 753a0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 5f130000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 69ff0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 5e9b0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 716d0000 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 77140000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 76340000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75380000 "AppLaunch.exe" loaded module "PROFAPI.DLL" at base 75060000 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 74b60000 "AppLaunch.exe" loaded module "CRYPTSP.DLL" at base 74a50000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 747e0000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 75c20000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 717d0000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 75870000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 5e590000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 5d950000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5c560000 "AppLaunch.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 69c50000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 76f90000 "AppLaunch.exe" loaded module "DWRITE.DLL" at base 6ad50000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 750d0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 5c3d0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 5c2e0000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 744e0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5c000000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 5bcf0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 6b950000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 69d00000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6a870000 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 71a20000 "AppLaunch.exe" loaded module "WS2_32.DLL" at base 75be0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74a10000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74570000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74a00000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 5b5900003d:Ta16,"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1" was detected as "Microsoft Cabinet" and name: "sfx" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1" was detected as "Microsoft Visual C/C++" and name: "Compiler" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1" was detected as "Microsoft Cabinet File" and name: "Archive" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1" was detected as "Microsoft Linker" and name: "Linker" "1cA05zG2.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1cA05zG2.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1cA05zG2.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1cA05zG2.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1cA05zG2.exe" was detected as "Microsoft Linker" and name: "Linker" "VV6sP45.exe" was detected as "Microsoft Cabinet" and name: "sfx" "VV6sP45.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "VV6sP45.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VV6sP45.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "VV6sP45.exe" was detected as "Microsoft Linker" and name: "Linker" "3Yb11Xt.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3Yb11Xt.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3Yb11Xt.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3Yb11Xt.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3Yb11Xt.exe" was detected as "Microsoft Linker" and name: "Linker" "2Ig6509.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2Ig6509.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2Ig6509.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2Ig6509.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2Ig6509.exe" was detected as "Microsoft Linker" and name: "Linker" "DISMHOST.EXE.6AA5D09F.bin" was detected as "Microsoft Cabinet" and name: "sfx" "DISMHOST.EXE.6AA5D09F.bin" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "DISMHOST.EXE.6AA5D09F.bin" was detected as "Microsoft Visual C/C++" and name: "Compiler" "DISMHOST.EXE.6AA5D09F.bin" was detected as "Microsoft Cabinet File" and name: "Archive" "DISMHOST.EXE.6AA5D09F.bin" was detected as "Microsoft Linker" and name: "Linker"3e:Te91,"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "1cA05zG2.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "VV6sP45.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "3Yb11Xt.exe" file has an entrypoint instructions - "call 0x4028e2,jmp 0x4022a2,ret 0,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x4021ac,jmp 0x402431,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x41d00c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "2Ig6509.exe" file has an entrypoint instructions - "call 0x4028e2,jmp 0x4022a2,ret 0,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x4021ac,jmp 0x402431,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x41d00c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "DISMHOST.EXE.6AA5D09F.bin" file has an entrypoint instructions - "call 0x100a7e6,jmp 0x10097f4,int3 ,int3 ,int3 ,int3 ,int3 ,push 0x14,push 0x1010878,call 0x1009d10,and dword ptr [ebp - 4], 0,dec dword ptr [ebp + 0x10],js 0x1009afc,mov ecx, dword ptr [ebp + 8],sub ecx, dword ptr [ebp + 0xc],mov dword ptr [ebp + 8], ecx,call dword ptr [ebp + 0x14],jmp 0x1009abc,mov eax, dword ptr [ebp - 0x14],mov dword ptr [ebp - 0x1c], eax,mov eax, dword ptr [ebp - 0x1c],mov eax, dword ptr [eax],mov dword ptr [ebp - 0x20], eax,mov eax, dword ptr [ebp - 0x20],cmp dword ptr [eax], 0xe06d7363,je 0x1009af3,mov dword ptr [ebp - 0x24], 0,mov eax, dword ptr [ebp - 0x24],ret ,call dword ptr [0x1001210],mov esp, dword ptr [ebp - 0x18],"3f:T458,"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "VV6sP45.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "VV6sP45.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1cA05zG2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1cA05zG2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1cA05zG2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "2Ig6509.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2Ig6509.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "3Yb11Xt.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3Yb11Xt.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")40:Tdd0,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00005656.00001618.1232211.00050000.wprm] Observed system executable string:"C:\Windows\system32\kernel32.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\KERNELBASE.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\GDI32.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\USER32.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\LPK.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\USP10.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\msvcrt.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\ADVAPI32.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\RPCRT4.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\SYSTEM32\sechost.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\IMM32.DLL" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\SspiCli.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\SHLWAPI.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\ole32.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\OLEAUT32.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\USERENV.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\UxTheme.dll" [Source: 00000000-00003840.00000001.74971.000F0000.00000004.mdmp]41:T469,Spawned process "VV6sP45.exe" (UID: 00000000-00005656) Spawned process "1cA05zG2.exe" (UID: 00000000-00005948) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00005684) Spawned process "iexplore.exe" with commandline "SCODEF:5684 CREDAT:275457 /prefetch:2" (UID: 00000000-00005780) Spawned process "iexplore.exe" with commandline "SCODEF:5684 CREDAT:275465 /prefetch:2" (UID: 00000000-00005860) Spawned process "iexplore.exe" with commandline "SCODEF:5684 CREDAT:865287 /prefetch:2" (UID: 00000000-00000500) Spawned process "iexplore.exe" with commandline "SCODEF:5684 CREDAT:603160 /prefetch:2" (UID: 00000000-00002168) Spawned process "iexplore.exe" with commandline "SCODEF:5684 CREDAT:603179 /prefetch:2" (UID: 00000000-00003924) Spawned process "iexplore.exe" with commandline "SCODEF:5684 CREDAT:1848342 /prefetch:2" (UID: 00000000-00003208) Spawned process "2Ig6509.exe" (UID: 00000000-00003840) Spawned process "AppLaunch.exe" (UID: 00000000-00002828) Spawned process "3Yb11Xt.exe" (UID: 00000000-00001384) Spawned process "AppLaunch.exe" (UID: 00000000-00000640)42:T469,Spawned process "VV6sP45.exe" (UID: 00000000-00005656) Spawned process "1cA05zG2.exe" (UID: 00000000-00005948) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00005684) Spawned process "iexplore.exe" with commandline "SCODEF:5684 CREDAT:275457 /prefetch:2" (UID: 00000000-00005780) Spawned process "iexplore.exe" with commandline "SCODEF:5684 CREDAT:275465 /prefetch:2" (UID: 00000000-00005860) Spawned process "iexplore.exe" with commandline "SCODEF:5684 CREDAT:865287 /prefetch:2" (UID: 00000000-00000500) Spawned process "iexplore.exe" with commandline "SCODEF:5684 CREDAT:603160 /prefetch:2" (UID: 00000000-00002168) Spawned process "iexplore.exe" with commandline "SCODEF:5684 CREDAT:603179 /prefetch:2" (UID: 00000000-00003924) Spawned process "iexplore.exe" with commandline "SCODEF:5684 CREDAT:1848342 /prefetch:2" (UID: 00000000-00003208) Spawned process "2Ig6509.exe" (UID: 00000000-00003840) Spawned process "AppLaunch.exe" (UID: 00000000-00002828) Spawned process "3Yb11Xt.exe" (UID: 00000000-00001384) Spawned process "AppLaunch.exe" (UID: 00000000-00000640)43:Tb80,The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: FC:B8:DC:ED:6F:0B:18:09:F8:63:FD:24:B5:43:5B:82:24:12:8D:CE; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: BC:1F:B5:F8:04:0C:7B:4F:F4:4F:20:30:D3:BA:66:E6:AF:8E:8F:AF; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: DB:16:C1:37:8D:6C:67:F5:7B:69:A5:CC:5A:E4:14:86:68:68:28:08; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 2F:3E:B0:A8:44:32:59:B0:15:E4:8E:5A:B5:0C:9C:5C:04:8F:36:E4; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 36:C6:15:F5:21:0B:24:21:0E:72:00:85:DD:C6:59:8A:81:39:9C:5F; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 3C:F7:A3:68:2E:01:AD:2D:3C:81:BA:39:16:59:75:E3:82:26:E5:84; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 09:32:D2:81:2C:77:5A:F1:AB:CB:A3:81:1C:E4:DD:F9:2D:B6:BF:D2; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B7:40:25:17:EE:AA:C8:0A:B0:46:81:18:6E:82:47:BD:78:51:CD:0A; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 M04, O=Amazon, C=US" (SHA1: EE:C1:BD:4E:34:75:3D:C4:2D:EA:58:F4:C4:BE:80:F1:E7:A2:AE:4E; see report for more information)44:T2447,"1cA05zG2.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\1cA05zG2.exe]- [targetUID: 00000000-00005948] "VV6sP45.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\VV6sP45.exe]- [targetUID: 00000000-00005688] "3Yb11Xt.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\3Yb11Xt.exe]- [targetUID: 00000000-00001384] "2Ig6509.