26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 7c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample df5f1034f8c5… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample df5f1034f8c5…. Malware family: Crifi.Generic. Threat score 100/100. 14/25 AV engines flagged this file. 24 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae"],"about":{"@type":"SoftwareApplication","name":"3989b9cdb7533f6a4224d826075e7b68.exe","applicationCategory":["peexe","executable"],"identifier":"df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":14,"total":25},"behavioralIndicators":{"malicious":24,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T25c4,Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolder"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBeep"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")28:T486,"df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" called "FindResourceA" with parameter "398032" - (UID: 00000000-00005816) "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" called "FindResourceA" with parameter "398072" - (UID: 00000000-00005816) "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" called "FindResourceA" with parameter "398088" - (UID: 00000000-00005816) "DB3VT84.exe" called "FindResourceA" with parameter "13505356" - (UID: 00000000-00005980) "DB3VT84.exe" called "FindResourceA" with parameter "458024" - (UID: 00000000-00005980) "DB3VT84.exe" called "FindResourceA" with parameter "13505224" - (UID: 00000000-00005980) "DB3VT84.exe" called "FindResourceA" with parameter "13505232" - (UID: 00000000-00005980) "DB3VT84.exe" called "FindResourceA" with parameter "13505260" - (UID: 00000000-00005980) "DB3VT84.exe" called "FindResourceA" with parameter "13505272" - (UID: 00000000-00005980) "DB3VT84.exe" called "FindResourceA" with parameter "13505288" - (UID: 00000000-00005980) "1xv00Bc4.exe" called "FindResourceW" with parameter "200" - (UID: 00000000-00005708)29:Tabf,"df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '444528'}" (UID: 00000000-00005816) "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '444480'}" (UID: 00000000-00005816) "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '444432'}" (UID: 00000000-00005816) "DB3VT84.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13551584'}" (UID: 00000000-00005980) "DB3VT84.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13551696'}" (UID: 00000000-00005980) "DB3VT84.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13551728'}" (UID: 00000000-00005980) "DB3VT84.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13551712'}" (UID: 00000000-00005980) "DB3VT84.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13551680'}" (UID: 00000000-00005980) "DB3VT84.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13551632'}" (UID: 00000000-00005980) "1xv00Bc4.exe" called "LoadResource with parameter {'hModule': '13369344', 'hResInfo': '14239032'}" (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadResource with parameter {'hModule': '13369344', 'hResInfo': '14238856'}" (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadResource with parameter {'hModule': '13369344', 'hResInfo': '14239064'}" (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadResource with parameter {'hModule': '13369344', 'hResInfo': '14238712'}" (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadResource with parameter {'hModule': '13369344', 'hResInfo': '14239048'}" (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadResource with parameter {'hModule': '13369344', 'hResInfo': '14238728'}" (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadResource with parameter {'hModule': '13369344', 'hResInfo': '14238872'}" (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadResource with parameter {'hModule': '13369344', 'hResInfo': '14239080'}" (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadResource with parameter {'hModule': '13369344', 'hResInfo': '14238744'}" (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadResource with parameter {'hModule': '1850605568', 'hResInfo': '1850782216'}" (UID: 00000000-00005708) "AppLaunch.exe" called "LoadResource with parameter {'hModule': '1792081920', 'hResInfo': '1793122680'}" (UID: 00000000-00003492) "AppLaunch.exe" called "LoadResource with parameter {'hModule': '1792081920', 'hResInfo': '1793122664'}" (UID: 00000000-00003492)2a:T5af,Found reference to API "IOpenServiceManager" (Indicator: "OpenService"; Source: "00000000-00005708.00000000.76287.728F1000.00000020.mdmp") Found reference to API "IOpenServiceActivity" (Indicator: "OpenService"; Source: "00000000-00005708.00000000.76287.728F1000.00000020.mdmp") Found reference to API "IOpenServiceActivityManager" (Indicator: "OpenService"; Source: "00000000-00005708.00000000.76287.728F1000.00000020.mdmp") Found reference to API "IOpenServiceActivityOutputContext" (Indicator: "OpenService"; Source: "00000000-00005708.00000000.76287.728F1000.00000020.mdmp") Found reference to API "IOpenServiceActivityInput" (Indicator: "OpenService"; Source: "00000000-00005708.00000000.76287.728F1000.00000020.mdmp") Found reference to API "IOpenService" (Indicator: "OpenService"; Source: "00000000-00005708.00000000.76287.728F1000.00000020.mdmp") Found reference to API "IEnumOpenServiceActivity" (Indicator: "OpenService"; Source: "00000000-00005708.00000000.76287.728F1000.00000020.mdmp") Found reference to API "IOpenServiceActivityCategory" (Indicator: "OpenService"; Source: "00000000-00005708.00000000.76287.728F1000.00000020.mdmp") Found reference to API "IEnumOpenServiceActivityCategory" (Indicator: "OpenService"; Source: "00000000-00005708.00000000.76287.728F1000.00000020.mdmp") Found reference to API "IOpenServiceManagerInternal" (Indicator: "OpenService"; Source: "00000000-00005708.00000000.76287.728F1000.00000020.mdmp")2b:T6af,file/memory contains long string with (Indicator: "SHA384"; File: "2TW6263.exe") file/memory contains long string with (Indicator: "Oid"; File: "SSL") file/memory contains long string with (Indicator: "Aes"; File: "SSL") Found reference to "AesGcm256" (Indicator: "Aes"; File: "00003492.00000DA4.5540554.00402000.wprm") Found reference to "AesGcm256" (Indicator: "AesGcm"; File: "00003492.00000DA4.5540554.00402000.wprm") Found reference to "AesFastEngine" (Indicator: "Aes"; File: "00003492.00000DA4.5540554.00402000.wprm") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00003492.00000DA4.5540554.00402000.wprm") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00003492.00000DA4.5540554.00402000.wprm") Found reference to "AesGcm256" (Indicator: "Aes"; Source: "00000000-00002532.00000000.78734.003AD000.00000004.mdmp, 00000000-00002532.00000001.78771.003AD000.00000004.mdmp") Found reference to "AesGcm256" (Indicator: "AesGcm"; Source: "00000000-00002532.00000000.78734.003AD000.00000004.mdmp, 00000000-00002532.00000001.78771.003AD000.00000004.mdmp") Found reference to "AesFastEngine" (Indicator: "Aes"; Source: "00000000-00002532.00000000.78734.003AD000.00000004.mdmp, 00000000-00002532.00000001.78771.003AD000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002532.00000000.78734.003AD000.00000004.mdmp, 00000000-00002532.00000001.78771.003AD000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00002532.00000000.78734.003AD000.00000004.mdmp, 00000000-00002532.00000001.78771.003AD000.00000004.mdmp")2c:T1497,Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00005708-19217-8-00CE0A8C Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00005708-19217-8-00CE0A8C Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00005708-19217-8-00CE0A8C Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00005708-19217-8-00CE0A8C Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00005708-19217-8-00CE0A8C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-19217-38-00CF3264 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-19217-38-00CF3264 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00005708-19217-39-00CF2FD7 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00005708-19217-39-00CF2FD7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-19217-44-00CF320E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-19217-44-00CF320E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-19217-92-00CF2622 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-19217-92-00CF2622 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-19217-96-00CF5AA9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-19217-96-00CF5AA9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-19217-97-00CF56C4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-19217-97-00CF56C4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-19217-99-00CF5891 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-19217-99-00CF5891 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-19217-100-00CF57A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-19217-100-00CF57A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-19217-101-00CF542E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-19217-101-00CF542E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-19217-115-00CE4D6D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-19217-115-00CE4D6D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-19217-205-00CFD8C3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-19217-205-00CFD8C3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-19217-212-00CF61FE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-19217-212-00CF61FE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-19217-213-00CF3467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-19217-213-00CF3467 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00005708-19217-245-00CF676B Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00005708-19217-245-00CF676B Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00005708-19217-245-00CF676B Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00005708-19217-245-00CF676B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-19217-253-00CFAF88 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-19217-253-00CFAF88 Assembly shows XOR instruction xor esi dword ptr [00D90730h] in Stream UID: 00000000-00005708-19217-333-00CE01F8 Assembly shows XOR instruction xor esi dword ptr [00D9072Ch] in Stream UID: 00000000-00005708-19217-347-00CE02D6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-19217-374-00D01522 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-19217-374-00D01522 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-19217-375-00CF30EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-19217-375-00CF30EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-19217-397-00CFCB7C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-19217-397-00CFCB7C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-19217-400-00CFC827 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-19217-400-00CFC827 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-19217-418-00CF333F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-19217-418-00CF333F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-19217-431-00CF32BD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-19217-431-00CF32BD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005708-19217-436-00CF3395 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005708-19217-436-00CF33952d:T32ae,Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/oBFYYahzgVI" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/75r4ZyA3vA0" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/9UVbN0w5E6Y" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/we1/pl4XiTjSDSk" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/we1/G0k" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/x6Eg-8TSwUw.