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\2Ig6509.exe]- [targetUID: 00000000-00005656] "index-BMC5_rMx_1_.js" has type "Unknown"- [targetUID: N/A] "fEet3vn392pm63XDkQrw2Sxgo-3469oiGGxG-roDaQsdT9DWDYPz6DhfgQe914iiBfONMKn3YhINqU49pVNahkCkvx2I9b7Pb8KWpaE_brMCJG_1_.css" has type "Unknown"- [targetUID: N/A] "identifier_1_.htm" has type "Unknown"- [targetUID: N/A] "login_1_.htm" has type "Unknown"- [targetUID: N/A] "api_1_.js" has type "Unknown"- [targetUID: N/A] "dism.log" has type "Unknown"- [targetUID: N/A] "928TN5UD.htm" has type "HTML document ASCII text with very long lines (56691) with CRLF line terminators"- [targetUID: N/A] "DISMHOST.EXE.6AA5D09F.bin" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A] "0839ECC4815B5D8D5ED699ED1C20C543" has type "Unknown"- [targetUID: N/A] "595CD0DCED5F6DE43A9C77C525C44511" has type "Unknown"- [targetUID: N/A] "75A092F4522006A97542D6AC4F4E69D2" has type "Unknown"- [targetUID: N/A] "9C69E496D546F49A980D7350EC49A180" has type "Unknown"- [targetUID: N/A] "dinosaur_1_.png" has type "Unknown"- [targetUID: N/A] "68317AD4F8681C59B8DA0296EF2FCDBA" has type "Unknown"- [targetUID: N/A] "imagestore.dat" has type "Unknown"- [targetUID: N/A] "KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWub2bVmUiAw_1_.woff" has type "Unknown"- [targetUID: N/A] "KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmUiAw_1_.woff" has type "Unknown"- [targetUID: N/A] "~DF5703404D29F844F2.TMP" has type "Unknown"- [targetUID: N/A] "~DF1A93C89540850C86.TMP" has type "Unknown"- [targetUID: N/A] "ay1hV6OlegS_1_.ico" has type "Unknown"- [targetUID: N/A] "main_1_.js" has type "Unknown"- [targetUID: N/A] "Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF_1_.woff" has type "Unknown"- [targetUID: N/A] "en-US.4" has type "Unknown"- [targetUID: N/A] "~DF02C79C5D01520C6E.TMP" has type "Unknown"- [targetUID: N/A] "~DFE64AC6AC7EED6BC0.TMP" has type "Unknown"- [targetUID: N/A] "~DFF2A623EDEC370D38.TMP" has type "Unknown"- [targetUID: N/A] "~DF43619695DE137C74.TMP" has type "Unknown"- [targetUID: N/A] "~DFB5FBCC66A95CE321.TMP" has type "Unknown"- [targetUID: N/A] "~DF755C1D413295EAF3.TMP" has type "Unknown"- [targetUID: N/A] "~DFAA71BF8AA3F6802C.TMP" has type "Unknown"- [targetUID: N/A] "~DFF5513BEEACD2F10C.TMP" has type "Unknown"- [targetUID: N/A] "~DFA5B86EE55B33D5DF.TMP" has type "Unknown"- [targetUID: N/A] "~DF818F0E5454ADF88F.TMP" has type "Unknown"- [targetUID: N/A] "firefox_1_.png" has type "Unknown"- [targetUID: N/A] "yt_logo_rgb_light_1_.png" has type "Unknown"- [targetUID: N/A] "httpErrorPagesScripts_1_" has type "Unknown"- [targetUID: N/A] "_14F1223B-AEE3-11F1-83DD-00505691B299_.dat" has type "Unknown"- [targetUID: N/A] "_14F1223D-AEE3-11F1-83DD-00505691B299_.dat" has type "Unknown"- [targetUID: N/A] "edgium_1_.png" has type "Unknown"- [targetUID: N/A] "login_2_.htm" has type "Unknown"- [targetUID: N/A] "RecoveryStore._14F12239-AEE3-11F1-83DD-00505691B299_.dat" has type "Unknown"- [targetUID: N/A] "chrome_1_.png" has type "Unknown"- [targetUID: N/A] "supported_browsers_1_.htm" has type "Unknown"- [targetUID: N/A] "epic-favicon-96x96_1_.png" has type "Unknown"- [targetUID: N/A] "_14F1223C-AEE3-11F1-83DD-00505691B299_.dat" has type "Unknown"- [targetUID: N/A] "favicon_2_.ico" has type "Unknown"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Unknown"- [targetUID: N/A] "_1B88D1DA-AEE3-11F1-83DD-00505691B299_.dat" has type "Unknown"- [targetUID: N/A] "_A3C2035E-AEE5-11F1-83DD-00505691B299_.dat" has type "Unknown"- [targetUID: N/A] "_1B88D1DE-AEE3-11F1-83DD-00505691B299_.dat" has type "Unknown"- [targetUID: N/A] "_14F1223E-AEE3-11F1-83DD-00505691B299_.dat" has type "Unknown"- [targetUID: N/A] "_A3C2035F-AEE5-11F1-83DD-00505691B299_.dat" has type "Unknown"- [targetUID: N/A] "_1B88D1DB-AEE3-11F1-83DD-00505691B299_.dat" has type "Unknown"- [targetUID: N/A] "_1B88D1DD-AEE3-11F1-83DD-00505691B299_.dat" has type "Unknown"- [targetUID: N/A] "_1B88D1DC-AEE3-11F1-83DD-00505691B299_.dat" has type "Unknown"- [targetUID: N/A] "errorPageStrings_1_" has type "Unknown"- [targetUID: N/A] "opera_1_.png" has type "Unknown"- [targetUID: N/A] "index-CfssTcG8_1_.css" has type "Unknown"- [targetUID: N/A] "8B2B9A00839EED1DFDCCC3BFC2F5DF12" has type "Unknown"- [targetUID: N/A] "dnserror_1_" has type "Unknown"- [targetUID: N/A] "B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D" has type "Unknown"- [targetUID: N/A] "B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92" has type "Unknown"- [targetUID: N/A] "BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894" has type "Unknown"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "Unknown"- [targetUID: N/A] "75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA" has type "Unknown"- [targetUID: N/A] "NewErrorPageTemplate_1_" has type "Unknown"- [targetUID: N/A] "CheckConnection_1_.htm" has type "Unknown"- [targetUID: N/A] "favicon_3_.ico" has type "Unknown"- [targetUID: N/A] "DABA17F5E36CBE65640DD2FE24F104E7" has type "Unknown"- [targetUID: N/A] "05DDC6AA91765AACACDB0A5F96DF8199" has type "Unknown"- [targetUID: N/A] "892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6" has type "Unknown"- [targetUID: N/A] "DFAFXI4B.txt" has type "Unknown"- [targetUID: N/A] "APG3OZTF.txt" has type "Unknown"- [targetUID: N/A] "58Z5QGHQ.txt" has type "Unknown"- [targetUID: N/A] "57SWH4ZC.txt" has type "Unknown"- [targetUID: N/A] "6IQVSJZS.txt" has type "Unknown"- [targetUID: N/A] "GK8C78OV.txt" has type "Unknown"- [targetUID: N/A] "BY64ZDQZ.txt" has type "Unknown"- [targetUID: N/A] "7FEI58P3.txt" has type "Unknown"- [targetUID: N/A] "TGQP50V4.txt" has type "Unknown"- [targetUID: N/A] "B46811C17859FFB409CF0E904A4AA8F8" has type "Unknown"- [targetUID: N/A] "SPR550F0.txt" has type "Unknown"- [targetUID: N/A] "7MLNHV8Z.txt" has type "Unknown"- [targetUID: N/A] "59D76868C250B3240414CE3EFBB12518_48DD617AFDB5114057A289197FEDE5C4" has type "Unknown"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" has type "Unknown"- [targetUID: N/A] "D1BEC81CCAFDC823A062FF26A89A6B6D_B9B4646227E0866A0D172EA2B644DB92" has type "Unknown"- [targetUID: N/A] "6CAFE3B721B7CE350C58A8F3EB28AA44_C4935EE08CAA8E5372EBE50CFA866626" has type "Unknown"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F" has type "Unknown"- [targetUID: N/A] "F28CC103A764A74B222272A7D2BDDA5C" has type "Unknown"- [targetUID: N/A] "I2QDQ3PF.txt" has type "Unknown"- [targetUID: N/A] "26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD" has type "Unknown"- [targetUID: N/A] "D3T9MFVY.txt" has type "Unknown"- [targetUID: N/A] "55D343B052AE566C8BF677731180E634" has type "Unknown"- [targetUID: N/A] "0F6O3RK7.txt" has type "Unknown"- [targetUID: N/A] "CC640368512A0520EF9FE4E00D0FE9C4" has type "Unknown"- [targetUID: N/A] "L8BOMPAW.txt" has type "Unknown"- [targetUID: N/A] "D347HUKE.txt" has type "Unknown"- [targetUID: N/A] "9JJNDPCE.txt" has type "Unknown"- [targetUID: N/A] "1JNAA4S9.txt" has type "Unknown"- [targetUID: N/A] "Q170CC2W.txt" has type "Unknown"- [targetUID: N/A] "MNDHW3FO.txt" has type "Unknown"- [targetUID: N/A] "NSX3AHV9.htm" has type "gzip compressed data original size modulo 2^32 365"- [targetUID: N/A] "8MFPSISD.txt" has type "Unknown"- [targetUID: N/A] "favicon_1_.htm" has type "Unknown"- [targetUID: N/A] "OE1YVOS8.txt" has type "Unknown"- [targetUID: N/A] "2DLC01SE.txt" has type "Unknown"- [targetUID: N/A] "8T3P6B9M.txt" has type "Unknown"- [targetUID: N/A] "2V1EGRWW.txt" has type "Unknown"- [targetUID: N/A] "5JPGQ2BA.txt" has type "Unknown"- [targetUID: N/A] "ACRP02X6.txt" has type "Unknown"- [targetUID: N/A] "E3NYGST6.txt" has type "Unknown"- [targetUID: N/A] "0RVCRXFZ.txt" has type "Unknown"- [targetUID: N/A] "GKQTXF8P.txt" has type "Unknown"- [targetUID: N/A] "Q0PS2J70.txt" has type "Unknown"- [targetUID: N/A] "www.epicgames_1_.xml" has type "Unknown"- [targetUID: N/A] "bscframe_1_.htm" has type "Unknown"- [targetUID: N/A] "b_lEtPAUPMI_1_.webp" has type "Unknown"- [targetUID: N/A] "dnserror_2_" has type "Unknown"- [targetUID: N/A] "NewErrorPageTemplate_2_" has type "Unknown"- [targetUID: N/A] "A49Z8HVX.htm" has type "gzip compressed data original size modulo 2^32 365"- [targetUID: N/A] "HIYD1A1Y.txt" has type "Unknown"- [targetUID: N/A] "SSVR71J6.txt" has type "Unknown"- [targetUID: N/A] "6E7VCAV9.txt" has type "Unknown"- [targetUID: N/A] "7JDBYOAQ.txt" has type "Unknown"- [targetUID: N/A]45:Tb94,"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")46:T10d8,"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CD732D10374E32F6FFB254FD765CB62B3BE65B7A394AB4ECA96FB37D5F7F83F1"; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "")47:Tc9a,"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe.Local\" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\Cabinet.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\VERSION.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\SspiCli.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\WINSPOOL.DRV" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\MPR.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\Windows\system32\MPR.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\UxTheme.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\WINMM.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\samcli.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\Windows\system32\samcli.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\MSACM32.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to touch file "C:\Windows\system32\MSACM32.dll"48:Td25,"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\Cabinet.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\VERSION.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\SspiCli.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\MPR.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\UxTheme.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\WINMM.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\samcli.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\MSACM32.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\sfc.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\sfc_os.DLL" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\dwmapi.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VV6sP45.exe" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\3Yb11Xt.exe" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\FLTLIB.DLL" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\MSVCP140.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\ucrtbase.DLL" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll"49:T877,"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe.Local\" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe.Config" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\CD732D10374E32F6FFB254FD765CB62B3BE65B7A394AB4ECA96FB37D5F7F83F1.EXE.LOCAL" "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe" trying to access non-existent file "C:\CD732D10374E32F6FFB254FD765CB62B3BE65B7A394AB4ECA96FB37D5F7F83F1.EXE.CONFIG" "VV6sP45.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VV6sP45.exe.Local\" "VV6sP45.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "VV6sP45.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VV6sP45.exe.Config" "VV6sP45.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "VV6sP45.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VV6SP45.EXE.LOCAL" "VV6sP45.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VV6SP45.EXE.CONFIG" "1cA05zG2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\1cA05zG2.exe.Local\" "1cA05zG2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "1cA05zG2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\1cA05zG2.exe.Config" "1cA05zG2.exe" trying to access non-existent file "C:\Windows\system32\UxTheme.dll.Config"4a:T5aa,Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /r/r1.crl" Found http requests in header "GET /wr2/oBFYYahzgVI.crl" Found http requests in header "GET /wr2/75r4ZyA3vA0.crl" Found http requests in header "GET /wr2/9UVbN0w5E6Y.crl" Found http requests in header "GET /r/gsr1.crl" Found http requests in header "GET /we1/pl4XiTjSDSk.crl" Found http requests in header "GET /r/r4.crl" Found http requests in header "GET /we1/x6Eg-8TSwUw.crl" Found http requests in header "GET /we1/G0k-BqpOX8k.crl" Found http requests in header "GET /rootg2.cer" Found http requests in header "GET /we2/yK5nPhtHKQs.crl" Found http requests in header "GET /wr2/oQ6nyr8F0m0.crl" Found http requests in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D" Found http requests in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D"4b:T26d6,Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:tCq39vx6Oa1cwXXfuQUDrGmeFdRUpQ:Y-ipFETvAp8GiuM7Connection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S1359381997:1789242587657247 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:tCq39vx6Oa1cwXXfuQUDrGmeFdRUpQ:Y-ipFETvAp8GiuM7"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:7exSwEqB67icLJrAhfj2-kfNu0CrXw:u7qYGaH3CvQkepvqConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S-1339270268:1789242588658479 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:7exSwEqB67icLJrAhfj2-kfNu0CrXw:u7qYGaH3CvQkepvq"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:tCq39vx6Oa1cwXXfuQUDrGmeFdRUpQ:Y-ipFETvAp8GiuM7"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:7exSwEqB67icLJrAhfj2-kfNu0CrXw:u7qYGaH3CvQkepvq"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:7exSwEqB67icLJrAhfj2-kfNu0CrXw:u7qYGaH3CvQkepvq"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v5/y-/l/0,cross/fEet3vn392pm63XDkQrw2Sxgo-3469oiGGxG-roDaQsdT9DWDYPz6DhfgQe914iiBfONMKn3YhINqU49pVNahkCkvx2I9b7Pb8KWpaE_brMCJG.css HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yH/r/uR_TIYVE0g0.eot HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yP/r/b_lEtPAUPMI.webp HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/y1/r/ay1hV6OlegS.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yP/r/kUc6oHI0fJd.woff HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yf/r/ipwqPKyH2FY.ttf HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /images/branding/googlelogo/2x/googlelogo_color_74x24dp.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: ssl.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=-164303525×tamp=1789242585117 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=1095322684×tamp=1789242586288 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com"; in File: "SSL") Found requests in header "GET /id/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.epicgames.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.epicgames.comDNT: 1Connection: Keep-AliveCookie: __cf_bm=Og02NW6yImDXTob_x2bNEGPAftyqntDK6w2UhLHMGac-1789242597.3177109-1.0.1.1-gBUnSU3CZ6AoPPH8hUg4KxpJdCS5GIFiDcsv9e.Lsc32GmRjIZQCB08.x2UVs3G61qFKSS4Gh2NG.ra.ENmlQIra1LeFORvvWbf169uNDfn3s98jnha6PW0K5fr96YMU"; in File: "SSL") Found requests in header "GET /cdn-cgi/challenge-platform/h/g/scripts/jsd/330e41bb475c/main.js? HTTP/1.1Accept: application/javascript, */*;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.epicgames.comDNT: 1Connection: Keep-AliveCookie: __cf_bm=TRB4x6YEU3uhy_NNVhcWgGfSP4MGNGU6i.lou5dPDbM-1789242598.3438437-1.0.1.1-fnu1OzpnoG0qIFaDWpPaiNOnd1mExZdbGDBFuiT6y0OxouhqmAiGCZT8353W8Nj8mNByP7D0GJwT7UUwUCn3gGNxY_0qe7Gk8OXXZdKhZjN301_JjD3Fu0SJjztJolSp"; in File: "SSL") Found requests in header "GET /account-portal/static/assets/index-BMC5_rMx.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.epicgames.com/id/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static-assets-prod.unrealengine.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /account-portal/static/assets/index-CfssTcG8.css HTTP/1.1Accept: text/css, */*Referer: https://www.epicgames.com/id/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static-assets-prod.unrealengine.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /account-portal/static/epic-favicon-96x96.png HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static-assets-prod.unrealengine.comDNT: 1Connection: Keep-AliveCookie: __cf_bm=jmYLLIU7q6PnKM4n8Xw2.G2FbkyxbOq9iPPo55atWUA-1789242597.9627042-1.0.1.1-sZQpoi37owcV7h2gQIG5lmWUohDK9ox1WpHIzkuzr.Ss0vQlqqODZfSg4bn2OCeEycQqPOIHlYe7vIxgVwtwVOit9kzd7AMEzXSCwCx4Nr5kHGAE1BCf88fXXA4454sW"; in File: "SSL")4c:T487,Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1")4d:T9bd,file/memory contains long string with (Indicator: " connect "; File: "dnserror_1_") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "gethostname" (Indicator: "gethostname"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00001384.00000000.75303.00D40000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00003840.00000000.74866.01400000.00000002.mdmp") Found reference to API "Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement." (Indicator: " accept "; Source: "00000000-00005656.00000000.72842.003CA000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00005656.00000000.72842.00E30000.00000002.mdmp, 00000000-00005656.00000001.74768.00E30000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00005688.00000000.72764.00930000.00000002.mdmp, 00000000-00005688.00000001.74689.00930000.00000002.mdmp") Found reference to API "Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement." (Indicator: " accept "; Source: "00000000-00005688.00000002.75367.0084A000.00000002.mdmp")4e:Ta147,"GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:tCq39vx6Oa1cwXXfuQUDrGmeFdRUpQ:Y-ipFETvAp8GiuM7Connection: Keep-AliveDNT: 1" "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S1359381997:1789242587657247 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:tCq39vx6Oa1cwXXfuQUDrGmeFdRUpQ:Y-ipFETvAp8GiuM7" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:7exSwEqB67icLJrAhfj2-kfNu0CrXw:u7qYGaH3CvQkepvq;Path=/;Expires=Mon, 11-Sep-2028 19:49:47 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-dfM1nuhkQNa6__1ls9osJQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Sat, 12 Sep 2026 19:49:47 GMTExpires: Sat, 12 Sep 2026 19:49:47 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Frame-Options: DENYVary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Sitex-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/x-ua-compatible: IE=edgeCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 12 Sep 2026 19:49:47 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsContent-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreportContent-Security-Policy: script-src 'nonce-Za5A1U1NFQPNpY3eVKYZPQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Resource-Policy: same-sitePermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*reporting-endpoints: default="/v3/signin/_/AccountsSignInUi/web-reports?context=eJwNx09IU3EAB_Cx_H0R8WBlaRNieHKB9jRYSl1KStb-uMfzOVvY888WDmTT7U1QoxTTg4V4KI3yFEGFWNShg5ESKDbCP-nEOSM9JPgvrEgp8tD38Dl80uYOnUozGRx5JsNY7qjxQvU34yUaSN80PqLu5RkxSPqTWdFDvTREDTWfRSMVmudFKTk8C8JN4ey4uEOW4rjIpwlLQnykX20JkdmeEKX7CVFGx5MrwkSx-BcxTQcdNhg6bdgos2OHbn-yo4v2Vu34S88WHEiBE6lkKXAin_YjvO7Edo8LuzT8wIVX9PJtOd5QyvdyvOhyY4SS9JUml9yIkWaWUU-TjTJi9LRPxnMKjcuI0I9jCn5TRraCTPppVbBHV84rcNF6rYJN-kMHdLROQRY1aRXQKXSzAm2HVdyiloCK7bsqdql5SkWUeqdVdL6vRDfdo34apMdUmeOBl0bue_CaHiY9GKKzJ6pwji4OV-Ey-f5dxajZizG6bvPizJoX8slrOJKeurI8sIiMjg_vtoy5p-tCzVrA5w_qAb31RjgU1P1BX21Ub4gGIv5wiz-sFUlFVqlEKi6QrFqT9B8xLsHb"Content-Encoding: gzipServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "��s��I~-W'~�/,f�Ɉ�M��,MH�_��㈦&2׉�=Z}쾣l��xp�1��*u��X@nD�Ng3'c�D��lM?��M;t��-��h�xB�\qT�9)'R�T6�2��?~�~�%c�EN�Z�"��h==�k��(�N�'ŗW�F;��a��a��g$`��Ϛt�Fm�R��`�E|��O9z�F"��Vr�o�O��?~t^X/�n,��Ɠ��pO�t�?��]��?֜I��«lq|D�χ9<��'��´��S��m��A)��>ou�_�TWp%��V��%�I�phڇx�?��~��S�ď�;<]�%��М�B�P��Q��\��ί��aM��e��jӖt�9�@��g�v��L"}�Бg��M/��I�~PO%V��x$�A��b�˟J�G�y0�X�*g��9��\�g��)��x&}3��p��}��T�7�NP2��r4��E�V=��¡@|��Y�I�h�<��D��5G�,)��-^�<��g�#�'�o�|�?�u�c�@�~��~M|x�-�1��?��~�� W�&��O�q?�L��J�U��F"��1Dm1`��p�|W�c��SQ�=7��wP��H�s<4�{9ڋ�F-��h��Ll�2�$pc�F.�H�E��\�WBH!��w ��.�'HY(��G7��_��(E�w�eYo��3x�@�R��YMD��4%6��t��ьs��å�A�v��\$�|��a;��v�l��Л@o��n΋N�X�/��pqP�7�֦��'�S��k�3�l��0Τ7�T�:�V��?�C� @<:��(?�$�0��'q�>�2-p�L��zB��}7>�%��!*�A�:Hؾ8�)�^�j]��%p��q\xC�]�[�=�)��n~vA�g�d(��W��}�3~oĕ}5;��?vݮ��֕GfN=E?��Omƿ��53�w��^~�/�J�똱��H�dr@�w<��4�h:tJg��`/h��6#��c�w3�$�a��쯎�� 6��ե�<��3�~�y��5��q7�W[�Â�6��O�R⼤��l��w��qg��+5�a�nfr��g1��d��WZ�6�z=�%u��U*>�ǽaq{��^:��8oO��", "0000000100000001�00000001000000110e8��s��5tE��N�8I�8��\m��A�HD\tE��X �"�x^_;v�ew�c��[��T[��i��k�3dkv~,��'�!��~��d��7:;��^Z�מ��m�6�V�3O�Y�uW��\`��8.Pl��69;[��˾�K�|�2g�&8?�s��|`��'��tN��8U�e!��ٗ3��Φ�7AW��Cpdq�kO��+��ݶ#��+Ij�9��󛛛��'��ßofo�_��d2��\L�.gW��Ğ��{>M擋3�\:�/�;��Ƴˍ(I��7��/�.^/�=^�Ϯ593�#�4�+��/S��p�m)�7Kx�}�<��,^O/�w��o�/�Vs!�<�T��6\Y՗��[;��l�&�m�n��LЖ��=R�S]��;�{��"��Rk컲�i�k��O��ӕ�BL�T�g��jq�"�Tj��}`��]Hs�'��]!��#+�+��dw��l�bH�^�L�+�P��B�K�/U��|��`$�3��||̷|(��HʍgN��`�L�/��#��܀?��؆��T>��x��̡a�DzxD8�ꑬ��Ϧnv��!��gK��)ʨ/��c��XA��FP��IR�tm�I}��槲��P`U��,�?�d=��_ƌ]�^��I,�4?�]t��b�(*��<"I�a�)�$D.b��xO��~�_�_��#��{��12�~54��`��z� ��u��2`-��?�QzZ}�ޘ��J��.e��j8�_��+�e�i��|��9LS��]l�}�xCC�Kp�V�|V�}O��r;0��W��{=��*�'ț��Q)��' �i`��O+VF�ŗ��ԡ%!b��:.��q.9�: (3�4�2�C�<��ZFm|l�n�Yztu-'��]��+�ӧ�o��c��(��h��p�&ӹ�h0!�TO4�7h��c��+��Ih��q��?��"|v��'�C��O�{�F��1��ҍ|d��J�R�$��S%u�|\:(~ɇ��CFQf�]��6�C��H"&��s�]�:�p=�z�`��>J�:=g�l]o?"�?;��m$u�y#�`,k�}�Nn77�[�aS_��d�zbr�ٔ]߆Zo��}�L��ђ�@h�{G@W��%Pv��n�=%d�#U�dh��].lw��1n��90��_�WP��3��3��[��C��B�� !oG��05le1�fS{�U 5(Մ#(�D�Z:t��P�م�X�I�HY��O��G�5��#��F�%�K׃sP.;L�|<��ќ��>o,��`A��(3�'W<5��ˏ˯CU��^~��d�u��P�=��A3�f�u��@*� u�V��r��\Z+��I��*]�4&x$��R��t��l�d�=��agV!��/?�0%Ш�`΋X�a"��/��e�&��Ͱ1�w�1�:�i��ҳU��/W��}��kz�n6�Q�`v;e-��b��j��*��3�,h��[jإ~4��f�1��N�Κ��@��#��P��QQ٢�ê��d��X��ΌsTs��ՠ��S2vu4�!U\4$�ƨiqi��Y�:B��1�h�Sthe��D��D� th��J�d��R3$�~(A6\q��#T\��q4)ޝE�DZ�*2E45�WmGV�~dի��e4�iB�J؃iA-q��sL��4>ɢ)A@��?4�q�0\M�^�_��b��d.J�stl�g��0}&-?Lw�Pp�qH��%��I�a��M�B}�A�))��q��2�dǁ* [~��o_��42uU5��tgc�h$��w��eAm�;_bL�N�R�4��Њ�|N��6MM�T�K7��lm��", "�v}�>��C�=;��b�~v�P��>�@X^>}6K7@E��ׂs��|[p�la��Uz��n�RZY�.[��kP0� ��6jRS#�$�+Y�3�%�-��8Fv�$;�F:��Գ��eּ�wx�� ׾ǘ�e5�RW>�+��wڅ>��6Bd�M��U��6��%�6A�|z�*�A.D�c�Ʌ�(Yo��(>4�sY��\�3��O� �AC��B~�B��,�vp}��=_I��V��n��-��A�i�\��&�ĵ�/w�Bo4��(xZʟ��f,Jx�2��8,�״$q�G*��X��F#�mClvy1��& �F�~��}�;|��ګ��{�ͼ�M�k6�b~��$;F��7nR�'3:��$��L�i��;ζy��W��=|�w��1j��ǝa��uDv_��n/5K��>��I��.��4�grs˯�VT4��Hm��x�q)�M��=?"�dY�\�д W��N��)�˰��;t$�h��07ؘ;k4G@Q��p��f��0��:=y�n1e:g�< u��rP��ٰ�b>�섖�Cy�K!�l��_#�Rچ��̭N��a�b��k�F��:g�6m�ɛW��h-x�6��,��C�|^��b�;��ۀ��&�0gPNb]�T�3��^��29�2�b��5]��C�P:У�Mu)d\*�%�ũDk��U��F�~%[.mȱ ��Y��5�ZR�u��p�Υ��#y��p/�k�@��0ȸ�q1D�b��:��M�y�}g$r]g�I�G:*i��i�"F��ςU��#N�ȇ�l�ʀ�^@�D��G�$�R��D7�~0Y�_x� �G`�.�aG9�+��&��A��3쀒sC�8^�4��_�^ls��Jir��r$�TWx��jRr�Y�fҥJQ&]"�˸�D~XVb�+!b��H�~$�V��^��ڎ�حc��J|�E��dگc�N��;�[�0�v��/� Ǵ� ?�<��$�a�4G{H9}<�~TD��r��/ڹ�2t��*�xɍƂ�jq��Q��8��i��Cfk��Ц�P+��>B� �GO��~�x�� G|�x?ս�J�G��㼨_��w�.;c��0��1&��-��eRVM��%�F��j^ӪP�NY�dlp�:b��C��X��n!�+�C4��ؘ��a6��z��Q�RR��T��", "00000001�00000001]00000001i00000001s00000001�00000001<0000000100000001�010de+��/ìI��ڭ�I !��p8cC��W��d�&y�ݚ�LaK�V��t�l&Tֶ.r�&��zag�4�7��|*��EL&"��)��S4��;�+E��D{e�R4Q�6I��e�p��0�Y��s.�e�-�S��L낖�sZ6�e��*�A[&�K��yrW��`�4/�Xg��7�j"G角nϊoӘ'�ʇ�5�'��x�4b��'x� ��Z��1��Ih3��2a��$��q+��l��x��p�ȓ$T�ǉ̥:Ħ��W|]<��c��L%�#�DY�$�@�=|9َG1+_`ʡ��ty�H�W�N1B��)��)9�s��K�8w�i%�؈2("6rW�1��J�R��*��L�>��io��ഷt�b�uv=6�U��&�g=�>��M{,_´��/k�ׁ�`N��љJ��J�,mPZ{9^��q��SV;�JA�T�p�CY3��@�0W==Y��A�BL��w)Kq��E|��">�ex��V��^O��Mz˳e�1��+��(�ې�EI�3�f|lk��v�o��+�l#�n�-z��Y5>�!�y��Xg��=��ΎG#��IbiK񃒏�Ұ��<�K��;�^�Ǔ��~*t6r�)0)M�QZ��_bGļVѵL��=Ͳ]c��"||]", "��&�w*Eh>I{��lNk�w�<�C�18�[�~M^ܓ��~��O�e4�f��ە�#Cџ7��^_;�?��>^��V�o|7�sG�:��;L��f�B��[��r��qc�N��3��$��t�t��#�M��|��/��jv��|/CɣO��e��)�4�ta��l��-g��9s�7Q��B%@��:��(��ާBȗB��7wnh�'�_4sU;�w��ۣ`f�oC4/�R$H㓐��@�g�qD��/�L�9��rH��Ak8��kd�.gv��v��)��-��V��V�H�r�U&�U�Bg�ϟ0�N��ZA�O�/w��w��B��Eh��m~��1cf'5uT0&}\��*tc=}��愅�if��='J3`�l�wn��À�cd��)�*^��r9硚W��.��`hYl��;�;K��&�ף��a��l;�H֨M�]wj��f��P�N�^�)��'��·��V\#��gp;��j��I�vw��46b#�lL��t��B�60��9<�qi�Y��aRo�z��O�bY�b*�?�G$��c��e�:�e��uTDt^h,��&&�5E��[*#�qP ��|7�_��g��u�)d(�ޑ��&:r��R�}��-��>�:��**�M�IHƩ�*��r��}�8��d�t�M�*ip}p��]|�8�s>X=�4f��j�v�j�n��LMq[�v��7�t��o�Cxd�[h��e��JzRhîq~Pgbl��F'�8��ݗ�6&�!�M��-)�o��N��u!�+G�v\k��$|�eysqbiq��p�ҝ�9��@�F��Dy�&pF8P�-P\��o��o/ˏN1� ��O��A�Cg׏�Aĥ�n��l��֦S��#�w)��Һ�&߁/rayܴ�@��rK^��=��[W��zA��7KfaeE�g@kri��2�cf�]�Q5��P�E��7�2�A��-�6k�f�̴;D��F?�FCc�X^=zjg�vi��9x��5�!��S��?y^��j^UNr��R�+�K:�f�;�v�10�L��~ki?��a��[q�X=�h$�M10�_=�4�F��Fo�*>s�4��6Jx(n!��Q�%B%J�x��k�ml��N��R�^��Lg�y� ��6��Ux6�3b��?��f�ܝ_��E78��؛�p˲��խ��>�٧�]�j�g)_*�^LQw�.Rx��QhZ��e7ߦ��l�X7~]|��", "�.�9��/AW�#��~R��s��>�)AH��q�i�g�xe�A�� 5h��/��9T�[�/�5wZ�=�G`��`��>\g}��x�x�w��d�e�'�� 0��f��[�?JC��Z��<��xkS��O�Lx�Ƿ��"�(Z��]��j�{�8}*��ֲ�f�ӫb�SQ9}ܐ�J�#V�p��B��h!/��,q��,��6�Tn�F_-Z�V�1Q&ˬ0�#�j��4W�%�lS\�(\`<��@��~>Ʀ�Ԋ�)�[��CV�j/��e�"Bʶ]v��Ѩ��t�t��V"��~�A�N*�4�A��>�%J�28��u=2z��͛��u�⩝�5k/m��#x�B*�1�NǺ��E7rN'Fk?3�/%��K~ȠpGO@�R<;w�&��u[�'�b�� 1D�`DP��o/f\|܎��܂\��o�@,햳�zT�AH偑��{��4m@ܱ5��aW~�}�~P��Z��{3{��xu��s�E��כ��O�=÷�f��J��@*Z.�@͜�O�|x!�a|'��7�j�gJ�=�I��k�/p��|��E�&�=��(��:P?m�|��l�̄��R+;��z�$q�A��y�\ή^�uW�x��$�1CZM��فnFMDRe��}�~'H�O��4�+��27�9�#��'.��B\�-��X_S)�/�'y^��:w��l�*��.ע�u��toW'��7��cl��>N:HL��(>Z%\B��q�ug�ʳǧ�^�S�&��\�ʹ[/��֠�1y��*��q9�Tx!�ϫ2�2�q�i*��5k�Rҡ�_�ȗ��Tnt��!v�C��\&g�T&�'4�I�H��E�P�'r��7��O�}T~��0�,)��M2��N.9z�%c\�J�ҙcD^b��W��_��tnY#չ��>�R�&r�%ެ9�iK��XR�5��uel��+�r�Uv�*܃��{Ɛ�nk`T�;��-��b��9Lm�JZ� ?�l��&M+g'�ne��m�V=�Sb)�]�� }�7�Ä=w��Y'~�?��O�@$�Jڳ�]��Jlv\��D4�c�E�~�g��S��C-��fY6:��5r'�L�Ͷ�$!(�i��0�1W��Q�n8��A��qt39�W磑�g:{\��6u��x(�O��̂�c�Y6C(ެ�\�1��>g�Su�i9��8O��ŀcra��H��Ư!�w��#cFdΐ*��2׀�%��DY�`JJ��7BA��ƪ��?��lJJ%��-�)�Oҹ��bm�� cC��P&��TQ+�(wX��UR�;K�ԊV/W?��$�ܪo�Í�<7̪ɢ>�e5�N'֭��V�,DD,�0�%{:�n4��v?2�®'3ߏ�[�\�k�)�h�GS/�}i��Y_]�+��|v�~��.ޯ��a�'M��塊�.�l��4��i&ų��6��h�WV�sg��h��]ő��|�U�*|/?Nu�ʑϬ��S��m'�&d>��P@0?1�G��AME��^��[W�H�a:��4��ɏ��vc�a�{M.~<��̡��bT��W��", "��a1I��>}<��pqW�(K�c��f��ݖ-�_��"Z�E_D�eh�'̍Gĝ��J1<>�O.�<�_��-_p {�ҍ(��{�W#)yo�T0w�}YR��t]}��eX�@�^?s��/�M&��3eNg��1�XR��%��I��6�� $�3��2R5s� "_��$��D@�'��&-%�^�p%�@��8�s$�d*MJCT�ր�Jb��قv�Fmѫ�{�4 F��Ü�dq��NkВ$�e��4%D��P��=SUWb��7Zܤ�KP�=)� :=�X5O��hzlP�HUdcQ"��^cJ�3�*��fkJN>�oEZ��-`�+��)��f+X� �E4]BM��ºT��tS��.B5*6�Vow�5O��V ��J{q�`j��V��4R�O��<�q�`��3�{яHK��3d��⼕��r��{��j(64t��b�n(N�ܷ��6o�5��!{k+Q5��*!0�v}u��>�xM�:�0��I�d�ր�2j�UEzM��C��?X�62)��=��@^8�r͡i勲2��3�;>�>-�a�D5n�I_��#ǲ��d~��+��0O#O6��$ۉ��Z�$��.��S�J}��D��Y6�Q�>+��n�i�"�e�ȧ�(�)rg)��Zu��r�t$�p2}��K&�#�k�f@+��Tz3�'�g��?;[�A8��Dx�W7� �[��(#��>�8Z�|f�K�*��(��z�l�D3K"ܳ�5��dgDC��WE��NgLC�Y�[Q��s��l]nȕZ�+��)��f�_d˪7�z�j�[�n��-d��Ă`�>�p�J9�B��x�(��[�|`c��1�@Ǟ��La$�RM)vFŮ�bo�:R�ǐ�M#Cryk�V�d�mM+�nyK�f�]l7�= �[�K�l�+�%3��C�:%:ຝOs�B�mp-Gm�?;ѓϹ��I&(T|KK�o�;��x��3dm��@�t��a�^�.��c�4�2/��P��=4D��AC$�s�D󚶂 G�tmo��٣��gۍ/T��O��cヸ B��U�0��*?]�);?��Ʃ��یO��h�5��!kK7C>�\E��>4݊l�o��C?)7��Q:�(V��BVl��i9YA�@4��aC�h��`��4�I��$I��X8i��7�7��QHO�Rט��)JL(�T7��놐��l��`:"�k+B�y��]�R�$�'��G��ʑ��9΢��w��i��j�f=�(ث�A��W�{j�=��S�j�m��0�x��{��6�F��&�'$�Ԑ��L��G1r6�&��s4k��O�c��t�{�'�'{>#]8�͢!�-��L��$�oB��ژ��5�RJmf��N};z��b$��c�{Q��ij�M�r�8c/��i�j�D{��ʄ��"�=�0��S�@�g{s��L�r:��V&o.�sfd)ђ�$jf�iʲ��g詘L��K[�-Q��q�!�{�)�� ـ[*_<��Ň��L�X3G�Qz�Y��}��O��3u��D�89)�� d��q\6rUO��\WI0�H�i%7��p|=0�K��Ơ7��$�*N.w;_�ش�5�i�ju�YΰVDau8��S��8��e�`\�]�ͨs�u�E��ׅ�`[�]��8�'!%�?�V&�Ȧ�:�pV9��U�z��5��O�9[�6��=�8�X|lz={��}<��)��h��(�"I"T�eYA��yA۳o��Kx=�'��ͤο�Η��k>��ǔy%ߐ҈��A�5�_��F�>2�ނ��R��B�2��[��qU7�U̖Ȕ��UVJM~"�t�g�D*�rm�'%�(�V��_�+m��ɏk��q��h¼:��z��#3^�7:��|�ny/4}d��Fǡ��{u��/�[T�X�=�kߖ�cL�>&�U(;`d�sL�K�og�+!_h��Mw��O�!�x�9��Y>�nQ�i�" "ݢ?��T�2��&%F��G�"W�kֻ��qt��Q�Ц�L��ͦ��L\kJQ1�*&��Z��J�k��J�hE��x֢E�B��!+��g��v�WW�V�6�x*+��", "00000001�00000001]0000000110000000100000001�0000000100000000100000001{0000171C��:#�Ā@L ��zh.