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we1/x6Eg-8TSwUw.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/x6Eg-8TSwUw.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /rootg2.cer HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crt.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /rootg2.cer HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crt.rootg2.amazontrust.com" Contains base64 string in header "/wr2/oQ6nyr8F0m0" in header "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "2BsKuKwH5CO65xMY" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com"2e:T41b,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to decrypt/decode data Matched sigs: Decrypted SSL network traffic Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to decode base64 data Matched sigs: Contains reference to crypto DLLs Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]2f:T3ceb,Found XOR loop in file "1xv00Bc4.exe" at offset 72323; code bytes = 30d0 Found XOR loop in file "1xv00Bc4.exe" at offset 122082; code bytes = 30d0 Found XOR loop in file "1xv00Bc4.exe" at offset 376916; code bytes = 30d0 Found XOR loop in file "1xv00Bc4.exe" at offset 376937; code bytes = 30d0 Found XOR loop in file "1xv00Bc4.exe" at offset 691258; code bytes = 30d0 Found XOR loop in file "1xv00Bc4.exe" at offset 887915; code bytes = 30d0 Found XOR loop in file "1xv00Bc4.exe" at offset 888929; code bytes = 30d0 Found XOR loop in file "1xv00Bc4.exe" at offset 891921; code bytes = 30d0 Found XOR loop in file "1xv00Bc4.exe" at offset 900833; code bytes = 30d0 Found XOR loop in file "1xv00Bc4.exe" at offset 913601; code bytes = 30d0 Found XOR loop in file "1xv00Bc4.exe" at offset 130790; code bytes = 33c1 Found XOR loop in file "1xv00Bc4.exe" at offset 140043; code bytes = 33c1 Found XOR loop in file "1xv00Bc4.exe" at offset 140172; code bytes = 33c1 Found XOR loop in file "1xv00Bc4.exe" at offset 351053; code bytes = 33c1 Found XOR loop in file "1xv00Bc4.exe" at offset 463773; code bytes = 33c1 Found XOR loop in file "1xv00Bc4.exe" at offset 463848; code bytes = 33c1 Found XOR loop in file "1xv00Bc4.exe" at offset 597022; code bytes = 33c1 Found XOR loop in file "1xv00Bc4.exe" at offset 701978; code bytes = 33c1 Found XOR loop in file "1xv00Bc4.exe" at offset 709317; code bytes = 33c1 Found XOR loop in file "1xv00Bc4.exe" at offset 709765; code bytes = 33c1 Found XOR loop in file "1xv00Bc4.exe" at offset 710341; code bytes = 33c1 Found XOR loop in file "1xv00Bc4.exe" at offset 710789; code bytes = 33c1 Found XOR loop in file "1xv00Bc4.exe" at offset 895349; code bytes = 33c1 Found XOR loop in file "1xv00Bc4.exe" at offset 905289; code bytes = 33c1 Found XOR loop in file "1xv00Bc4.exe" at offset 1330; code bytes = 8030 Found XOR loop in file "1xv00Bc4.exe" at offset 1959; code bytes = 8030 Found XOR loop in file "1xv00Bc4.exe" at offset 232120; code bytes = 8030 Found XOR loop in file "1xv00Bc4.exe" at offset 356589; code bytes = 8030 Found XOR loop in file "1xv00Bc4.exe" at offset 674772; code bytes = 8030 Found XOR loop in file "1xv00Bc4.exe" at offset 687130; code bytes = 8030 Found XOR loop in file "1xv00Bc4.exe" at offset 887876; code bytes = 8030 Found XOR loop in file "1xv00Bc4.exe" at offset 890824; code bytes = 8030 Found XOR loop in file "1xv00Bc4.exe" at offset 894056; code bytes = 8030 Found XOR loop in file "1xv00Bc4.exe" at offset 913562; code bytes = 8030 Found XOR loop in file "DB3VT84.exe" at offset 31749; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 31829; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 31853; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 31973; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32037; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32101; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32229; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32253; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32277; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32301; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32325; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32349; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32373; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32397; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32421; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32445; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32469; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32493; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32517; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32541; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32565; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32589; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32613; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32637; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32661; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32685; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32709; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32733; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32757; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32781; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32805; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32829; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32853; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32877; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32901; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32925; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32949; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32973; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 32997; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 33021; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 33045; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 33069; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 33093; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 33117; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 33141; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 33165; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 33189; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 33213; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 33237; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 33261; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 33285; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 33309; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 159610; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 205029; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 227429; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 249204; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 429904; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 452208; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 525780; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 553985; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 563712; code bytes = 30d0 Found XOR loop in file "DB3VT84.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "DB3VT84.exe" at offset 243520; code bytes = 33c1 Found XOR loop in file "DB3VT84.exe" at offset 291751; code bytes = 33c1 Found XOR loop in file "DB3VT84.exe" at offset 299787; code bytes = 33c1 Found XOR loop in file "DB3VT84.exe" at offset 342225; code bytes = 33c1 Found XOR loop in file "DB3VT84.exe" at offset 438244; code bytes = 33c1 Found XOR loop in file "DB3VT84.exe" at offset 438699; code bytes = 33c1 Found XOR loop in file "DB3VT84.exe" at offset 503844; code bytes = 33c1 Found XOR loop in file "DB3VT84.exe" at offset 606598; code bytes = 33c1 Found XOR loop in file "DB3VT84.exe" at offset 689081; code bytes = 33c1 Found XOR loop in file "DB3VT84.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "DB3VT84.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "DB3VT84.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "DB3VT84.exe" at offset 200430; code bytes = 8030 Found XOR loop in file "DB3VT84.exe" at offset 381056; code bytes = 8030 Found XOR loop in file "DB3VT84.exe" at offset 563226; code bytes = 8030 Found XOR loop in file "DB3VT84.exe" at offset 587090; code bytes = 8030 Found XOR loop in file "DB3VT84.exe" at offset 655062; code bytes = 8030 Found XOR loop in file "DB3VT84.exe" at offset 657013; code bytes = 8030 Found XOR loop in file "3oJ78sj.exe" at offset 8212; code bytes = 30d0 Found XOR loop in file "3oJ78sj.exe" at offset 8477; code bytes = 30d0 Found XOR loop in file "3oJ78sj.exe" at offset 8495; code bytes = 30d0 Found XOR loop in file "3oJ78sj.exe" at offset 8525; code bytes = 30d0 Found XOR loop in file "3oJ78sj.exe" at offset 8572; code bytes = 30d0 Found XOR loop in file "3oJ78sj.exe" at offset 8590; code bytes = 30d0 Found XOR loop in file "3oJ78sj.exe" at offset 8613; code bytes = 30d0 Found XOR loop in file "3oJ78sj.exe" at offset 8647; code bytes = 30d0 Found XOR loop in file "3oJ78sj.exe" at offset 8740; code bytes = 30d0 Found XOR loop in file "3oJ78sj.exe" at offset 8789; code bytes = 30d0 Found XOR loop in file "3oJ78sj.exe" at offset 9398; code bytes = 30d0 Found XOR loop in file "3oJ78sj.exe" at offset 10168; code bytes = 30d0 Found XOR loop in file "3oJ78sj.exe" at offset 10288; code bytes = 30d0 Found XOR loop in file "3oJ78sj.exe" at offset 345315; code bytes = 30d0 Found XOR loop in file "3oJ78sj.exe" at offset 3022; code bytes = 33c1 Found XOR loop in file "3oJ78sj.exe" at offset 3127; code bytes = 33c1 Found XOR loop in file "3oJ78sj.exe" at offset 7374; code bytes = 33c1 Found XOR loop in file "3oJ78sj.exe" at offset 10938; code bytes = 33c1 Found XOR loop in file "3oJ78sj.exe" at offset 146; code bytes = 8030 Found XOR loop in file "3oJ78sj.exe" at offset 178; code bytes = 8030 Found XOR loop in file "3oJ78sj.exe" at offset 345296; code bytes = 8030 Found XOR loop in file "3oJ78sj.exe" at offset 347072; code bytes = 8030 Found XOR loop in file "3oJ78sj.exe" at offset 350341; code bytes = 8030 Found XOR loop in file "3oJ78sj.exe" at offset 353006; code bytes = 8030 Found XOR loop in file "3oJ78sj.exe" at offset 353253; code bytes = 8030 Found XOR loop in file "2TW6263.exe" at offset 8228; code bytes = 30d0 Found XOR loop in file "2TW6263.exe" at offset 8493; code bytes = 30d0 Found XOR loop in file "2TW6263.exe" at offset 8511; code bytes = 30d0 Found XOR loop in file "2TW6263.exe" at offset 8541; code bytes = 30d0 Found XOR loop in file "2TW6263.exe" at offset 8588; code bytes = 30d0 Found XOR loop in file "2TW6263.exe" at offset 8606; code bytes = 30d0 Found XOR loop in file "2TW6263.exe" at offset 8629; code bytes = 30d0 Found XOR loop in file "2TW6263.exe" at offset 8663; code bytes = 30d0 Found XOR loop in file "2TW6263.exe" at offset 8756; code bytes = 30d0 Found XOR loop in file "2TW6263.exe" at offset 8805; code bytes = 30d0 Found XOR loop in file "2TW6263.exe" at offset 9414; code bytes = 30d0 Found XOR loop in file "2TW6263.exe" at offset 10184; code bytes = 30d0 Found XOR loop in file "2TW6263.exe" at offset 10304; code bytes = 30d0 Found XOR loop in file "2TW6263.exe" at offset 304185; code bytes = 30d0 Found XOR loop in file "2TW6263.exe" at offset 304447; code bytes = 30d0 Found XOR loop in file "2TW6263.exe" at offset 305383; code bytes = 30d0 Found XOR loop in file "2TW6263.exe" at offset 3028; code bytes = 33c1 Found XOR loop in file "2TW6263.exe" at offset 3133; code bytes = 33c1 Found XOR loop in file "2TW6263.exe" at offset 7390; code bytes = 33c1 Found XOR loop in file "2TW6263.exe" at offset 10954; code bytes = 33c1 Found XOR loop in file "2TW6263.exe" at offset 146; code bytes = 8030 Found XOR loop in file "2TW6263.exe" at offset 178; code bytes = 8030 Found XOR loop in file "2TW6263.exe" at offset 305364; code bytes = 8030 Found XOR loop in file "2TW6263.exe" at offset 307140; code bytes = 8030 Found XOR loop in file "2TW6263.exe" at offset 310405; code bytes = 8030 Found XOR loop in file "2TW6263.exe" at offset 313070; code bytes = 8030 Found XOR loop in file "2TW6263.exe" at offset 313317; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6AA76FB6.bin" at offset 76665; code bytes = 30d0 Found XOR loop in file "DISMHOST.EXE.6AA76FB6.bin" at offset 77648; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6AA76FB6.bin" at offset 77788; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6AA76FB6.bin" at offset 78978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 254037; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 300827; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 323227; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 345010; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 525807; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 548111; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 621724; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 649945; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 659680; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 877991; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 26031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 161883; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 284793; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 339326; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 387582; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 395626; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 438088; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 534147; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 534602; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 599780; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 702590; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 790032; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 813978; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 923819; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 938425; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 90891; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 102399; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 103104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 278292; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 286760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 476927; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 659194; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 683058; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 751062; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 753021; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 809151; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 810172; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 819379; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 855290; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 859581; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 862713; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 910422; code bytes = 803030:T425,file/memory contains long string with (Indicator: "youtube.com"; File: "supported_browsers_1_.htm") file/memory contains long string with (Indicator: "youtube.com"; File: "TF6YGQUA.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "TF92N9KU.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "I00VQ1DZ.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "VVQWRVO3.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "4NIXQKYW.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "3UW5971G.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube.com"; File: "EQ60QSZ4.txt") Found string "accounts.youtube.com" (Indicator: "youtube.com"; File: "PCAP") Found string "www.paypal.com" (Indicator: "paypal.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube.com"; File: "PCAP") file/memory contains long string with (Indicator: "youtube.com"; File: "SSL")31:T7ef,file/memory contains long string with (Indicator: "GetCommandLine"; File: "2TW6263.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "DISMHOST.EXE.6AA76FB6.bin") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00002532.00000000.78734.003AD000.00000004.mdmp, 00000000-00002532.00000001.78771.003AD000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002532.00000001.78771.003A5000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002532.00000001.78771.003A5000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003124.00000000.86915.00DF1000.00000020.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003948.00000000.78374.00DAD000.00000004.mdmp, 00000000-00003948.00000001.78403.00DA5000.00000002.mdmp, 00000000-00003948.00000001.78403.00DAD000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003948.00000000.78374.00DAD000.00000004.mdmp, 00000000-00003948.00000001.78403.00DA5000.00000002.mdmp, 00000000-00003948.00000001.78403.00DAD000.00000004.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp")32:T454,Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "00000000-00005708.00000001.78045.00CC1000.00000020.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "00000000-00005708.00000001.78045.00CC1000.00000020.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp")33:T340a,"df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005816) "DB3VT84.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005980) "DB3VT84.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005980) "1xv00Bc4.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005708) "1xv00Bc4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005708) "1xv00Bc4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000084df920290df920258e1920292e0226b2d7bdfdffeffffffd8e0920216bc216b9ec40f02020000000ce09202d8e0920220bc216b0600000000006969010000002fbc216b2a000000060000009ec40f0202000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005708) "1xv00Bc4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000014e19202000000007600000064e19202feffffffece09202cf002c77d6002c775074b375760000003b00000064e1920200000000c0e092020000000028e1920295e12777a4920a00feffffffd6002c772f7b19750100000050006006167b19754c1800b6 (UID: 00000000-00005708) "1xv00Bc4.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005708) "1xv00Bc4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000003000000e4dd7f03f0dd7f03b8df7f0392e0226b2d7bdfdffeffffff38df7f0316bc216bc011ebc3030000006cde7f0338df7f0320bc216b8205000000006969010000002fbc216b2a00000082050000c011ebc303000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005708) "1xv00Bc4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000004e4990210e49902d8e5990292e0226b2d7bdfdffeffffff58e5990216bc216b8a86fd40050000008ce4990258e5990220bc216b8205000000006969010000002fbc216b2a000000820500008a86fd4005000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005708) "1xv00Bc4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000004e1970210e19702d8e2970292e0226b2d7bdfdffeffffff58e2970216bc216b68c96bae060000008ce1970258e2970220bc216b8205000000006969010000002fbc216b2a0000008205000068c96bae06000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005708) "1xv00Bc4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000003000000e4e09902f0e09902b8e2990292e0226b2d7bdfdffeffffff38e2990216bc216b4e52fea3080000006ce1990238e2990220bc216b8205000000006969010000002fbc216b2a000000820500004e52fea308000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005708) "1xv00Bc4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000014de7f0320de7f03e8df7f0392e0226b2d7bdfdffeffffff68df7f0316bc216b1010c11b0a0000009cde7f0368df7f0320bc216b8205000000006969010000002fbc216b2a000000820500001010c11b0a000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005708) "1xv00Bc4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000094e39b02a0e39b0268e59b0292e0226b2d7bdfdffeffffffe8e49b0216bc216bda21f67a0b0000001ce49b02e8e49b0220bc216b8205000000006969010000002fbc216b2a00000082050000da21f67a0b000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005708) "1xv00Bc4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000064e0960270e0960238e2960292e0226b2d7bdfdffeffffffb8e1960216bc216bba39d9290d000000ece09602b8e1960220bc216b8205000000006969010000002fbc216b2a00000082050000ba39d9290d000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005708) "1xv00Bc4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000003000000c4de7903d0de790398e0790392e0226b2d7bdfdffeffffff18e0790316bc216bbc97b6da0e0000004cdf790318e0790320bc216b8205000000006969010000002fbc216b2a00000082050000bc97b6da0e000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005708) "1xv00Bc4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000024df940230df9402f8e0940292e0226b2d7bdfdffeffffff78e0940216bc216bee97cf8c10000000acdf940278e0940220bc216b8205000000006969010000002fbc216b2a00000082050000ee97cf8c10000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00005708) "2TW6263.