�.ir��!�kGu{\b']JOZ��R%p�E:�J(xH��Fi�j(��,�]�PB��)d�d�,yo�D�}�ַ��\��'��J�=�y�Ⴠ88-��; |��AW='z��~�q�͌8�%��4z {��57'�A�y4�ͼ�D�&�RA��ɋ��ٶ��4��$��w�oD<��e.Ҁ��ʙ�o�Q�m}�>�K�<��ܬ�l��!�Vdk�I0��i�f+J�X]��7 �j�=lNӕ�hP��A��!�r�&�EZ(�U��j�Ҕ�ؠ/%�j��SYlS�5��T+��*��", "00000001�00000001]00000001m00000001s00000001�0000000180000000100000001�00000001+00000001�00000001�00000001�00000001d00000001�1�842��/wC{m�K/m�Izߌm.Sl2I��,��+J�|�0��j�h��-�:n�'��gے�*S�ל�#�E6��&�:��>y�-��h�L�˳H풑4={d²�r��t�'�3��1��c���9�ovF��xU��@w�{��Biٮ�Ry�̑��?�(>�+�W]�,0"Co��)cas3QH��)k�SD��4te�~��`�+��;��?"t�S�x2��Ә�yf��lp��3��?�߇T��[2�gfC�Q.��9�?��" "00000001�00000001�00000001O00000001�00000001S0001A46b�?��+�&�œ�E<Ȃ��(~y��D�l�NOwU��=��g&4�m��Ɠ�ƕc�Uj�HQ�]g�o�g�c��`�˲p��}�RU�7N[?q�r�ಟ/��7��޽��w��㭒�/��9�ξ��r��|&�w�|V��\��v��ˍ�*.��hm��<��uD:\�u�K˞�a�pbht�[��j��ue�u��zZ�0J��˧b�2AQ�/�(��4��u��W]0��U,��^�3�R�j`o�s�^^(H�]@12Тxbzz�~�tO#Z4Ab��f!��ĔO�D+�� 8`I��l�C#{�Yt��n#�B�}�0��S�戀,o��Bެ6�q��f`��0궐ew�=^�z�:/��.��3Bz�ݸ2��N��+:�aTq@�1�N�bw��݃��.�=�,0��@�=��(�/�g�(��nY�6?e��W�BA�U�b�&�Q�V��0��" ��&�Q6��]I�A�jʞl��F ��[��DF�� a��9`��IW��A� F�[Vt ¨2��$c� FE�+�v%a%�[*{�Y`<��i�g�`��T�l̕��] �n�ѭ��F�$ĺ-d��b�{�h2$W!��j�'�Q�y�1��E ��'�Q�>��]I�A�jڗʞl��F´�U��Wx��dD�� O�[�at��E{�v�"A��0q��qѹT3��I�:�Ĩz=Ê�UB#�d�Ĩ��ae�®$��d5�KeO6�G�~#�7h�y��r�C��<붐��@,�[� ٪��@� u�'�Q�}�$1��I ��'�Q�?��]I�A�j��ʞl��F ��[��Y��,��a�<�BA�U袌�E�0�U�gX�q�JȜ��YĨ+�v� (Y��ʞlo�7Y�ֽX�̈́�q�<�i ��q��ۑ��}��?.�͞`H��4#N�z��#��ח�SgO�BU�in�#��1a��/��" "00000001�00000001]00000001m00007a8s�8�+��L��PV+T4.�{��J��ZVIV{r�.5U�X��v}ݻ��X~^-N;GoEG�i'��P�@��U�}�$4�/~.[-N�n��'��(�U@2T�`ċ/*w0��okq�u#�zG��*$�R�ec^X��`�ˉ�c:�B`�J�2":a��*G�^��{۽��|�U��Y�8�7|��o{}��I��s�=�VX�u��C��T��#^��͇ž��Z��޷��yp�]��w��ki��#��{\r!�?�+�Ʌ��'"1nT�+�h\M��s#Lp?��"h� ,�u��f��+f� (��`��G�� 0(��|�2+ʱ 0(ۂ��2pXK.�|�:�J�5��7E7^(��B�� n�Pa��[a=B�Zzby�Npk(�-"��`։��+��^��[�|�}��X@�D�|�c��m�cYd��V;��M}o��T!ZNbR�.��) mn�`��wU�`��_/�ȸ�(uB��Dn��MS�-`m��I��y��1�̓�&�Z�sM/�W��Ol��2��ʖ:]e�'�t��#�Fl1��M�a��Yw|��}�^�l6.ѳ�9V<~nE2�3��}��>E��}�g��$2��=+�d9�Ug�"�J�>��P|c��tVq�邰�?J��o��ۿ��|mPI��.��CvW�ھ��{a��Ց��B�,��Ҭ��HJg'j�Ʉ5�G+�#�X,�X��b��ٻ6s�46o�%�}<:7/�܀M�\+��N|��x��>�`X~�1+��{��r��veC9��'�J�D�Q �6��.�R��ws��В��٣��be�wd�O��T��tN��0$�?�?%�9T�28��-��1Ub�U��91��.7�xՋ`$��al��I��J{�x�N��cO��c��(f�&wKJJnk�0*��;ٱ�g��h�T-NW��8t��ύ7;��", "-�h��B��_��B��F��1_WA��t,�f�u�>�D�|��q�'0{ݛ��h��'�r��<�,,R%��Z��C��8��D�]��ܪxR=�ٴ?��IΟ��8�6cr[U�^,(�!]�m��W��l��t��m<�6�\>?5W[��.ixM�xĕ�u�P��O��'��29��˛-��NR��)Wc�rRߗ)�&��", "00000001�00000001]00000001M00000001O00000001�00000001@0000000100000001�00000001;000000010161ac�bA�'�1�ب=�]HQ��Zß\��5�H��7y��N$��ۊ<��q�G��P��,��=Ym��2�&NU�l�u�L9��'��u3��Y�ש�E�zr�R��y�+{��x�*�o��ζ�'�_�i�u��f��ҏ��m{�Kf��񝛲�#6�Rx��w��P�;o�]�r�s�6�Ax}�Қc��J�Qx}��Rj��J�Qx}��;��z�ۍϳ�7f�p�CWit�CW��V=ZI�=��Z��?0��LKQEÅ�h茢h�4Q�W_�x��I��BQ4�JQ4\(��~)��R��Q��", "00000001�00000001]00000001�00000001o00000001�0000000160000000100000001�00000001W00000001�00000001�00000001K0000000100000001H00000001�00000001�00000001�00000001I00000001j00000001c00000001�a30V/^׼�&Y��#��:1�O%ْ(�OL6EW��x<ߴQ�\�>��+_fO=�%��]k��1��op��T8~L��8?&|��>�Ǐ�KF��06X�r��9�@u6��e�BՏ,W(�&��hL>��'d��p��K'M�슳��:h)�CMi�\��K�;aU�'�#�ê(O G��4�M��r��*��ê(O`�⛨Y9Rt��K�yN��9J�;��6��-@1q��(&[@6LP��a��8l��-@�D [�b��Z�b��Ѐ�d�3��m�E��l��]�\�-;��jl��μ@�\��LD��B��B�\�Yƫ�XNZ�/}�W��vK�� YW�� Y�b7�]��%��JL��!IK\9 �J�!IK��!IKr�!IK$ �Ee?�D��Q]i�O�6=��ct��?O�5{�$��,U�!��,��T�w�iØڍ�0��x/H�X�m�{ۨ��F=@��6��QZ��F��|��Y-��轖��ۣ�??��znض;�S�[��U7y��3*��+&Nۮ��Q�_~H\��=�n%f��[G�Яg��zb�cw��_�3תs�W��(h|��ex�:�6�f��r0&0D�V�!�ȍ��2�E�Bf��8�jw�A��zY_� Hw��KC-��W�-"�_4��E#7��HƐG��xW'�&8��@tP�Qv��1T�)O�3�!*ff��Ɨ��v�Z�̬*D��LA2�1��q�v�(6��C,3��8��)3��R��V�/��d��w}[�髉��N1��TJ��>��L��tt�q�r��1{��.H�>�LH�dR�� |��ᓝ�`�C��z48�quQ�?�z�p��ٷ�W�\�dU��t��NZ~�:;��6c6O��SG��l��1~ ��7#�hD��_˲�S�x��"��%"�|u��3��.G��a9LFPY�x9b-��?�@v�IŋCD��x"�e" "�S�7ͭ�R��㣵V)��׶��R(��'v�u�D�َYwK��cp4�Sh��O6��Y]�V��*JU��$��+e��&Zf76KL.GfT��y ��#��,]�W�}ن�*R��"4f:T2ae1,Pattern match: "https://accounts.google.com" Heuristic match: "ch-.kh" Heuristic match: "?a$.gp" Heuristic match: "is.nz" Pattern match: "http://www.imagemagick.orgtextthumb::document::pagestextthumb::image::heighttextthumb::image::widthtextthumb::mimetypeimage/png?textthumb::mtime1463602654textthumb::sizevtextthumb::urifile:///mntlog/favicons/2016-05-18/1a55d07c6ec007389dfa0cacbe041e86.ico." Pattern match: "https://developers.google.com/web/fundamentals/engage-and-retain/web-app-manifest/" Pattern match: "https://fonts.googleapis.com/css?family=youtube+sans:500" Pattern match: "https://static-assets-prod.unrealengine.com/account-portal/static/assets/inter-light-cdxm_abl.woff2" Pattern match: "o.ss2.us/0!http://x.ss2.us/x.cer0&http://s.ss2.us/r.crl0sn" Pattern match: "consentwp.2676bayoutube.com/102431383388163210825482504061830633367__secure-ynid21.yt=trnar6tkpw-vorh2x2fyv3dew0kde0ruqkjab1srxv7nnp4b4fkj-jg93ynvdynpuy71voxn9l9phjm3o0jmsr6a8p1-_ngmo28fcm2zwouo_pcddmdhszoj0szby7kdvhjq6y4uavtcdzxbmykexyzrud0jvfuvoryxy4kztc" Pattern match: "9216266519244831356262341735194331277810muid1612c898ddb5631d219bdf4adcef6282msn.com/1025266519244831356262341719594231277810web-user%7b%22userid%22%3a%22m-1612c898ddb5631d219bdf4adcef6282%22%2c%22cohorts%22%3a%5b%7b%22name%22%3a%22supercold%22%2c%22eversel" Pattern match: "muid1612c898ddb5631d219bdf4adcef6282msn.com/1025266519244831356262341719594231277810web-user%7b%22userid%22%3a%22m-1612c898ddb5631d219bdf4adcef6282%22%2c%22cohorts%22%3a%5b%7b%22name%22%3a%22supercold%22%2c%22everselected%22%3afalse%2c%22reason%22%3a%22mat" Pattern match: "7dmsn.com/921771548006431279216341719594231277810" Pattern match: "muid371055bcca8062b00d33426ecbf663c2microsoft.com/1025264519244831356262280546791831277810_edge_vmicrosoft.com/9216264519244831356262280562391831277810srchdaf=noformmicrosoft.com/102447862144031424860280562391831277810srchuidv=2&guid=d6b6dcac1b9a4617af36ed" Pattern match: "consentwp.2676bayoutube.com/102431383388163210825482504061830633367__secure-ynid21.yt=f58bucu9xjr0oxlbazzvyoev7qsuzr67gvey5bhadvviq94syew2hye7l_ajofvvqqsindr3waoarjhjdc15p8lnyq0m1hrngpdzm0wa1rwdfzygixzj5mi1g4ka5epdrxjuunilhrngdhcap-2axvpkng32be06ikprwtamvd" Pattern match: "http://c.pki.goog/we1/pl4xitjsdsk.crl" Pattern match: "http://c.pki.goog/we1/g0k-bqpox8k.crl&c-" Pattern match: "3a48zwww.msn.com/102449862144031424860341719594231277810muidb1612c898ddb5631d219bdf4adcef6282www.msn.com/9216266519244831356262341719594231277810" Pattern match: "http://c.pki.goog/we1/x6eg-8tswuw.crldb5=" Pattern match: ".g2fbkyxboq9ippo55atwua-1789242597.9627042-1.0.1.1-szqpoi37owcv7h2gqig5lmwuohdk9ox1wphizkuzr.ss0vqlqqodzfsg4bn2oceeycqqpoihlye7vixgvwtwvoit9kzd7amezxscwcx4nr5khgae1bcf88fxxa4454swunrealengine.com/214749286533956364831277812166962705831277810" Pattern match: "-1789242597.3177109-1.0.1.1-gbunsu3cz6aopph8hug4kxpjdcs5gifidcsv9e.lsc32gmrjizqcb08.x2uvs3g61qfkss4gh2ng.ra.enmlqira1leforvvwbf169undfn3s98jnha6pw0k5fr96ymuwww.epicgames.com/921733956364831277812166494705031277810" Pattern match: ".epicgames.com/921734956364831277812167321506431277810" Pattern match: ".epicgames.com/921734956364831277812167415106631277810" Pattern match: "muid371055bcca8062b00d33426ecbf663c2microsoft.com/1025264519244831356262280546791831277810_edge_vmicrosoft.com/9216264519244831356262280562391831277810srchdaf=noformmicrosoft.com/102447862144031424860280562391831277810" Pattern match: "https://www.google.com/favicon.ico" Pattern match: "0pfh1lzgnl9xsz2ka..bqpazx..aaa.0.0.bqpazx.awe-8zejvotese7m-cpxbjgi6dyfacebook.com/921732915060483129591236502846993127780716ylaqvqgnevgmobdf7t1fyhfacebook.com/921754099289631358274365044070031277807" Pattern match: "3a48zwww.msn.com/102449862144031424860341719594231277810" Pattern match: "muid371055bcca8062b00d33426ecbf663c2microsoft.com/1025264519244831356262280546791831277810_edge_vmicrosoft.com/9216264519244831356262280562391831277810" Pattern match: "0pfh1lzgnl9xsz2ka..bqpazx..aaa.0.0.bqpazx.awe-8zejvotese7m-cpxbjgi6dyfacebook.com/9217329150604831295912365028469931277807" Pattern match: "y-ipfetvap8gium7accounts.google.com/9217347201523231424658368678876431277807" Pattern match: "u7qygah3cvqkepvqaccounts.google.com/9217347201523231424658368912876831277807" Pattern match: "muidb371055bcca8062b00d33426ecbf663c2ieonline.microsoft.com/9216264519244831356262280562391831277810" Pattern match: "muid371055bcca8062b00d33426ecbf663c2microsoft.com/1025264519244831356262280546791831277810" Pattern match: "consentwp.2676bayoutube.com/102431383388163210825482504061830633367" Pattern match: "nactkwww.msn.com/spartan/108834324326431367516156339216030633261" Heuristic match: "ocsp.digicert.cn" Heuristic match: "get /mfewtzbnmeswstajbgurdgmcgguabbtfqhljklejqzpin0kczkdaqpvyowqust7daqp4v0cb1jgmgggc72nkk8mcea59dsncqddhv39mzstnbr0%3d http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/6.1host: ocsp.digicert.cn" Heuristic match: "crt.rootg2.amazontrust.com" Heuristic match: "get /rootg2.cer http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/6.1host: crt.rootg2.amazontrust.com" Heuristic match: "ocsp.rootg2.amazontrust.com" Heuristic match: "get /mfqwujbqme4wtdajbgurdgmcgguabbsifarexmfqfjr3tkmynd7o5mhzegqunf8a36ob1zaroiiiug1knpirkymcewz%2fleoqj83z%2bskukwh5co65xmy%3d http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/6.1host: ocsp.rootg2.amazontrust.com" Heuristic match: "ocsp.rootca1.amazontrust.com" Heuristic match: "get /mfqwujbqme4wtdajbgurdgmcgguabbrpwaouu8%2b5vz5%2fa9jftau9pkk3faquhbjmhttsvayulc4iwzzhshbocggcewdzek8qls4%2b0ypyvbhdg8doxyc%3d http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/6.1host: ocsp.rootca1.amazontrust.com" Heuristic match: "ocsp.r2m04.amazontrust.com" Heuristic match: "get /mfewtzbnmeswstajbgurdgmcgguabbtihufvpmfdw5hocip918jm5b3cqgquh1ksyvacvh%2bbztgdpqqqmlyh3qgcea3n2p7awhpio7utrzjdirs%3d http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/6.1host: ocsp.r2m04.amazontrust.com" Heuristic match: "accounts.google.com" Heuristic match: "accounts.youtube.com" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "js.hcaptcha.com" Heuristic match: "o.ss2.us" Heuristic match: "s.ss2.us" Heuristic match: "ssl.gstatic.com" Heuristic match: "static-assets-prod.unrealengine.com" Heuristic match: "static.xx.fbcdn.net" Heuristic match: "tracking.epicgames.com" Heuristic match: "twitter.com" Pattern match: "www.epicgames.com" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "www.paypal.com" Pattern match: "www.youtube.com" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowname=weblitesignin&flowentry=servicelogin&dsh=s1359381997:1789242587657247" Pattern match: "https://accounts.google.com/servicelogin?passive=1209600&continue=https%3a%2f%2faccounts.google.com%2f&followup=https%3a%2f%2faccounts.google.com%2fcontent-encoding" Pattern match: "accounts.google.com/x-ua-compatible" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowname=weblitesignin&flowentry=servicelogin&dsh=s1359381997:1789242587657247strict-transport-security" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowname=weblitesignin&flowentry=servicelogin&dsh=s-1339270268:1789242588658479" Pattern match: "https://accounts.google.com/accept-language" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowname=weblitesignin&flowentry=servicelogin&dsh=s-1339270268:1789242588658479strict-transport-security" Pattern match: "https://csp.withgoogle.com/csp/report-to/accountssigninsignupui}]}content-encoding" Pattern match: "https://csp.withgoogle.com/csp/report-to/accountssigninsignupui}]}permissions-policy" Pattern match: "https://www.google.com/favicon.icox-content-type-options" Pattern match: "www.facebook.comdnt" Pattern match: "fb.me/p3pset-cookie" Pattern match: "https://www.fbsbx.com" Pattern match: "rsrc.php/v5/y-/l/0,cross/feet3vn392pm63xdkqrw2sxgo-3469oiggxg-rodaqsdt9dwdypz6dhfgqe914iibfonmkn3yhinqu49pvnahkckvx2i9b7pb8kwpae_brmcjg.css" Pattern match: "www.xx.facebook.com\/ajax\/browser_error_reports\/}],group:permissions_policy}timing-allow-origin" Pattern match: "rsrc.php/yh/r/ur_tiyve0g0.eot" Pattern match: "rsrc.php/yp/r/b_letpaupmi.webp" Pattern match: "rsrc.php/y1/r/ay1hv6olegs.ico" Pattern match: "rsrc.php/yp/r/kuc6ohi0fjd.woff" Pattern match: "rsrc.php/yf/r/ipwqpkyh2fy.ttf" Pattern match: "https://csp.withgoogle.com/csp/report-to/static-on-bigtable}]}content-length" Pattern match: "https://accounts.google.com&v=-164303525×tamp=1789242585117" Pattern match: "https://accounts.google.comcontent-security-policy" Pattern match: "https://accounts.google.com&v=1095322684×tamp=1789242586288" Pattern match: "www.epicgames.comconnection" Pattern match: "www.epicgames.comdnt" Pattern match: "https://www.epicgames.com/id/loginaccept-language" Pattern match: "https://www.youtube.com/supported_browsers?next_url=https%3a%2f%2fwww.youtube.com%2faccept-language" Pattern match: "www.youtube.comdnt" Pattern match: "https://csp.withgoogle.com/csp/report-to/youtube-marketing}]}content-length" Pattern match: "https://www.youtube.com/supported_browsers?next_url=https%3a%2f%2fwww.youtube.com%2fp3p" Pattern match: "http://support.google.com/accounts/answer/151657?hl=en" Pattern match: "https://csp.withgoogle.com/csp/apps-themescross-origin-resource-policy" Pattern match: "www.youtube.com/supported_browsers?next_url=https%3a%2f%2fwww.youtube.com%2f" Heuristic match: "vm3d.cat" Heuristic match: "44,9,$name,2,0,,system.workflow.rs" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0a" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0" Pattern match: "crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s" Pattern match: "crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0" Pattern match: "http://www.digicert.com/cps0" Pattern match: "http://ocsp.digicert.com0\" Pattern match: "cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" Pattern match: "crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0" Pattern match: "http://ocsp.digicert.com0x" Pattern match: "cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0" Pattern match: "www.digicert.com1$0" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0"50:T1ef2,Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00005656.00000000.72842.001E0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0i" - Source: "00000000-00005656.00000000.72842.001E0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0xw70iq,xcu" - Source: "00000000-00005656.00000000.72842.001E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00005656.00000000.72842.001E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00005656.00000000.72842.001E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00005656.00000001.74768.001E0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0i" - Source: "00000000-00005656.00000001.74768.001E0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0xw70iq,xcu" - Source: "00000000-00005656.00000001.74768.001E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00005656.00000001.74768.001E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00005656.00000001.74768.001E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00005656.00000002.74978.001E0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0i" - Source: "00000000-00005656.00000002.74978.001E0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0xw70iq,xcu" - Source: "00000000-00005656.00000002.74978.001E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00005656.00000002.74978.001E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00005656.00000002.74978.001E0000.00000004.mdmp") Found URL "https://steamcommunity.com/openid/loginform/aaybexu60428,5896,3,hre0,,1e449896,3j3m" - Source: "00000000-00005948.00000000.72882.007F0000.00000004.mdmp") Found URL "https://accounts.google.comttps://accounts.google.comaccessibilitycpl.dllactioncentercpl.dlladvancedinstallersaspnet_counters.dllauditnativesnapin.dllbcryptprimitives.dllbdeunlockwizard.exebridgeunattend.exe000ybwcontexthandler.dllbwunpairelevated.dllcertcredprovider.dllcertenrollctrl.exe000ycmicryptinstall.dllcompattelrunner.execompmgmtlauncher.execomputerdefaults.execrppresentation.dlld3dcompiler_47.dlldeviceproperties.exedsccoreconfprov.dlldshowrdpfilter.dlldxptaskringtone.dllfindnetprinters.dllflashplayerapp.exeflashplayercplapp.cplgameuxlegacygdfs.dllgathernetworkinfo.vbsgettingstarted.exehotstartuseragent.dllaclui.dlladsnt.dllaepic.dllansi.sysapds.dllappmgmtapss.dllarp.exeatl71.dllatmfd.dllazman.mscbatt.dllbios1.rombios4.rombthci.dllcalc.execatrootcatroot2cca.dllcdd.dllcero.rsetdrivetypeci.dllcic.dllclb.dllclip.execmifw.dllcmlua.dllcmstp.execob-au.rscomp.exeryptgenkeyconfig\winc:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\microsoft.management.infrastructure.native.unmanaged.dll:\users\hapubws\appdata\local\temp\ixp001.tmp\1ca05zg2.exeistry\user\s-1-5-21-2092356043-4041700817-663127204-1001_classesindows\system32\ieframe.dllc:\windows\system32\ieframe.dlllsid\" - Source: "00000000-00005948.00000000.72882.007F0000.00000004.mdmp") Found URL "https://accounts.google.com/:\windows\system32\ieframe.dlltps://accounts.google.com/ttps://www.paypal.com/signinauditpolicygpinterop.dll\windows\system32\ieframe.dllttps://www.paypal.com/signineryperformancefrequency\windows\system32\ieframe.dllttps://www.facebook.com/login\windows\system32\shell32.dllhttps://www.youtube.com/ttps://www.facebook.com/loginttps://accounts.google.com/tps://accounts.google.com/ttps://accounts.google.com/ttps://accounts.google.com/mediametadatahandler.dll\lag\mi Microsoft Corporation\"\n \"VV6sP45.exe\" was detected as \"Microsoft Visual C++ 8\"\n \"3Yb11Xt.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"2Ig6509.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"DISMHOST.EXE.6AA5D09F.bin\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"1cA05zG2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1\" has section name .rsrc with entropy \"7.9505025810563055\"\n \"VV6sP45.exe\" has section name .rsrc with entropy \"7.919696430945463\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO TLS Handshake Failure\" (SID: 2029340, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/23 Antivirus vendors marked sample as malicious (56% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1\" has resource with unusual entropy \"RT_ICON:7.985151320986029\"\n \"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1\" has resource with unusual entropy \"RT_RCDATA:7.99969311821111\"\n \"1cA05zG2.exe\" has resource with unusual entropy \"RT_RCDATA:7.76637495509754\"\n \"VV6sP45.exe\" has resource with unusual entropy \"RT_ICON:7.985151320986029\"\n \"VV6sP45.exe\" has resource with unusual entropy \"RT_RCDATA:7.999640155282615\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"suspicious","category":"General","name":"References URL in command line","description":"Process \"iexplore.exe\" with commandline \"https://accounts.google.com/\" (UID: 00000000-00005684)","origin":"Monitored Target","mitre_attack_id":"T1105","relevance":1,"id":"target-174","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"1cA05zG2.exe\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\IXP001.TMP\\1cA05zG2.exe]- [targetUID: 00000000-00005948]\n \"VV6sP45.exe\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\IXP000.TMP\\VV6sP45.exe]- [targetUID: 00000000-00005688]\n \"3Yb11Xt.exe\" has type \"PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections\"- Location: [%TEMP%\\IXP000.TMP\\3Yb11Xt.exe]- [targetUID: 00000000-00001384]\n \"2Ig6509.exe\" has type \"PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections\"- Location: [%TEMP%\\IXP001.TMP\\2Ig6509.exe]- [targetUID: 00000000-00005656]\n \"DISMHOST.EXE.6AA5D09F.bin\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"WEXTRACT_CLEANUP0\"; Value: \"rundll32.exe %WINDIR%\\system32\\advpack.dll,DelNodeRunDLL32 \"%TEMP%\\IXP000.TMP\\\"\")\n \"VV6sP45.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"VV6sP45.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"WEXTRACT_CLEANUP1\"; Value: \"rundll32.exe %WINDIR%\\system32\\advpack.dll,DelNodeRunDLL32 \"%TEMP%\\IXP001.TMP\\\"\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$58","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"$59","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - References common sandbox DLLs (sandbox evasion)","description":"YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process \"00000000-00005948\"","origin":"YARA Signature","mitre_attack_id":"T1497.001","relevance":5,"id":"yara-52","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\3Yb11Xt.exe\" for deletion\n \"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\VV6sP45.exe\" for deletion\n \"VV6sP45.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP001.TMP\\2Ig6509.exe\" for deletion\n \"VV6sP45.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP001.TMP\\1cA05zG2.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\" with delete access\n \"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\3Yb11Xt.exe\" with delete access\n \"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\VV6sP45.exe\" with delete access\n \"VV6sP45.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP001.TMP\" with delete access\n \"VV6sP45.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\" with delete access\n \"VV6sP45.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP001.TMP\\2Ig6509.exe\" with delete access\n \"VV6sP45.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP001.TMP\\1cA05zG2.exe\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"1cA05zG2.exe\" claimed CRC 941303 while the actual is CRC 941481\n \"VV6sP45.exe\" claimed CRC 941402 while the actual is CRC 706730\n \"3Yb11Xt.exe\" claimed CRC 706730 while the actual is CRC 381785","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$5a","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"$5b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/23 Antivirus vendors marked sample as malicious (56% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"15/23 Antivirus vendors marked dropped file \"2Ig6509.exe\" as malicious (classified as \"Trojan.Kryptik\" with 65% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"15/23 Antivirus vendors marked spawned process \"2Ig6509.exe\" (PID: 3840) as malicious (classified as \"Trojan.Kryptik\" with 65% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"malicious","category":"Network Related","name":"Contacts multiple hosts","description":"Contacted 21 (or more) hosts in at least 0 different cls.countries","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"malicious","category":"Network Related","name":"Detected multiple DNS responses with a low TTL","description":"\"accounts.google.com\" with TTL 300\n \"accounts.youtube.com\" with TTL 300\n \"c.pki.goog\" with TTL 224\n \"crt.rootg2.amazontrust.com\" with TTL 60\n \"fonts.googleapis.com\" with TTL 127\n \"fonts.gstatic.com\" with TTL 126\n \"js.hcaptcha.com\" with TTL 300\n \"o.ss2.us\" with TTL 58\n \"ocsp.digicert.cn\" with TTL 236\n \"ocsp.pki.goog\" with TTL 280\n \"ocsp.r2m04.amazontrust.com\" with TTL 60\n \"ocsp.rootca1.amazontrust.com\" with TTL 60\n \"ocsp.rootg2.amazontrust.com\" with TTL 60\n \"s.ss2.us\" with TTL 584\n \"ssl.gstatic.com\" with TTL 300\n \"static-assets-prod.unrealengine.com\" with TTL 300\n \"twitter.com\" with TTL 282\n \"www.google.com\" with TTL 300\n \"www.youtube.com\" with TTL 142","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":3,"id":"network-35","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 5.42.92.51 on port 19057","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe\" (UID: 00000000-00005688)\n Spawned process \"VV6sP45.exe\" (UID: 00000000-00005656)\n Spawned process \"1cA05zG2.exe\" (UID: 00000000-00005948)\n Spawned process \"2Ig6509.exe\" (UID: 00000000-00003840)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00002828)\n Spawned process \"3Yb11Xt.exe\" (UID: 00000000-00001384)\n Spawned process \"AppLaunch.exe\" (UID: 00000000-00000640)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected multiple DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 24 domains and 24 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]}],"intel_graph":{"map":{"Domain:accounts.google.com":{"type":"Domain","value":"accounts.google.com"},"Domain:accounts.youtube.com":{"type":"Domain","value":"accounts.youtube.com"},"Domain:c.pki.goog":{"type":"Domain","value":"c.pki.goog"},"Domain:crt.rootg2.amazontrust.com":{"type":"Domain","value":"crt.rootg2.amazontrust.com"},"Domain:fonts.googleapis.com":{"type":"Domain","value":"fonts.googleapis.com"},"Domain:fonts.gstatic.com":{"type":"Domain","value":"fonts.gstatic.com"},"Domain:js.hcaptcha.com":{"type":"Domain","value":"js.hcaptcha.com"},"Domain:o.ss2.us":{"type":"Domain","value":"o.ss2.us"},"Domain:ocsp.digicert.cn":{"type":"Domain","value":"ocsp.digicert.cn"},"Domain:ocsp.pki.goog":{"type":"Domain","value":"ocsp.pki.goog"},"Domain:ocsp.r2m04.amazontrust.com":{"type":"Domain","value":"ocsp.r2m04.amazontrust.com"},"Domain:ocsp.rootca1.amazontrust.com":{"type":"Domain","value":"ocsp.rootca1.amazontrust.com"},"Domain:ocsp.rootg2.amazontrust.com":{"type":"Domain","value":"ocsp.rootg2.amazontrust.com"},"Domain:s.ss2.us":{"type":"Domain","value":"s.ss2.us"},"Domain:ssl.gstatic.com":{"type":"Domain","value":"ssl.gstatic.com"},"Domain:static-assets-prod.unrealengine.com":{"type":"Domain","value":"static-assets-prod.unrealengine.com"},"Domain:static.xx.fbcdn.net":{"type":"Domain","value":"static.xx.fbcdn.net"},"Domain:tracking.epicgames.com":{"type":"Domain","value":"tracking.epicgames.com"},"Domain:twitter.com":{"type":"Domain","value":"twitter.com"},"Domain:www.epicgames.com":{"type":"Domain","value":"www.epicgames.com"},"Domain:www.facebook.com":{"type":"Domain","value":"www.facebook.com"},"Domain:www.google.com":{"type":"Domain","value":"www.google.com"},"Domain:www.paypal.com":{"type":"Domain","value":"www.paypal.com"},"Domain:www.youtube.com":{"type":"Domain","value":"www.youtube.com"},"File:0466e10b13f045c3feab80308783bc3fcd5607012fdc06d75ef3b945685a3272":{"type":"File","value":"0466e10b13f045c3feab80308783bc3fcd5607012fdc06d75ef3b945685a3272"},"File:053032b9b2c95bf3edc42c2cb0dcd1545c5531210cbef1fab736efa99c2d92ff":{"type":"File","value":"053032b9b2c95bf3edc42c2cb0dcd1545c5531210cbef1fab736efa99c2d92ff"},"File:0a8bbe5d6592b39553d6e1ffdd134ed1cf095fa698781041b6f6950acc63246a":{"type":"File","value":"0a8bbe5d6592b39553d6e1ffdd134ed1cf095fa698781041b6f6950acc63246a"},"File:1a9251dc3b3c064cfc5e2b90b6c7dc3c225f7017066db2b77e49dae90a94a399":{"type":"File","value":"1a9251dc3b3c064cfc5e2b90b6c7dc3c225f7017066db2b77e49dae90a94a399"},"File:280a2429a39314d52f48be41c6e02c33980da31ed12d0f6baf12bbc399863825":{"type":"File","value":"280a2429a39314d52f48be41c6e02c33980da31ed12d0f6baf12bbc399863825","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:41681f90ae14d87dee5d37d19500fc21d85c2b3e7b0dd697a27c36d03e3606ba":{"type":"File","value":"41681f90ae14d87dee5d37d19500fc21d85c2b3e7b0dd697a27c36d03e3606ba","filetype":"data (from peinfo)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:47ecf82aba64ee41831f79b3d526cef06e81604c025354ebad6299143c6bd67c":{"type":"File","value":"47ecf82aba64ee41831f79b3d526cef06e81604c025354ebad6299143c6bd67c"},"File:54920dee8e017a42246a1054a0e46a791815356030b02f028ff79d21a9ed76aa":{"type":"File","value":"54920dee8e017a42246a1054a0e46a791815356030b02f028ff79d21a9ed76aa"},"File:846260e79282cef1f75e983aadea30c93e419e64cee71d1d8b0f29902f54dfe8":{"type":"File","value":"846260e79282cef1f75e983aadea30c93e419e64cee71d1d8b0f29902f54dfe8","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:889064b52634057b86b5c888c7b3602a812154bfe5e47f3425d3d6ab196169f3":{"type":"File","value":"889064b52634057b86b5c888c7b3602a812154bfe5e47f3425d3d6ab196169f3"},"File:905aff92e6dc5fe78d0a9b09fc22db3b26eb60f78732b066d3a32b6a295c6492":{"type":"File","value":"905aff92e6dc5fe78d0a9b09fc22db3b26eb60f78732b066d3a32b6a295c6492"},"File:93bb3af192e3302af7a6fe3a96bec837f3237b7ff0b3d96ed9d1a7617d23bf7d":{"type":"File","value":"93bb3af192e3302af7a6fe3a96bec837f3237b7ff0b3d96ed9d1a7617d23bf7d"},"File:9560d41ec52d0c87aa43156d323f044be91a14c429b15726f9de503081d04ed5":{"type":"File","value":"9560d41ec52d0c87aa43156d323f044be91a14c429b15726f9de503081d04ed5"},"File:a5879d94a96fb91b8e0ef01b1b56cd1db5536082b995734cde4e1734c052f810":{"type":"File","value":"a5879d94a96fb91b8e0ef01b1b56cd1db5536082b995734cde4e1734c052f810"},"File:a7ead2641fb011a7b7a1c050b5b29c58279e6f4e56c2115bf53993c417a27bf2":{"type":"File","value":"a7ead2641fb011a7b7a1c050b5b29c58279e6f4e56c2115bf53993c417a27bf2","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:b484511532687254b86f7ef375e4e82179a526cf42d8940770243495c5eac07e":{"type":"File","value":"b484511532687254b86f7ef375e4e82179a526cf42d8940770243495c5eac07e"},"File:c756f2b971df037ad007f13ca7faff6031b17f6187aa081abacbbbc8823f7aef":{"type":"File","value":"c756f2b971df037ad007f13ca7faff6031b17f6187aa081abacbbbc8823f7aef"},"File:cb5c3560d5a73c46a236a054ae699547a32d284b595726d908bfef6762f928e0":{"type":"File","value":"cb5c3560d5a73c46a236a054ae699547a32d284b595726d908bfef6762f928e0","filetype":"PE32 executable (console) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1":{"type":"File","value":"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:e5ecbbb59e9b094cf18555494afbd4e61f39f90ba2debeee983cb00b93c59250":{"type":"File","value":"e5ecbbb59e9b094cf18555494afbd4e61f39f90ba2debeee983cb00b93c59250"},"File:e9642529bbd47cbdc4252e5fa16cdc40380c2a14e84cac8bc3c6f3d1ebdc9813":{"type":"File","value":"e9642529bbd47cbdc4252e5fa16cdc40380c2a14e84cac8bc3c6f3d1ebdc9813"},"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11":{"type":"File","value":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},"Ip:104.18.21.177":{"type":"Ip","value":"104.18.21.177"},"Ip:104.18.21.94":{"type":"Ip","value":"104.18.21.94"},"Ip:104.19.229.21":{"type":"Ip","value":"104.19.229.21"},"Ip:142.250.190.238":{"type":"Ip","value":"142.250.190.238"},"Ip:142.250.191.10":{"type":"Ip","value":"142.250.191.10"},"Ip:142.250.191.3":{"type":"Ip","value":"142.250.191.3"},"Ip:142.250.217.227":{"type":"Ip","value":"142.250.217.227"},"Ip:142.250.65.67":{"type":"Ip","value":"142.250.65.67"},"Ip:142.251.155.4":{"type":"Ip","value":"142.251.155.4"},"Ip:142.251.156.119":{"type":"Ip","value":"142.251.156.119"},"Ip:151.101.65.21":{"type":"Ip","value":"151.101.65.21"},"Ip:155.102.176.82":{"type":"Ip","value":"155.102.176.82"},"Ip:162.159.140.229":{"type":"Ip","value":"162.159.140.229"},"Ip:18.164.126.61":{"type":"Ip","value":"18.164.126.61"},"Ip:18.238.80.38":{"type":"Ip","value":"18.238.80.38"},"Ip:184.192.132.151":{"type":"Ip","value":"184.192.132.151"},"Ip:192.178.155.84":{"type":"Ip","value":"192.178.155.84"},"Ip:5.42.92.51":{"type":"Ip","value":"5.42.92.51"},"Ip:52.84.24.24":{"type":"Ip","value":"52.84.24.24"},"Ip:57.144.180.128":{"type":"Ip","value":"57.144.180.128"},"Ip:57.144.220.1":{"type":"Ip","value":"57.144.220.1"},"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D":{"type":"Url","value":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D"},"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D":{"type":"Url","value":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D"},"Url:/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D":{"type":"Url","value":"/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D"},"Url:/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D":{"type":"Url","value":"/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D"},"Url:/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D":{"type":"Url","value":"/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D"},"Url:/r/gsr1.crl":{"type":"Url","value":"/r/gsr1.crl"},"Url:/r/r1.crl":{"type":"Url","value":"/r/r1.crl"},"Url:/r/r4.crl":{"type":"Url","value":"/r/r4.crl"},"Url:/rootg2.cer":{"type":"Url","value":"/rootg2.cer"},"Url:/we1/G0k-BqpOX8k.crl":{"type":"Url","value":"/we1/G0k-BqpOX8k.crl"},"Url:/we1/pl4XiTjSDSk.crl":{"type":"Url","value":"/we1/pl4XiTjSDSk.crl"},"Url:/we1/x6Eg-8TSwUw.crl":{"type":"Url","value":"/we1/x6Eg-8TSwUw.crl"},"Url:/we2/yK5nPhtHKQs.crl":{"type":"Url","value":"/we2/yK5nPhtHKQs.crl"},"Url:/wr2/75r4ZyA3vA0.crl":{"type":"Url","value":"/wr2/75r4ZyA3vA0.crl"},"Url:/wr2/9UVbN0w5E6Y.crl":{"type":"Url","value":"/wr2/9UVbN0w5E6Y.crl"},"Url:/wr2/oBFYYahzgVI.crl":{"type":"Url","value":"/wr2/oBFYYahzgVI.crl"},"Url:/wr2/oQ6nyr8F0m0.crl":{"type":"Url","value":"/wr2/oQ6nyr8F0m0.crl"}},"chains":[{"id":"1548420357185679899","root":"File:a7ead2641fb011a7b7a1c050b5b29c58279e6f4e56c2115bf53993c417a27bf2","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:a7ead2641fb011a7b7a1c050b5b29c58279e6f4e56c2115bf53993c417a27bf2","to_key":"File:41681f90ae14d87dee5d37d19500fc21d85c2b3e7b0dd697a27c36d03e3606ba"}],"verdict":{"verdict":"unknown"}},{"id":"1548420357307314716","root":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:280a2429a39314d52f48be41c6e02c33980da31ed12d0f6baf12bbc399863825"}],"verdict":{"verdict":"unknown"}},{"id":"1548420357315703325","root":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:cb5c3560d5a73c46a236a054ae699547a32d284b595726d908bfef6762f928e0"},{"edge_kind":"extracted_from_archive","from_key":"File:cb5c3560d5a73c46a236a054ae699547a32d284b595726d908bfef6762f928e0","to_key":"File:846260e79282cef1f75e983aadea30c93e419e64cee71d1d8b0f29902f54dfe8"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_network","root":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","edges":[{"edge_kind":"contacted_ip","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Ip:192.178.155.84"},{"edge_kind":"contacted_ip","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Ip:57.144.220.1"},{"edge_kind":"contacted_ip","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Ip:155.102.176.82"},{"edge_kind":"contacted_ip","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Ip:57.144.180.128"},{"edge_kind":"contacted_ip","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Ip:142.250.217.227"},{"edge_kind":"contacted_ip","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Ip:142.250.191.3"},{"edge_kind":"contacted_ip","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Ip:142.250.190.238"},{"edge_kind":"contacted_ip","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Ip:142.251.156.119"},{"edge_kind":"contacted_ip","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Ip:162.159.140.229"},{"edge_kind":"contacted_ip","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Ip:104.18.21.94"},{"edge_kind":"contacted_ip","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Ip:104.18.21.177"},{"edge_kind":"contacted_ip","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Ip:104.19.229.21"},{"edge_kind":"contacted_ip","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Ip:184.192.132.151"},{"edge_kind":"contacted_ip","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Ip:18.238.80.38"},{"edge_kind":"contacted_ip","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Ip:151.101.65.21"},{"edge_kind":"contacted_ip","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Ip:142.251.155.4"},{"edge_kind":"contacted_ip","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Ip:142.250.191.10"},{"edge_kind":"contacted_ip","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Ip:18.164.126.61"},{"edge_kind":"contacted_ip","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Ip:142.250.65.67"},{"edge_kind":"contacted_ip","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Ip:52.84.24.24"},{"edge_kind":"contacted_ip","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Ip:5.42.92.51"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:accounts.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:accounts.google.com","to_key":"Ip:192.178.155.84"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:accounts.youtube.com"},{"edge_kind":"resolves_to","from_key":"Domain:accounts.youtube.com","to_key":"Ip:142.250.190.238"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:c.pki.goog"},{"edge_kind":"resolves_to","from_key":"Domain:c.pki.goog","to_key":"Ip:142.250.217.227"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:crt.rootg2.amazontrust.com"},{"edge_kind":"resolves_to","from_key":"Domain:crt.rootg2.amazontrust.com","to_key":"Ip:18.238.80.38"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:fonts.googleapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:fonts.googleapis.com","to_key":"Ip:142.250.191.10"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:fonts.gstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:fonts.gstatic.com","to_key":"Ip:142.250.65.67"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:js.hcaptcha.com"},{"edge_kind":"resolves_to","from_key":"Domain:js.hcaptcha.com","to_key":"Ip:104.19.229.21"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:o.ss2.us"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:ocsp.digicert.cn"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.digicert.cn","to_key":"Ip:155.102.176.82"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:ocsp.pki.goog"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.pki.goog","to_key":"Ip:142.250.217.227"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:ocsp.r2m04.amazontrust.com"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.r2m04.amazontrust.com","to_key":"Ip:52.84.24.24"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:ocsp.rootca1.amazontrust.com"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.rootca1.amazontrust.com","to_key":"Ip:18.164.126.61"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:ocsp.rootg2.amazontrust.com"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.rootg2.amazontrust.com","to_key":"Ip:18.164.126.61"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:s.ss2.us"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:ssl.gstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:ssl.gstatic.com","to_key":"Ip:142.250.191.3"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:static-assets-prod.unrealengine.com"},{"edge_kind":"resolves_to","from_key":"Domain:static-assets-prod.unrealengine.com","to_key":"Ip:104.18.21.177"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:static.xx.fbcdn.net"},{"edge_kind":"resolves_to","from_key":"Domain:static.xx.fbcdn.net","to_key":"Ip:57.144.180.128"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:tracking.epicgames.com"},{"edge_kind":"resolves_to","from_key":"Domain:tracking.epicgames.com","to_key":"Ip:184.192.132.151"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:twitter.com"},{"edge_kind":"resolves_to","from_key":"Domain:twitter.com","to_key":"Ip:162.159.140.229"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:www.epicgames.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.epicgames.com","to_key":"Ip:104.18.21.94"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:www.facebook.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.facebook.com","to_key":"Ip:57.144.220.1"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:www.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.google.com","to_key":"Ip:142.251.156.119"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:www.paypal.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.paypal.com","to_key":"Ip:151.101.65.21"},{"edge_kind":"contacted_domain","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Domain:www.youtube.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.youtube.com","to_key":"Ip:142.251.155.4"},{"edge_kind":"contacted_url","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D"},{"edge_kind":"contacted_url","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Url:/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D"},{"edge_kind":"contacted_url","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Url:/r/r1.crl"},{"edge_kind":"contacted_url","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Url:/wr2/oBFYYahzgVI.crl"},{"edge_kind":"contacted_url","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Url:/wr2/75r4ZyA3vA0.crl"},{"edge_kind":"contacted_url","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Url:/wr2/9UVbN0w5E6Y.crl"},{"edge_kind":"contacted_url","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Url:/r/gsr1.crl"},{"edge_kind":"contacted_url","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Url:/we1/pl4XiTjSDSk.crl"},{"edge_kind":"contacted_url","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Url:/r/r4.crl"},{"edge_kind":"contacted_url","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Url:/we1/x6Eg-8TSwUw.crl"},{"edge_kind":"contacted_url","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Url:/we1/G0k-BqpOX8k.crl"},{"edge_kind":"contacted_url","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Url:/rootg2.cer"},{"edge_kind":"contacted_url","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Url:/we2/yK5nPhtHKQs.crl"},{"edge_kind":"contacted_url","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Url:/wr2/oQ6nyr8F0m0.crl"},{"edge_kind":"contacted_url","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Url:/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D"},{"edge_kind":"contacted_url","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Url:/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D"},{"edge_kind":"contacted_url","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","edges":[{"edge_kind":"extracted","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:41681f90ae14d87dee5d37d19500fc21d85c2b3e7b0dd697a27c36d03e3606ba"},{"edge_kind":"extracted","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:280a2429a39314d52f48be41c6e02c33980da31ed12d0f6baf12bbc399863825"},{"edge_kind":"extracted","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:cb5c3560d5a73c46a236a054ae699547a32d284b595726d908bfef6762f928e0"},{"edge_kind":"extracted","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:846260e79282cef1f75e983aadea30c93e419e64cee71d1d8b0f29902f54dfe8"},{"edge_kind":"extracted","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:a7ead2641fb011a7b7a1c050b5b29c58279e6f4e56c2115bf53993c417a27bf2"},{"edge_kind":"extracted","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:905aff92e6dc5fe78d0a9b09fc22db3b26eb60f78732b066d3a32b6a295c6492"},{"edge_kind":"extracted","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},{"edge_kind":"extracted","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:0a8bbe5d6592b39553d6e1ffdd134ed1cf095fa698781041b6f6950acc63246a"},{"edge_kind":"extracted","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:54920dee8e017a42246a1054a0e46a791815356030b02f028ff79d21a9ed76aa"},{"edge_kind":"extracted","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:47ecf82aba64ee41831f79b3d526cef06e81604c025354ebad6299143c6bd67c"},{"edge_kind":"extracted","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:b484511532687254b86f7ef375e4e82179a526cf42d8940770243495c5eac07e"},{"edge_kind":"extracted","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:053032b9b2c95bf3edc42c2cb0dcd1545c5531210cbef1fab736efa99c2d92ff"},{"edge_kind":"extracted","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:a5879d94a96fb91b8e0ef01b1b56cd1db5536082b995734cde4e1734c052f810"},{"edge_kind":"extracted","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:9560d41ec52d0c87aa43156d323f044be91a14c429b15726f9de503081d04ed5"},{"edge_kind":"extracted","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:93bb3af192e3302af7a6fe3a96bec837f3237b7ff0b3d96ed9d1a7617d23bf7d"},{"edge_kind":"extracted","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:889064b52634057b86b5c888c7b3602a812154bfe5e47f3425d3d6ab196169f3"},{"edge_kind":"extracted","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:e5ecbbb59e9b094cf18555494afbd4e61f39f90ba2debeee983cb00b93c59250"},{"edge_kind":"extracted","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:e9642529bbd47cbdc4252e5fa16cdc40380c2a14e84cac8bc3c6f3d1ebdc9813"},{"edge_kind":"extracted","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:1a9251dc3b3c064cfc5e2b90b6c7dc3c225f7017066db2b77e49dae90a94a399"},{"edge_kind":"extracted","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:0466e10b13f045c3feab80308783bc3fcd5607012fdc06d75ef3b945685a3272"},{"edge_kind":"extracted","from_key":"File:cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","to_key":"File:c756f2b971df037ad007f13ca7faff6031b17f6187aa081abacbbbc8823f7aef"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":14,"spawned_processes_count":14,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":21,"imported_dlls_count":190,"dropped_files_count":0,"extracted_files_count":21,"files_written_count":6,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":21,"dns_resolutions_count":24,"contacted_urls_count":17,"http_requests_count":17},"behavior_tags":["suspicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"6aa5acb3b938dd67e70c4971","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Heur.Crifi","contacted_countries":["RUS","USA"],"submit_name":"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","analysis_start_time":"2026-09-12T19:49:08+00:00","indicators_count":{"informative":255,"suspicious":55,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"192.178.155.84","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"address":"57.144.220.1","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"address":"155.102.176.82","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"address":"57.144.180.128","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"address":"142.250.217.227","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"address":"142.250.191.3","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"address":"142.250.190.238","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"address":"142.251.156.119","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"address":"162.159.140.229","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"address":"104.18.21.94","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"address":"104.18.21.177","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"address":"104.19.229.21","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"address":"184.192.132.151","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"address":"18.238.80.38","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"address":"151.101.65.21","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"address":"142.251.155.4","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"address":"142.250.191.10","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"address":"18.164.126.61","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"address":"142.250.65.67","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"address":"52.84.24.24","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"address":"5.42.92.51","port":19057,"protocol":"TCP","country":"Russia","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]}],"dns_resolutions":[{"domain":"accounts.google.com","address":"192.178.155.84","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"accounts.youtube.com","address":"142.250.190.238","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"c.pki.goog","address":"142.250.217.227","ttl":224,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"crt.rootg2.amazontrust.com","address":"18.238.80.38","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"fonts.googleapis.com","address":"142.250.191.10","ttl":127,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"fonts.gstatic.com","address":"142.250.65.67","ttl":126,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"ns4.google.com","registrar_creation_date":"2008-02-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"js.hcaptcha.com","address":"104.19.229.21","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"o.ss2.us","ttl":58,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"ocsp.digicert.cn","address":"155.102.176.82","ttl":236,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"ocsp.pki.goog","address":"142.250.217.227","ttl":280,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"ocsp.r2m04.amazontrust.com","address":"52.84.24.24","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"ocsp.rootca1.amazontrust.com","address":"18.164.126.61","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"ocsp.rootg2.amazontrust.com","address":"18.164.126.61","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"s.ss2.us","ttl":584,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"ssl.gstatic.com","address":"142.250.191.3","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"static-assets-prod.unrealengine.com","address":"104.18.21.177","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"static.xx.fbcdn.net","address":"57.144.180.128","ttl":3468,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"tracking.epicgames.com","address":"184.192.132.151","ttl":2801,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"twitter.com","address":"162.159.140.229","ttl":282,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"www.epicgames.com","address":"104.18.21.94","ttl":3600,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"www.facebook.com","address":"57.144.220.1","ttl":3570,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"www.google.com","address":"142.251.156.119","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"www.paypal.com","address":"151.101.65.21","ttl":2904,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"domain":"www.youtube.com","address":"142.251.155.4","ttl":142,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]}],"http_requests":[{"host":"ocsp.digicert.cn","host_ip":"155.102.176.82:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.cn","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"host":"ocsp.pki.goog","host_ip":"142.250.217.227:80","url":"/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"host":"c.pki.goog","host_ip":"142.250.217.227:80","url":"/r/r1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /r/r1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"host":"c.pki.goog","host_ip":"142.250.217.227:80","url":"/wr2/oBFYYahzgVI.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wr2/oBFYYahzgVI.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"host":"c.pki.goog","host_ip":"142.250.217.227:80","url":"/wr2/75r4ZyA3vA0.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wr2/75r4ZyA3vA0.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"host":"c.pki.goog","host_ip":"142.250.217.227:80","url":"/wr2/9UVbN0w5E6Y.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"host":"c.pki.goog","host_ip":"142.250.217.227:80","url":"/r/gsr1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /r/gsr1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"host":"c.pki.goog","host_ip":"142.250.217.227:80","url":"/we1/pl4XiTjSDSk.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /we1/pl4XiTjSDSk.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"host":"c.pki.goog","host_ip":"142.250.217.227:80","url":"/r/r4.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /r/r4.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"host":"c.pki.goog","host_ip":"142.250.217.227:80","url":"/we1/x6Eg-8TSwUw.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /we1/x6Eg-8TSwUw.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"host":"c.pki.goog","host_ip":"142.250.217.227:80","url":"/we1/G0k-BqpOX8k.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /we1/G0k-BqpOX8k.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"host":"crt.rootg2.amazontrust.com","host_ip":"18.238.80.38:80","url":"/rootg2.cer","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /rootg2.cer HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crt.rootg2.