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003948) "3oJ78sj.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002532) "3oJ78sj.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002532) "AppLaunch.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003492)34:T468,"1xv00Bc4.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005708) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000088ae2e001000000028ed2e000100000003000000010000000c00000000000000000000000000000001000000010000000000000000000000690070007400730000000000000000000000000000000000010000002f0000000000000000000000570053005c0041007000700044006100 (UID: 00000000-00003492) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000000000000000000000000000000000000000000b2f42b7748d50777aceb260000009371000093710000000000000000f0000000f00093710000000018eb260000000000acec260000000000010000007ceb260040f52b77000000000000000068eb2600 (UID: 00000000-00003492)35:T4f5,"df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "DB3VT84.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "DB3VT84.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1xv00Bc4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1xv00Bc4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "2TW6263.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2TW6263.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "3oJ78sj.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3oJ78sj.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")36:Ta52,Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; File: "00003492.00000DA4.5540554.00402000.wprm") Found reference to API "FindWindow" (Indicator: "FindWindow"; File: "00003492.00000DA4.5540554.00402000.wprm") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00002532.00000000.78734.003AD000.00000004.mdmp, 00000000-00002532.00000001.78771.003AD000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "FindWindow"; Source: "00000000-00002532.00000000.78734.003AD000.00000004.mdmp, 00000000-00002532.00000001.78771.003AD000.00000004.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00005708.00000000.76287.728F1000.00000020.mdmp, 00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp")37:T5f3,GetProcessHeap@KERNEL32.DLL at 00000000-00005708-19217-1603-00D20B62 GetProcessHeap@KERNEL32.DLL at 00000000-00005708-19217-1604-00D2115F GetProcessHeap@KERNEL32.DLL at 00000000-00005708-19217-1605-00D21193 GetProcessHeap@KERNEL32.DLL at 00000000-00005708-19217-1606-00D210F9 GetProcessHeap@KERNEL32.DLL at 00000000-00005708-19217-1607-00D20D8B GetProcessHeap@KERNEL32.DLL at 00000000-00005708-19217-1608-00D20FB4 GetProcessHeap@KERNEL32.DLL at 00000000-00005708-19217-1609-00D21014 GetProcessHeap@KERNEL32.DLL at 00000000-00005708-19217-1612-00D21571 OpenProcessToken@ADVAPI32.DLL at 00000000-00005708-19217-1614-00D2162B GetProcessHeap@KERNEL32.DLL at 00000000-00005708-19217-1615-00D21201 GetProcessHeap@KERNEL32.DLL at 00000000-00005708-19217-1616-00D21803 GetProcessHeap@KERNEL32.DLL at 00000000-00005708-19217-1617-00D2175D OpenProcessToken@ADVAPI32.DLL at 00000000-00005708-19217-1619-00D214CE GetProcessHeap@KERNEL32.DLL at 00000000-00005708-19217-1620-00D21874 OpenProcess@KERNEL32.DLL at 00000000-00005708-19217-1641-00D2B32A OpenProcess@KERNEL32.DLL at 00000000-00005708-19217-1867-00D2EB20 OpenProcess@KERNEL32.DLL at 00000000-00005708-19217-2268-00D4A0E2 OpenProcess@KERNEL32.DLL at 00000000-00005708-19217-2270-00D4A387 OpenProcess@KERNEL32.DLL at 00000000-00005708-19217-2273-00D4A8A3 OpenProcess@KERNEL32.DLL at 00000000-00005708-19217-2276-00D4AA6C GetProcessHeap@KERNEL32.DLL at 00000000-00005708-19217-3454-00CFD1DB GetProcessHeap@KERNEL32.DLL at 00000000-00002532-29414-867-0039D74238:T4b7,"AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00003492-0000010C-648136 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00003492-0000010C-2178315 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00003492-0000010C-2183370 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00003492-0000010C-2960113 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00003492-0000010C-2964061 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003492-0000010C-329497339:T41a,file/memory contains long string(File: "2TW6263.exe") file/memory contains long string(File: "DISMHOST.EXE.6AA76FB6.bin") Found string "GetCommandLineA" (Source: "00000000-00002532.00000001.78771.003A5000.00000002.mdmp") Found string "GetCommandLineW" (Source: "00000000-00002532.00000001.78771.003A5000.00000002.mdmp") Found string "GetCommandLineW" (Source: "00000000-00003124.00000000.86915.00DF1000.00000020.mdmp") Found string "GetCommandLineA" (Source: "00000000-00003948.00000000.78374.00DAD000.00000004.mdmp, 00000000-00003948.00000001.78403.00DA5000.00000002.mdmp, 00000000-00003948.00000001.78403.00DAD000.00000004.mdmp") Found string "GetCommandLineW" (Source: "00000000-00003948.00000000.78374.00DAD000.00000004.mdmp, 00000000-00003948.00000001.78403.00DA5000.00000002.mdmp, 00000000-00003948.00000001.78403.00DAD000.00000004.mdmp") Found string "GetCommandLineA" (Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found string "GetCommandLineW" (Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp")3a:T438,Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002532.00000001.78771.003A5000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003124.00000000.86915.00DF1000.00000020.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003948.00000000.78374.00DAD000.00000004.mdmp, 00000000-00003948.00000001.78403.00DA5000.00000002.mdmp, 00000000-00003948.00000001.78403.00DAD000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp")3b:T2b90,"df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005816) "DB3VT84.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00005980) "DB3VT84.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005980) "1xv00Bc4.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00005708) "1xv00Bc4.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00005708) "2TW6263.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003948) "3oJ78sj.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002532) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003492) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00003492)3c:T85ae,"df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005816) "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005816) "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005816) "DB3VT84.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00005980) "DB3VT84.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005980) "DB3VT84.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005980) "DB3VT84.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005980) "DB3VT84.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005980) "DB3VT84.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00005980) "DB3VT84.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00005980) "DB3VT84.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005980) "1xv00Bc4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter SendMessageTimeoutW (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00005708) "1xv00Bc4.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005708) "2TW6263.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003948) "2TW6263.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003948) "3oJ78sj.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002532) "3oJ78sj.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002532) "3oJ78sj.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002532) "3oJ78sj.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002532) "3oJ78sj.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002532) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003492) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003492)3d:T5a1,WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005708-19217-347-00CE02D6 Sleep@KERNEL32.DLL at 00000000-00005708-19217-521-00CCD760 Sleep@KERNEL32.DLL at 00000000-00005708-19217-541-00D579AB Sleep@KERNEL32.DLL at 00000000-00005708-19217-548-00D2BE52 Sleep@KERNEL32.DLL at 00000000-00005708-19217-745-00D2E97B WaitForSingleObject@KERNEL32.DLL at 00000000-00005708-19217-753-00D3096B WaitForSingleObject@KERNEL32.DLL at 00000000-00005708-19217-756-00D3D2E7 SetTimer at 00000000-00005708-19217-1208-00CC3170 Sleep@KERNEL32.DLL at 00000000-00005708-19217-1211-00D2BF30 SetTimer at 00000000-00005708-19217-1215-00D2C161 SetTimer at 00000000-00005708-19217-1254-00CD8891 Sleep@KERNEL32.DLL at 00000000-00005708-19217-1349-00CDF291 Sleep@KERNEL32.DLL at 00000000-00005708-19217-1396-00CDF645 WaitForSingleObject@KERNEL32.DLL at 00000000-00005708-19217-1620-00D21874 Sleep@KERNEL32.DLL at 00000000-00005708-19217-1622-00D21901 Sleep@KERNEL32.DLL at 00000000-00005708-19217-1649-00D225A2 SetTimer at 00000000-00005708-19217-1710-00D25A1B Sleep@KERNEL32.DLL at 00000000-00005708-19217-1796-00D29C49 WaitForSingleObject@KERNEL32.DLL at 00000000-00005708-19217-1855-00D2E1D6 Sleep@KERNEL32.DLL at 00000000-00005708-19217-1862-00D2E6B0 Sleep@KERNEL32.DLL at 00000000-00005708-19217-1909-00D39B2B Sleep@KERNEL32.DLL at 00000000-00005708-19217-1919-00D3503F WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00002532-29414-176-00391A4D3e:T6fc,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002532.00000001.78771.003A5000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002532.00000001.78771.003A5000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003124.00000000.86915.00DF1000.00000020.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00003124.00000000.86915.00DF1000.00000020.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003948.00000000.78374.00DAD000.00000004.mdmp, 00000000-00003948.00000001.78403.00DA5000.00000002.mdmp, 00000000-00003948.00000001.78403.00DAD000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003948.00000000.78374.00DAD000.00000004.mdmp, 00000000-00003948.00000001.78403.00DA5000.00000002.mdmp, 00000000-00003948.00000001.78403.00DAD000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp")3f:T85b,Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\UpdatingNewTabPageData" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_5696" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1640_IE_EarlyTabStart_0x16ac_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1640_ConnHashTable<5696>_HashTable_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1640_IESQMMUTEX_0_303" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1640_IESQMMUTEX_0_331" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1640_IESQMMUTEX_0_519" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_1640_IESQMMUTEX_0_274" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\MSIMGSIZECacheMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\https://www.epicgames.com/" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\InternetExplorerDOMStoreQuota"40:T8b4,"1xv00Bc4.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "1xv00Bc4.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "2TW6263.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "3oJ78sj.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135]41:T86a,Found string "paypalcomsignin" (Indicator: "paypal"; File: "screen_3.png") file/memory contains long string with (Indicator: "youtube"; File: "~DF7FD0EA4A5956D396.TMP") file/memory contains long string with (Indicator: "youtube"; File: "~DFA01BC1773CAAA4E3.TMP") file/memory contains long string with (Indicator: "youtube"; File: "TF6YGQUA.txt") file/memory contains long string with (Indicator: "youtube"; File: "TF92N9KU.txt") file/memory contains long string with (Indicator: "youtube"; File: "I00VQ1DZ.txt") file/memory contains long string with (Indicator: "youtube"; File: "VVQWRVO3.txt") file/memory contains long string with (Indicator: "youtube"; File: "4NIXQKYW.txt") file/memory contains long string with (Indicator: "youtube"; File: "3UW5971G.txt") Found string "09RP4LsIvoRaICv1i..Bqp0-i..AAA.0.0.Bqp0-i.AWfdXcSloI0QAk02hl7tHXJ8Zwcfacebook.com/9217165968204831296162201594871431278057ok-nap9dTnw28diodi9KACUbfacebook.com/9217320413619231358523201594871431278057" (Indicator: "facebook.com"; File: "FDF9HQI3.txt") Found string "09RP4LsIvoRaICv1i..Bqp0-i..AAA.0.0.Bqp0-i.AWfdXcSloI0QAk02hl7tHXJ8Zwcfacebook.com/9217165968204831296162201594871431278057" (Indicator: "facebook.com"; File: "G3E4Z2ZY.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "EQ60QSZ4.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "twitter.com" (Indicator: "twitter"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.paypal.com" (Indicator: "paypal"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") file/memory contains long string with (Indicator: "youtube"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive" (Indicator: "facebook.com"; File: "SSL") file/memory contains long string with (Indicator: "facebook.com"; File: "SSL")42:T8b7,"REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002532.00000001.78771.000A0000.00000004.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003124.00000000.86915.00DF1000.00000020.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003948.00000000.78374.00510000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003948.00000001.78403.00510000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005708.00000000.76287.007C0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005708.00000000.76287.007C0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing" in Source: 00000000-00005708.00000001.78045.00832000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005708.00000001.78045.00832000.00000004.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00005708.00000001.78045.00D5C000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00005708.00000001.78045.00D5C000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00005708.00000001.78045.00D5C000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005816.00000000.76171.00061000.00000020.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005816.00000000.76171.00310000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005816.00000002.78780.00310000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00005980.00000001.78159.00CE1000.00000020.mdmp43:T406b,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.cn" Response ==> HTTP/1.1 200 OK Server: Tengine Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Date: Mon 14 Sep 2026 00:36:36 GMT Cache-Control: max-age=7200 X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-DC-POP: dub-004 Via: ens-cache24.l2us5[189 188 200-0 M] ens-cache10.l2us5[190 0] ens-cache10.us37[0 0 200-0 H] ens-cache12.us37[1 0] Age: 3597 Ali-Swift-Global-Savetime: 1789346196 X-Cache: HIT TCP_MEM_HIT dirn:-2:-2 X-Swift-SaveTime: Mon 14 Sep 2026 00:36:36 GMT X-Swift-CacheTime: 3600 Timing-Allow-Origin: * EagleId: 9b6682a017893497932613271e with response body ==>30C28201C3930A0100C2A0C28201C38C30C28201C38806092B060105050730010104C28201C2B930C28201C2B530C281C29EC2A2160414C2B13EC3836903C3B8....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/sytroprc:52:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=sytroprc:52:0 Report-To: {"group":"sytroprc:52:0" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/sytroprc:52:0"}] } Server: scaffolding on HTTPServer2 Content-Length: 1446 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sun 13 Sep 2026 22:22:37 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 11638 with response body ==>30C28205C2A20A0100C2A0C28205C29B30C28205C29706092B060105050730010104C28205C28830C28205C28430C281C29EC2A2160414C3BCC2B709C3AA4D79....... "GET /r/r1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 993 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 14 Sep 2026 01:26:35 GMT Expires: Mon 14 Sep 2026 02:16:35 GMT Cache-Control: public max-age=3000 Age: 600 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C28203C39D30C28201C385020101300D06092AC28648C286C3B70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C....... "GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 62399 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 14 Sep 2026 01:23:46 GMT Expires: Mon 14 Sep 2026 02:13:46 GMT Cache-Control: public max-age=3000 Last-Modified: Mon 14 Sep 2026 01:13:45 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 769 with response body ==>30C282C3B3C2BB30C282C3B2C2A3020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F....... "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 63370 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 14 Sep 2026 01:05:17 GMT Expires: Mon 14 Sep 2026 01:55:17 GMT Cache-Control: public max-age=3000 Last-Modified: Mon 14 Sep 2026 00:17:34 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 1879 with response body ==>30C282C3B7C28630C282C3B66E020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F67....... "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 60735 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 14 Sep 2026 01:01:35 GMT Expires: Mon 14 Sep 2026 01:51:35 GMT Cache-Control: public max-age=3000 Age: 2103 Last-Modified: Sun 13 Sep 2026 23:02:56 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282C3AD3B30C282C3AC23020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F676C....... "GET /r/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1871 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 14 Sep 2026 00:46:55 GMT Expires: Mon 14 Sep 2026 01:36:55 GMT Cache-Control: public max-age=3000 Age: 2990 Last-Modified: Mon 31 Aug 2026 08:08:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282074B30C2820633020101300D06092AC28648C286C3B70D01010B05003057310B300906035504061302424531193017060355040A1310476C6F62616C53....... "GET /r/r4.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 528 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 14 Sep 2026 01:23:27 GMT Expires: Mon 14 Sep 2026 02:13:27 GMT Cache-Control: public max-age=3000 Age: 798 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282020C30C28201C293020101300A06082AC28648C38E3D0403033047310B300906035504061302555331223020060355040A1319476F6F676C6520547275....... "GET /we1/pl4XiTjSDSk.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 454 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 14 Sep 2026 00:55:49 GMT Expires: Mon 14 Sep 2026 01:45:49 GMT Cache-Control: public max-age=3000 Age: 2456 Last-Modified: Sun 13 Sep 2026 22:13:36 GMT Content-Type: application/pkix-crl with response body ==>30C28201C38230C2820168020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C6520547275....... "GET /we1/G0k-BqpOX8k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 346 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 14 Sep 2026 00:55:40 GMT Expires: Mon 14 Sep 2026 01:45:40 GMT Cache-Control: public max-age=3000 Last-Modified: Mon 14 Sep 2026 00:34:53 GMT Content-Type: application/pkix-crl Age: 2466 with response body ==>30C282015630C281C3BE020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C652054727573....... "GET /we1/x6Eg-8TSwUw.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 309 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 14 Sep 2026 00:50:10 GMT Expires: Mon 14 Sep 2026 01:40:10 GMT Cache-Control: public max-age=3000 Age: 2796 Last-Modified: Sun 13 Sep 2026 21:53:43 GMT Content-Type: application/pkix-crl with response body ==>30C282013130C281C398020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C652054727573....... "GET /rootg2.cer HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crt.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 1145 Connection: keep-alive Date: Sun 13 Sep 2026 22:17:30 GMT Last-Modified: Fri 11 Sep 2026 01:18:20 GMT ETag: "c6150925cfea5941ddc7ff2a0a506692" x-amz-server-side-encryption: AES256 x-amz-version-id: Lv9t7Qwuz1t60a5irHqs9RMrlIG0r7Xw Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 3235d194bb862aa113227c9680bce62c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P5 X-Amz-Cf-Id: H6_1rHnqYdG4fXe3YlTz27GMUFG8vu9F8dKruTeiPkY6blmkij8zAA== Age: 11958 with response body ==>30C282047530C282035DC2A003020102020900C2A70E4A4C34C282C2B77F300D06092AC28648C286C3B70D01010B05003068310B300906035504061302555331....... "GET /rootg2.cer HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crt.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 1145 Connection: keep-alive Date: Sun 13 Sep 2026 22:17:30 GMT Last-Modified: Fri 11 Sep 2026 01:18:20 GMT ETag: "c6150925cfea5941ddc7ff2a0a506692" x-amz-server-side-encryption: AES256 x-amz-version-id: Lv9t7Qwuz1t60a5irHqs9RMrlIG0r7Xw Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 891301f67eeb14db1b941c87f006cfaa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P5 X-Amz-Cf-Id: p-TaNXxqjWsfoui9QN0SM52obPCbvA-QVxGPVDFSJgXePnkDnVkVdw== Age: 11958 with response body ==>30C282047530C282035DC2A003020102020900C2A70E4A4C34C282C2B77F300D06092AC28648C286C3B70D01010B05003068310B300906035504061302555331....... "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 64196 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 14 Sep 2026 01:09:51 GMT Expires: Mon 14 Sep 2026 01:59:51 GMT Cache-Control: public max-age=3000 Age: 1622 Last-Modified: Sun 13 Sep 2026 23:18:20 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282C3BAC38030C282C3B9C2A8020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1560 Connection: keep-alive Date: Mon 14 Sep 2026 00:58:41 GMT x-amzn-RequestId: 5464deac-6e82-4be9-91d8-86840fc1a6fa Last-Modified: Mon 14 Sep 2026 00:57:57 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Expires: Sun 20 Sep 2026 23:57:57 GMT ETag: 63382992f72936ab056dce635cc7bedfd1e0dc5f X-Cache: Hit from cloudfront Via: 1.1 3b596e6534b28f6cf60d32fc6bf542dc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P7 X-Amz-Cf-Id: B7KmBFk03TpDRcJEOBzwnmGpFt8aAouEwbui1SpbHcYPpQZNVYBUtA== Age: 2292 with response body ==>30C28206140A0100C2A0C282060D30C282060906092B060105050730010104C28205C3BA30C28205C3B630C281C3A1C2A1563054310B30090603550406130255....