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"host":"c.pki.goog","host_ip":"142.250.217.227:80","url":"/we2/yK5nPhtHKQs.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /we2/yK5nPhtHKQs.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"host":"c.pki.goog","host_ip":"142.250.217.227:80","url":"/wr2/oQ6nyr8F0m0.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"host":"ocsp.rootg2.amazontrust.com","host_ip":"18.164.126.61:80","url":"/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.rootg2.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"host":"ocsp.rootca1.amazontrust.com","host_ip":"18.164.126.61:80","url":"/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.rootca1.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"host":"ocsp.r2m04.amazontrust.com","host_ip":"52.84.24.24:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.r2m04.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}],"processes":[{"pid":5688,"ppid":0,"name":"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe","command_line":"","sha256":"cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1","normalized_path":"C:\\cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1.exe","uid":"00000000-00005688","icon":"$5c"},{"pid":5656,"ppid":5688,"name":"VV6sP45.exe","command_line":"","sha256":"280a2429a39314d52f48be41c6e02c33980da31ed12d0f6baf12bbc399863825","normalized_path":"%TEMP%\\IXP000.TMP\\VV6sP45.exe","parent_uid":"00000000-00005688","uid":"00000000-00005656"},{"pid":5948,"ppid":5656,"name":"1cA05zG2.exe","command_line":"","sha256":"a7ead2641fb011a7b7a1c050b5b29c58279e6f4e56c2115bf53993c417a27bf2","normalized_path":"%TEMP%\\IXP001.TMP\\1cA05zG2.exe","parent_uid":"00000000-00005656","uid":"00000000-00005948"},{"pid":5684,"ppid":5948,"name":"iexplore.exe","command_line":"https://accounts.google.com/","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00005948","uid":"00000000-00005684"},{"pid":5780,"ppid":5684,"name":"iexplore.exe","command_line":"SCODEF:5684 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00005684","uid":"00000000-00005780"},{"pid":5860,"ppid":5684,"name":"iexplore.exe","command_line":"SCODEF:5684 CREDAT:275465 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00005684","uid":"00000000-00005860"},{"pid":500,"ppid":5684,"name":"iexplore.exe","command_line":"SCODEF:5684 CREDAT:865287 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00005684","uid":"00000000-00000500"},{"pid":2168,"ppid":5684,"name":"iexplore.exe","command_line":"SCODEF:5684 CREDAT:603160 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00005684","uid":"00000000-00002168"},{"pid":3924,"ppid":5684,"name":"iexplore.exe","command_line":"SCODEF:5684 CREDAT:603179 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00005684","uid":"00000000-00003924"},{"pid":3208,"ppid":5684,"name":"iexplore.exe","command_line":"SCODEF:5684 CREDAT:1848342 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00005684","uid":"00000000-00003208"},{"pid":3840,"ppid":5656,"name":"2Ig6509.exe","command_line":"","sha256":"905aff92e6dc5fe78d0a9b09fc22db3b26eb60f78732b066d3a32b6a295c6492","normalized_path":"%TEMP%\\IXP001.TMP\\2Ig6509.exe","parent_uid":"00000000-00005656","uid":"00000000-00003840"},{"pid":2828,"ppid":3840,"name":"AppLaunch.exe","command_line":"","sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe","parent_uid":"00000000-00003840","uid":"00000000-00002828"},{"pid":1384,"ppid":5688,"name":"3Yb11Xt.exe","command_line":"","sha256":"cb5c3560d5a73c46a236a054ae699547a32d284b595726d908bfef6762f928e0","normalized_path":"%TEMP%\\IXP000.TMP\\3Yb11Xt.exe","parent_uid":"00000000-00005688","uid":"00000000-00001384"},{"pid":640,"ppid":1384,"name":"AppLaunch.exe","command_line":"","sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe","parent_uid":"00000000-00001384","uid":"00000000-00000640"}],"all_imported_dlls":["msacm32.dll","sfc.dll","fltLib.dll","api-ms-win-core-processthreads-l1-1-1.dll","dnsapi.dll","msvcr90.dll","PresentationNative_v0400.dll","sspicli.dll","api-ms-win-core-timezone-l1-1-0.dll","wship6.dll","dhcpcsvc6.dll","ucrtbase_clr0400.dll","System.ServiceModel.dll","System.Transactions.dll","api-ms-win-crt-utility-l1-1-0.dll","vm3dum.dll","comctl32.dll","winmm.dll","sfc_os.dll","wininet.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","d3d11.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","IPHLPAPI.DLL","mlang.dll","SensApi.dll","api-ms-win-crt-convert-l1-1-0.dll","clr.dll","nlssorting.dll","PresentationCore.ni.dll","AcLayers.dll","cfgmgr32.dll","msctf.dll","api-ms-win-crt-filesystem-l1-1-0.dll","clbcatq.dll","Wldap32.dll","credssp.dll","mscoree.dll","user32.dll","userenv.dll","IEShims.dll","mscorwks.dll","powrprof.dll","api-ms-win-core-xstate-l2-1-0.dll","System.Drawing.ni.dll","SwDir_1231201.dll","KernelBase.dll","profapi.dll","vcruntime140.dll","wshqos.dll","sxs.dll","actxprxy.dll","advapi32.dll","iertutil.dll","cryptsp.dll","wintrust.dll","winhttp.dll","mshtml.dll","URLREDIR.DLL","msimtf.dll","apphelp.dll","shell32.dll","feclient.dll","crypt32.dll","dui70.dll","wpfgfx_v0400.dll","System.IdentityModel.ni.dll","dwmapi.dll","urlmon.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-core-file-l1-2-0.dll","dxgi.dll","System.Windows.Forms.ni.dll","System.Core.ni.dll","VxSSL32.dll","ieproxy.dll","rasadhlp.dll","xmllite.dll","msvcrt.dll","version.dll","devobj.dll","vm3dum_loader.dll","System.ServiceModel.Internals.dll","cryptbase.dll","netapi32.dll","d3d10level9.dll","WSHTCPIP.DLL","cryptnet.dll","ssv.dll","AcGenral.dll","ws2_32.dll","wkscli.dll","msvcr100.dll","WindowsBase.ni.dll","gdi32.dll","api-ms-win-crt-runtime-l1-1-0.dll","nlaapi.dll","RpcRtRemote.dll","netutils.dll","FWPUCLNT.DLL","d2d1.dll","System.Configuration.ni.dll","msasn1.dll","WindowsCodecs.dll","clrjit.dll","System.Xml.ni.dll","shlwapi.dll","api-ms-win-downlevel-version-l1-1-0.dll","psapi.dll","rpcss.dll","ieui.dll","bcryptprimitives.dll","rpcrt4.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","jp2ssv.dll","System.Transactions.ni.dll","oleaut32.dll","api-ms-win-core-synch-l1-2-0.dll","rsaenh.dll","duser.dll","mscoreei.dll","MSOHEV.DLL","System.ni.dll","setupapi.dll","advpack.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","netprofm.dll","msimg32.dll","imagehlp.dll","vcruntime140_clr0400.dll","mscorlib.ni.dll","usp10.dll","samcli.dll","System.Windows.Forms.dll","msvcp140_clr0400.dll","System.Runtime.Serialization.ni.dll","ole32.dll","comdlg32.dll","ieframe.dll","ncrypt.dll","bcrypt.dll","sechost.dll","api-ms-win-downlevel-user32-l1-1-0.dll","nsi.dll","mswsock.dll","srvcli.dll","dhcpcsvc.dll","ntmarta.dll","d3d10warp.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","secur32.dll","webio.dll","jscript9.dll","deploy.dll","PresentationFramework.ni.dll","diasymreader.dll","lpk.dll","mpr.dll","normaliz.dll","imm32.dll","api-ms-win-core-file-l2-1-0.dll","winnsi.dll","propsys.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","msvcp140.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","sqmapi.dll","ExplorerFrame.dll","schannel.dll","gpapi.dll","DWrite.dll","vm3dum_10.dll","ucrtbase.dll","wsock32.dll","npctrl.dll","oleaccrc.dll","ntdll.dll","kernel32.dll","cabinet.dll","api-ms-win-crt-heap-l1-1-0.dll","npmproxy.dll","oleacc.dll","SMDiagnostics.ni.dll","uxtheme.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"41681f90ae14d87dee5d37d19500fc21d85c2b3e7b0dd697a27c36d03e3606ba","sha256":"41681f90ae14d87dee5d37d19500fc21d85c2b3e7b0dd697a27c36d03e3606ba","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"VV6sP45.exe","sha256":"280a2429a39314d52f48be41c6e02c33980da31ed12d0f6baf12bbc399863825","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"3Yb11Xt.exe","sha256":"cb5c3560d5a73c46a236a054ae699547a32d284b595726d908bfef6762f928e0","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"846260e79282cef1f75e983aadea30c93e419e64cee71d1d8b0f29902f54dfe8","sha256":"846260e79282cef1f75e983aadea30c93e419e64cee71d1d8b0f29902f54dfe8","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"1cA05zG2.exe","sha256":"a7ead2641fb011a7b7a1c050b5b29c58279e6f4e56c2115bf53993c417a27bf2","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"2Ig6509.exe","sha256":"905aff92e6dc5fe78d0a9b09fc22db3b26eb60f78732b066d3a32b6a295c6492","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"DISMHOST.EXE.6AA5D09F.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"index-BMC5_rMx_1_.js","sha256":"0a8bbe5d6592b39553d6e1ffdd134ed1cf095fa698781041b6f6950acc63246a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"fEet3vn392pm63XDkQrw2Sxgo-3469oiGGxG-roDaQsdT9DWDYPz6DhfgQe914iiBfONMKn3YhINqU49pVNahkCkvx2I9b7Pb8KWpaE_brMCJG_1_.css","sha256":"54920dee8e017a42246a1054a0e46a791815356030b02f028ff79d21a9ed76aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"identifier_1_.htm","sha256":"47ecf82aba64ee41831f79b3d526cef06e81604c025354ebad6299143c6bd67c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"login_1_.htm","sha256":"b484511532687254b86f7ef375e4e82179a526cf42d8940770243495c5eac07e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"api_1_.js","sha256":"053032b9b2c95bf3edc42c2cb0dcd1545c5531210cbef1fab736efa99c2d92ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"dism.log","sha256":"a5879d94a96fb91b8e0ef01b1b56cd1db5536082b995734cde4e1734c052f810","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"928TN5UD.htm","sha256":"9560d41ec52d0c87aa43156d323f044be91a14c429b15726f9de503081d04ed5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"0839ECC4815B5D8D5ED699ED1C20C543","sha256":"93bb3af192e3302af7a6fe3a96bec837f3237b7ff0b3d96ed9d1a7617d23bf7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"595CD0DCED5F6DE43A9C77C525C44511","sha256":"889064b52634057b86b5c888c7b3602a812154bfe5e47f3425d3d6ab196169f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"75A092F4522006A97542D6AC4F4E69D2","sha256":"e5ecbbb59e9b094cf18555494afbd4e61f39f90ba2debeee983cb00b93c59250","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"9C69E496D546F49A980D7350EC49A180","sha256":"e9642529bbd47cbdc4252e5fa16cdc40380c2a14e84cac8bc3c6f3d1ebdc9813","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"dinosaur_1_.png","sha256":"1a9251dc3b3c064cfc5e2b90b6c7dc3c225f7017066db2b77e49dae90a94a399","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"68317AD4F8681C59B8DA0296EF2FCDBA","sha256":"0466e10b13f045c3feab80308783bc3fcd5607012fdc06d75ef3b945685a3272","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"imagestore.dat","sha256":"c756f2b971df037ad007f13ca7faff6031b17f6187aa081abacbbbc8823f7aef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]}],"files_written":[{"path":"%TEMP%\\IXP000.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"path":"%TEMP%\\IXP000.TMP\\VV6sP45.exe","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"path":"%TEMP%\\IXP000.TMP\\3Yb11Xt.exe","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"path":"%TEMP%\\IXP001.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"path":"%TEMP%\\IXP001.TMP\\1cA05zG2.exe","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"path":"%TEMP%\\IXP001.TMP\\2Ig6509.exe","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP0\\WEXTRACT_CLEANUP0","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP1\\WEXTRACT_CLEANUP1","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_1634_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_5684","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_1634_IE_EarlyTabStart_0x1664_Mutex","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_1634_ConnHashTable<5684>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_1634_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_1634_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_1634_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\https://www.epicgames.com/","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6aa5acb3b938dd67e70c4971"}]}]}},"report_ids":{"sandbox_job_ids":["6aa5acb3b938dd67e70c4971"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Crifi.Generic Sample cd732d10374e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample cd732d10374e…. Malware family: Crifi.Generic. Threat score 100/100. 14/24 AV engines flagged this file. 12 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1"}],["$","meta","4",{"property":"og:title","content":"Malicious Crifi.Generic Sample cd732d10374e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample cd732d10374e…. Malware family: Crifi.Generic. Threat score 100/100. 14/24 AV engines flagged this file. 12 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/cd732d10374e32f6ffb254fd765cb62b3be65b7a394ab4eca96fb37d5f7f83f1"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Crifi.Generic Sample cd732d10374e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample cd732d10374e…. Malware family: Crifi.Generic. Threat score 100/100. 14/24 AV engines flagged this file. 12 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5d","11",{}]]