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1438 Connection: keep-alive Date: Mon 14 Sep 2026 00:45:21 GMT x-amzn-RequestId: 085f13d7-a791-424a-a696-2807f062eb0e Last-Modified: Mon 14 Sep 2026 00:44:14 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Expires: Sun 20 Sep 2026 23:44:14 GMT ETag: 4fff4b252849627300faaa855a65a604c890084f X-Cache: Hit from cloudfront Via: 1.1 d0abe8e02f00bbb3378a9a4149801740.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P7 X-Amz-Cf-Id: MyHlfnJwX1aG8YWK2YW7Cmtr7cTXjQxm92L4_QN2jR6392aPYyggQQ== Age: 3093 with response body ==>30C28205C29A0A0100C2A0C28205C29330C28205C28F06092B060105050730010104C28205C28030C282057C30C281C394C2A1493047310B3009060355040613....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.r2m04.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Date: Mon 14 Sep 2026 00:04:31 GMT CF-RAY: a3ab227d1a9791fa-IAD Cache-Control: max-age=7200 Accept-Ranges: bytes Last-Modified: Mon 14 Sep 2026 00:04:31 GMT cf-cache-status: MISS Server: cloudflare X-Cache: Hit from cloudfront Via: 1.1 cf55dc262383279ff1977e7e1c14ddfa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P16 X-Amz-Cf-Id: VLopK9nHTjeSVFjka0TgYRiU5iWlKBoJt4lutADgrMsVZV84WCoYUw== Age: 5543 with response body ==>30C28201C3930A0100C2A0C28201C38C30C28201C38806092B060105050730010104C28201C2B930C28201C2B530C281C29EC2A21604141F52C2926156C28254.......44:T1d83,"df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 71d80000 "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75010000 "DB3VT84.exe" loaded module "FECLIENT.DLL" at base 727c0000 "DB3VT84.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 71c20000 "DB3VT84.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75010000 "1xv00Bc4.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 71180000 "1xv00Bc4.exe" loaded module "DWMAPI.DLL" at base 73c70000 "1xv00Bc4.exe" loaded module "COMCTL32.DLL" at base 74030000 "1xv00Bc4.exe" loaded module "KERNEL32.DLL" at base 75ae0000 "1xv00Bc4.exe" loaded module "UXTHEME.DLL" at base 73c20000 "1xv00Bc4.exe" loaded module "IMM32.DLL" at base 75c70000 "1xv00Bc4.exe" loaded module "COMCTL32" at base 74030000 "1xv00Bc4.exe" loaded module "SHELL32.DLL" at base 75fe0000 "1xv00Bc4.exe" loaded module "OLE32.DLL" at base 76ff0000 "1xv00Bc4.exe" loaded module "ADVAPI32.DLL" at base 759d0000 "1xv00Bc4.exe" loaded module "PROPSYS.DLL" at base 73da0000 "1xv00Bc4.exe" loaded module "OLEAUT32.DLL" at base 75cd0000 "1xv00Bc4.exe" loaded module "APPHELP.DLL" at base 75010000 "1xv00Bc4.exe" loaded module "CLBCATQ.DLL" at base 771d0000 "1xv00Bc4.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 69690000 "1xv00Bc4.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75250000 "1xv00Bc4.exe" loaded module "URLMON.DLL" at base 75880000 "1xv00Bc4.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 728e0000 "1xv00Bc4.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73da0000 "1xv00Bc4.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 728f0000 "1xv00Bc4.exe" loaded module "IERTUTIL.DLL" at base 76db0000 "1xv00Bc4.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75fe0000 "1xv00Bc4.exe" loaded module "USER32.DLL" at base 76ce0000 "1xv00Bc4.exe" loaded module "SETUPAPI.DLL" at base 75d70000 "1xv00Bc4.exe" loaded module "RPCRT4.DLL" at base 75520000 "1xv00Bc4.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75010000 "2TW6263.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75010000 "3oJ78sj.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 71180000 "3oJ78sj.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75010000 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 6b830000 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 773b0000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 75520000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 75ae0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 61420000 "AppLaunch.exe" loaded module "OLE32.DLL" at base 76ff0000 "AppLaunch.exe" loaded module "CRYPTBASE.DLL" at base 75060000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73c20000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 727c0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6aa90000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 609c0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 65130000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 5fb50000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 759d0000 "AppLaunch.exe" loaded module "UXTHEME.DLL" at base 73c20000 "AppLaunch.exe" loaded module "USER32.DLL" at base 76ce0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 5f330000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6a500000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 5ebb0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 71160000 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 77260000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 75fe0000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75500000 "AppLaunch.exe" loaded module "PROFAPI.DLL" at base 75170000 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 74c80000 "AppLaunch.exe" loaded module "CRYPTSP.DLL" at base 74b70000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74900000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 75c70000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 71930000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 76c30000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 5e790000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 5db50000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5c760000 "AppLaunch.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 6a6d0000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 75a80000 "AppLaunch.exe" loaded module "DWRITE.DLL" at base 6ad10000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75190000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 5c5d0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 69380000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 74600000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5c2f0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 5bfe0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 6c8f0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 5b8d0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6a4b0000 "AppLaunch.exe" loaded module "WS2_32.DLL" at base 75c90000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74b30000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74690000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74b20000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 5b73000045:Ta16,"df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae" was detected as "Microsoft Cabinet" and name: "sfx" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae" was detected as "Microsoft Visual C/C++" and name: "Compiler" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae" was detected as "Microsoft Cabinet File" and name: "Archive" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae" was detected as "Microsoft Linker" and name: "Linker" "1xv00Bc4.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1xv00Bc4.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1xv00Bc4.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1xv00Bc4.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1xv00Bc4.exe" was detected as "Microsoft Linker" and name: "Linker" "DB3VT84.exe" was detected as "Microsoft Cabinet" and name: "sfx" "DB3VT84.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "DB3VT84.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "DB3VT84.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "DB3VT84.exe" was detected as "Microsoft Linker" and name: "Linker" "3oJ78sj.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3oJ78sj.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3oJ78sj.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3oJ78sj.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3oJ78sj.exe" was detected as "Microsoft Linker" and name: "Linker" "2TW6263.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2TW6263.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2TW6263.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2TW6263.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2TW6263.exe" was detected as "Microsoft Linker" and name: "Linker" "DISMHOST.EXE.6AA76FB6.bin" was detected as "Microsoft Cabinet" and name: "sfx" "DISMHOST.EXE.6AA76FB6.bin" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "DISMHOST.EXE.6AA76FB6.bin" was detected as "Microsoft Visual C/C++" and name: "Compiler" "DISMHOST.EXE.6AA76FB6.bin" was detected as "Microsoft Cabinet File" and name: "Archive" "DISMHOST.EXE.6AA76FB6.bin" was detected as "Microsoft Linker" and name: "Linker"46:Te91,"df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "1xv00Bc4.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "DB3VT84.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "3oJ78sj.exe" file has an entrypoint instructions - "call 0x4028d2,jmp 0x40229e,ret 0,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x4021a8,jmp 0x40242d,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x41d00c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "2TW6263.exe" file has an entrypoint instructions - "call 0x4028e2,jmp 0x4022a4,ret 0,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x4021ae,jmp 0x402433,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x41d00c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "DISMHOST.EXE.6AA76FB6.bin" file has an entrypoint instructions - "call 0x100a7e6,jmp 0x10097f4,int3 ,int3 ,int3 ,int3 ,int3 ,push 0x14,push 0x1010878,call 0x1009d10,and dword ptr [ebp - 4], 0,dec dword ptr [ebp + 0x10],js 0x1009afc,mov ecx, dword ptr [ebp + 8],sub ecx, dword ptr [ebp + 0xc],mov dword ptr [ebp + 8], ecx,call dword ptr [ebp + 0x14],jmp 0x1009abc,mov eax, dword ptr [ebp - 0x14],mov dword ptr [ebp - 0x1c], eax,mov eax, dword ptr [ebp - 0x1c],mov eax, dword ptr [eax],mov dword ptr [ebp - 0x20], eax,mov eax, dword ptr [ebp - 0x20],cmp dword ptr [eax], 0xe06d7363,je 0x1009af3,mov dword ptr [ebp - 0x24], 0,mov eax, dword ptr [ebp - 0x24],ret ,call dword ptr [0x1001210],mov esp, dword ptr [ebp - 0x18],"47:T458,"df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "DB3VT84.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "DB3VT84.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1xv00Bc4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1xv00Bc4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1xv00Bc4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "2TW6263.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2TW6263.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "3oJ78sj.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3oJ78sj.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")48:T1056,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00005980.0000175C.1029439.00090000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00005816-00000C2B-195137462] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00005816-00000BC1-195270837] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00005980-00000BC1-196001879] Observed system executable string:"%WINDIR%\System32\ieframe.dll" [Source: 00000000-00005708-00000C2B-198666176] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003492-00000C2B-239948667] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003492-00000C2B-239996217] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003492-00000C2B-240175343] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003492-00000C2B-240199260] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003492-00000C2B-240242369] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003492-00000C2B-240348593] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003492-00000C2B-240413924] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00003492-00000C2B-240445566] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00003492-00000C2B-240493617] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00003492-00000C2B-240582795] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003492-00000C2B-240659341] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00003492-00000C2B-240680183] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00003492-00000C2B-240712654] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003492-00000C2B-240734592] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00003492-00000C2B-240843109] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00003492-00000C2B-241083307] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll" [Source: 00000000-00003492-00000C2B-241140767] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll" [Source: 00000000-00003492-00000C2B-241212400] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" [Source: 00000000-00003492-00000C2B-241307797] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" [Source: 00000000-00003492-00000C2B-241378644]49:T4dc,Spawned process "DB3VT84.exe" (UID: 00000000-00005980) Spawned process "1xv00Bc4.exe" (UID: 00000000-00005708) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00005696) Spawned process "iexplore.exe" with commandline "SCODEF:5696 CREDAT:275457 /prefetch:2" (UID: 00000000-00005908) Spawned process "iexplore.exe" with commandline "SCODEF:5696 CREDAT:275464 /prefetch:2" (UID: 00000000-00001968) Spawned process "iexplore.exe" with commandline "SCODEF:5696 CREDAT:275480 /prefetch:2" (UID: 00000000-00004420) Spawned process "iexplore.exe" with commandline "SCODEF:5696 CREDAT:275513 /prefetch:2" (UID: 00000000-00004120) Spawned process "iexplore.exe" with commandline "SCODEF:5696 CREDAT:275524 /prefetch:2" (UID: 00000000-00003600) Spawned process "iexplore.exe" with commandline "SCODEF:5696 CREDAT:1061910 /prefetch:2" (UID: 00000000-00003760) Spawned process "iexplore.exe" with commandline "SCODEF:5696 CREDAT:1455131 /prefetch:2" (UID: 00000000-00003468) Spawned process "2TW6263.exe" (UID: 00000000-00003948) Spawned process "AppLaunch.exe" (UID: 00000000-00000472) Spawned process "3oJ78sj.exe" (UID: 00000000-00002532) Spawned process "AppLaunch.exe" (UID: 00000000-00003492)4a:T4dc,Spawned process "DB3VT84.exe" (UID: 00000000-00005980) Spawned process "1xv00Bc4.exe" (UID: 00000000-00005708) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00005696) Spawned process "iexplore.exe" with commandline "SCODEF:5696 CREDAT:275457 /prefetch:2" (UID: 00000000-00005908) Spawned process "iexplore.exe" with commandline "SCODEF:5696 CREDAT:275464 /prefetch:2" (UID: 00000000-00001968) Spawned process "iexplore.exe" with commandline "SCODEF:5696 CREDAT:275480 /prefetch:2" (UID: 00000000-00004420) Spawned process "iexplore.exe" with commandline "SCODEF:5696 CREDAT:275513 /prefetch:2" (UID: 00000000-00004120) Spawned process "iexplore.exe" with commandline "SCODEF:5696 CREDAT:275524 /prefetch:2" (UID: 00000000-00003600) Spawned process "iexplore.exe" with commandline "SCODEF:5696 CREDAT:1061910 /prefetch:2" (UID: 00000000-00003760) Spawned process "iexplore.exe" with commandline "SCODEF:5696 CREDAT:1455131 /prefetch:2" (UID: 00000000-00003468) Spawned process "2TW6263.exe" (UID: 00000000-00003948) Spawned process "AppLaunch.exe" (UID: 00000000-00000472) Spawned process "3oJ78sj.exe" (UID: 00000000-00002532) Spawned process "AppLaunch.exe" (UID: 00000000-00003492)4b:Tb80,The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: FC:B8:DC:ED:6F:0B:18:09:F8:63:FD:24:B5:43:5B:82:24:12:8D:CE; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: BC:1F:B5:F8:04:0C:7B:4F:F4:4F:20:30:D3:BA:66:E6:AF:8E:8F:AF; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: DB:16:C1:37:8D:6C:67:F5:7B:69:A5:CC:5A:E4:14:86:68:68:28:08; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 2F:3E:B0:A8:44:32:59:B0:15:E4:8E:5A:B5:0C:9C:5C:04:8F:36:E4; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 36:C6:15:F5:21:0B:24:21:0E:72:00:85:DD:C6:59:8A:81:39:9C:5F; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 3C:F7:A3:68:2E:01:AD:2D:3C:81:BA:39:16:59:75:E3:82:26:E5:84; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 07:D5:2A:32:43:06:48:D3:1D:A1:74:4A:6C:D6:B4:EC:DB:7D:B2:B1; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B7:40:25:17:EE:AA:C8:0A:B0:46:81:18:6E:82:47:BD:78:51:CD:0A; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 M04, O=Amazon, C=US" (SHA1: EE:C1:BD:4E:34:75:3D:C4:2D:EA:58:F4:C4:BE:80:F1:E7:A2:AE:4E; see report for more information)4c:T266d,"1xv00Bc4.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\1xv00Bc4.exe]- [targetUID: 00000000-00005708] "DB3VT84.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\DB3VT84.exe]- [targetUID: 00000000-00005816] "3oJ78sj.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\3oJ78sj.exe]- [targetUID: 00000000-00005816] "2TW6263.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\2TW6263.exe]- [targetUID: 00000000-00003948] "index-BMC5_rMx_1_.js" has type "Unknown"- [targetUID: N/A] "q22hRfcuyI1m63XDkQrw2Sxgo-3469oiGGxG-roDaQsdT9DWDYPz6DhfgQe914iiBfONMKn3YhINqU49pVNahkCkvx2I9b7Pb8KWpaE_brMCJG_1_.css" has type "Unknown"- [targetUID: N/A] "identifier_3_.htm" has type "Unknown"- [targetUID: N/A] "identifier_2_.htm" has type "Unknown"- [targetUID: N/A] "identifier_1_.htm" has type "Unknown"- [targetUID: N/A] "login_1_.htm" has type "Unknown"- [targetUID: N/A] "api_1_.js" has type "Unknown"- [targetUID: N/A] "dism.log" has type "Unknown"- [targetUID: N/A] "OGC2BM1Q.htm" has type "HTML document ASCII text with very long lines (56174) with CRLF line terminators"- [targetUID: N/A] "DISMHOST.EXE.6AA76FB6.bin" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A] "0839ECC4815B5D8D5ED699ED1C20C543" has type "Unknown"- [targetUID: N/A] "595CD0DCED5F6DE43A9C77C525C44511" has type "Unknown"- [targetUID: N/A] "75A092F4522006A97542D6AC4F4E69D2" has type "Unknown"- [targetUID: N/A] "9C69E496D546F49A980D7350EC49A180" has type "Unknown"- [targetUID: N/A] "dinosaur_1_.png" has type "Unknown"- [targetUID: N/A] "imagestore.dat" has type "Unknown"- [targetUID: N/A] "_0707F7AE-AFDD-11F1-BE90-005056912768_.dat" has type "Unknown"- [targetUID: N/A] "KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWub2bVmUiAw_1_.woff" has type "Unknown"- [targetUID: N/A] "KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmUiAw_1_.woff" has type "Unknown"- [targetUID: N/A] "main_1_.js" has type "Unknown"- [targetUID: N/A] "~DFA7A6186E7B9924A0.TMP" has type "Unknown"- [targetUID: N/A] "~DFA54D271741B91917.TMP" has type "Unknown"- [targetUID: N/A] "~DF7FD0EA4A5956D396.TMP" has type "Unknown"- [targetUID: N/A] "ay1hV6OlegS_1_.ico" has type "Unknown"- [targetUID: N/A] "Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF_1_.woff" has type "Unknown"- [targetUID: N/A] "en-US.4" has type "Unknown"- [targetUID: N/A] "~DF9C55839BF02F16E4.TMP" has type "Unknown"- [targetUID: N/A] "~DFFAC35F4AF8E1AC4D.TMP" has type "Unknown"- [targetUID: N/A] "~DFD069200C371FBA2D.TMP" has type "Unknown"- [targetUID: N/A] "~DF8C5F7934951513D2.TMP" has type "Unknown"- [targetUID: N/A] "~DFFA960087DBC9830E.TMP" has type "Unknown"- [targetUID: N/A] "~DFCCF93956BCBA0139.TMP" has type "Unknown"- [targetUID: N/A] "~DF256A481ED01F0431.TMP" has type "Unknown"- [targetUID: N/A] "~DFA01BC1773CAAA4E3.TMP" has type "Unknown"- [targetUID: N/A] "~DF64C808AA8FB104A8.TMP" has type "Unknown"- [targetUID: N/A] "~DF5B814AE995E12DD2.TMP" has type "Unknown"- [targetUID: N/A] "~DF739436FB238CD9CB.TMP" has type "Unknown"- [targetUID: N/A] "firefox_1_.png" has type "Unknown"- [targetUID: N/A] "yt_logo_rgb_light_1_.png" has type "Unknown"- [targetUID: N/A] "httpErrorPagesScripts_1_" has type "Unknown"- [targetUID: N/A] "_B26E42EB-AFDC-11F1-BE90-005056912768_.dat" has type "Unknown"- [targetUID: N/A] "_B26E42E9-AFDC-11F1-BE90-005056912768_.dat" has type "Unknown"- [targetUID: N/A] "edgium_1_.png" has type "Unknown"- [targetUID: N/A] "login_2_.htm" has type "Unknown"- [targetUID: N/A] "RecoveryStore._B26E42E7-AFDC-11F1-BE90-005056912768_.dat" has type "Unknown"- [targetUID: N/A] "chrome_1_.png" has type "Unknown"- [targetUID: N/A] "supported_browsers_1_.htm" has type "Unknown"- [targetUID: N/A] "epic-favicon-96x96_1_.png" has type "Unknown"- [targetUID: N/A] "_B26E42EA-AFDC-11F1-BE90-005056912768_.dat" has type "Unknown"- [targetUID: N/A] "favicon_2_.ico" has type "Unknown"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Unknown"- [targetUID: N/A] "_B91ADE29-AFDC-11F1-BE90-005056912768_.dat" has type "Unknown"- [targetUID: N/A] "_B91ADE2B-AFDC-11F1-BE90-005056912768_.dat" has type "Unknown"- [targetUID: N/A] "_0707F7AF-AFDD-11F1-BE90-005056912768_.dat" has type "Unknown"- [targetUID: N/A] "_B91ADE2D-AFDC-11F1-BE90-005056912768_.dat" has type "Unknown"- [targetUID: N/A] "_B26E42EC-AFDC-11F1-BE90-005056912768_.dat" has type "Unknown"- [targetUID: N/A] "_B91ADE2C-AFDC-11F1-BE90-005056912768_.dat" has type "Unknown"- [targetUID: N/A] "_B91ADE2A-AFDC-11F1-BE90-005056912768_.dat" has type "Unknown"- [targetUID: N/A] "_0707F7AC-AFDD-11F1-BE90-005056912768_.dat" has type "Unknown"- [targetUID: N/A] "_0707F7AD-AFDD-11F1-BE90-005056912768_.dat" has type "Unknown"- [targetUID: N/A] "errorPageStrings_1_" has type "Unknown"- [targetUID: N/A] "b_lEtPAUPMI_1_.webp" has type "Unknown"- [targetUID: N/A] "UJSOPP97IDWCSS5KD4CB.temp" has type "Unknown"- [targetUID: N/A] "googlelogo_color_74x24dp_1_.png" has type "Unknown"- [targetUID: N/A] "opera_1_.png" has type "Unknown"- [targetUID: N/A] "index-CfssTcG8_1_.css" has type "Unknown"- [targetUID: N/A] "8B2B9A00839EED1DFDCCC3BFC2F5DF12" has type "Unknown"- [targetUID: N/A] "dnserror_1_" has type "Unknown"- [targetUID: N/A] "B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D" has type "Unknown"- [targetUID: N/A] "B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92" has type "Unknown"- [targetUID: N/A] "BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894" has type "Unknown"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "Unknown"- [targetUID: N/A] "75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA" has type "Unknown"- [targetUID: N/A] "NewErrorPageTemplate_1_" has type "Unknown"- [targetUID: N/A] "CheckConnection_2_.htm" has type "Unknown"- [targetUID: N/A] "CheckConnection_1_.htm" has type "Unknown"- [targetUID: N/A] "favicon_3_.ico" has type "Unknown"- [targetUID: N/A] "DABA17F5E36CBE65640DD2FE24F104E7" has type "Unknown"- [targetUID: N/A] "05DDC6AA91765AACACDB0A5F96DF8199" has type "Unknown"- [targetUID: N/A] "892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6" has type "Unknown"- [targetUID: N/A] "TF6YGQUA.txt" has type "Unknown"- [targetUID: N/A] "TF92N9KU.txt" has type "Unknown"- [targetUID: N/A] "K33RIH3V.txt" has type "Unknown"- [targetUID: N/A] "O3QHPXCO.txt" has type "Unknown"- [targetUID: N/A] "I00VQ1DZ.txt" has type "Unknown"- [targetUID: N/A] "5RDAAU0W.txt" has type "Unknown"- [targetUID: N/A] "VVQWRVO3.txt" has type "Unknown"- [targetUID: N/A] "2MX1JTPR.txt" has type "Unknown"- [targetUID: N/A] "E6XP3YSK.txt" has type "Unknown"- [targetUID: N/A] "B46811C17859FFB409CF0E904A4AA8F8" has type "Unknown"- [targetUID: N/A] "4NIXQKYW.txt" has type "Unknown"- [targetUID: N/A] "3UW5971G.txt" has type "Unknown"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" has type "Unknown"- [targetUID: N/A] "D1BEC81CCAFDC823A062FF26A89A6B6D_B9B4646227E0866A0D172EA2B644DB92" has type "Unknown"- [targetUID: N/A] "6CAFE3B721B7CE350C58A8F3EB28AA44_C4935EE08CAA8E5372EBE50CFA866626" has type "Unknown"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F" has type "Unknown"- [targetUID: N/A] "59D76868C250B3240414CE3EFBB12518_957FBAEAC26431C5F0B84F7986302387" has type "Unknown"- [targetUID: N/A] "F28CC103A764A74B222272A7D2BDDA5C" has type "Unknown"- [targetUID: N/A] "0J0B9PGQ.txt" has type "Unknown"- [targetUID: N/A] "26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD" has type "Unknown"- [targetUID: N/A] "IRUCHZLR.txt" has type "Unknown"- [targetUID: N/A] "55D343B052AE566C8BF677731180E634" has type "Unknown"- [targetUID: N/A] "IHP9MDLL.txt" has type "Unknown"- [targetUID: N/A] "CC640368512A0520EF9FE4E00D0FE9C4" has type "Unknown"- [targetUID: N/A] "I01BODY3.txt" has type "Unknown"- [targetUID: N/A] "5511AULF.txt" has type "Unknown"- [targetUID: N/A] "EEN1GIKE.txt" has type "Unknown"- [targetUID: N/A] "218KKOSL.txt" has type "Unknown"- [targetUID: N/A] "875JM70C.txt" has type "Unknown"- [targetUID: N/A] "XGGDM9VY.txt" has type "Unknown"- [targetUID: N/A] "NASWFLK2.htm" has type "gzip compressed data original size modulo 2^32 365"- [targetUID: N/A] "0LSEZAY2.txt" has type "Unknown"- [targetUID: N/A] "favicon_1_.htm" has type "Unknown"- [targetUID: N/A] "FDF9HQI3.txt" has type "Unknown"- [targetUID: N/A] "MD6WGOUQ.txt" has type "Unknown"- [targetUID: N/A] "EC7T8K5I.txt" has type "Unknown"- [targetUID: N/A] "G3E4Z2ZY.txt" has type "Unknown"- [targetUID: N/A] "7AU6055L.txt" has type "Unknown"- [targetUID: N/A] "MWERNCZ7.txt" has type "Unknown"- [targetUID: N/A] "D2ZIJ47K.txt" has type "Unknown"- [targetUID: N/A] "CF9G7P44.txt" has type "Unknown"- [targetUID: N/A] "EQ60QSZ4.txt" has type "Unknown"- [targetUID: N/A] "www.epicgames_1_.xml" has type "Unknown"- [targetUID: N/A] "bscframe_1_.htm" has type "Unknown"- [targetUID: N/A] "httpErrorPagesScripts_2_" has type "Unknown"- [targetUID: N/A] "errorPageStrings_2_" has type "Unknown"- [targetUID: N/A] "dnserror_2_" has type "Unknown"- [targetUID: N/A] "NewErrorPageTemplate_2_" has type "Unknown"- [targetUID: N/A] "OS2FHA23.htm" has type "gzip compressed data original size modulo 2^32 365"- [targetUID: N/A] "F41078BK.htm" has type "gzip compressed data original size modulo 2^32 365"- [targetUID: N/A] "bscframe_2_.htm" has type "Unknown"- [targetUID: N/A]4d:Tadb,"df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "")4e:Tfff,"df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "DF5F1034F8C58E4A3CCCABB50947ABC1D1E6DDD774B5CD294176870CFAB130AE"; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "")4f:Tc9a,"df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe.Local\" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\Cabinet.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\VERSION.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\SspiCli.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\WINSPOOL.DRV" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\MPR.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\Windows\system32\MPR.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\UxTheme.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\WINMM.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\samcli.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\Windows\system32\samcli.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\MSACM32.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to touch file "C:\Windows\system32\MSACM32.dll"50:Td25,"df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\Cabinet.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\VERSION.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\SspiCli.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\MPR.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\UxTheme.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\WINMM.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\samcli.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\MSACM32.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\sfc.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\sfc_os.DLL" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\dwmapi.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\DB3VT84.exe" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\FLTLIB.DLL" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\MSVCP140.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\3oJ78sj.exe" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\ucrtbase.DLL" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll"51:T877,"df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe.Local\" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe.Config" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\DF5F1034F8C58E4A3CCCABB50947ABC1D1E6DDD774B5CD294176870CFAB130AE.EXE.LOCAL" "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" trying to access non-existent file "C:\DF5F1034F8C58E4A3CCCABB50947ABC1D1E6DDD774B5CD294176870CFAB130AE.EXE.CONFIG" "DB3VT84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\DB3VT84.exe.Local\" "DB3VT84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "DB3VT84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\DB3VT84.exe.Config" "DB3VT84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "DB3VT84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\DB3VT84.EXE.LOCAL" "DB3VT84.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\DB3VT84.EXE.CONFIG" "1xv00Bc4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\1xv00Bc4.exe.Local\" "1xv00Bc4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "1xv00Bc4.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\1xv00Bc4.exe.Config" "1xv00Bc4.exe" trying to access non-existent file "C:\Windows\system32\UxTheme.dll.Config"52:T4b2,Found reference to API "WNetAddConnection2W" (Indicator: "WNetAddConnection"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "WNetUseConnectionW" (Indicator: "WNetUseConnection"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "WNetCancelConnection2W" (Indicator: "WNetCancelConnection"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "WNetAddConnection2W" (Indicator: "WNetAddConnection"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "WNetUseConnectionW" (Indicator: "WNetUseConnection"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "WNetCancelConnection2W" (Indicator: "WNetCancelConnection"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp")53:T570,Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /r/r1.crl" Found http requests in header "GET /wr2/oBFYYahzgVI.crl" Found http requests in header "GET /wr2/75r4ZyA3vA0.crl" Found http requests in header "GET /wr2/9UVbN0w5E6Y.crl" Found http requests in header "GET /r/gsr1.crl" Found http requests in header "GET /r/r4.crl" Found http requests in header "GET /we1/pl4XiTjSDSk.crl" Found http requests in header "GET /we1/G0k-BqpOX8k.crl" Found http requests in header "GET /we1/x6Eg-8TSwUw.crl" Found http requests in header "GET /rootg2.cer" Found http requests in header "GET /wr2/oQ6nyr8F0m0.crl" Found http requests in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D" Found http requests in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D"54:T31e4,Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:sXQMKdRyFQAdUO0Us-fNhk3YXdtsSQ:B9zQdfhM8WQLk9eOConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:IPSZTLTSEv_K8CyddWEzCgNIwBn48w:jY9pVLeH1J-Y0xteConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S202950553:1789349795473302 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:IPSZTLTSEv_K8CyddWEzCgNIwBn48w:jY9pVLeH1J-Y0xte"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S672900755:1789349796242197 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:sXQMKdRyFQAdUO0Us-fNhk3YXdtsSQ:B9zQdfhM8WQLk9eO"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:sXQMKdRyFQAdUO0Us-fNhk3YXdtsSQ:B9zQdfhM8WQLk9eO"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:sXQMKdRyFQAdUO0Us-fNhk3YXdtsSQ:B9zQdfhM8WQLk9eO"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:sXQMKdRyFQAdUO0Us-fNhk3YXdtsSQ:B9zQdfhM8WQLk9eO"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S202950553:1789349816514593 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:sXQMKdRyFQAdUO0Us-fNhk3YXdtsSQ:B9zQdfhM8WQLk9eOConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:sXQMKdRyFQAdUO0Us-fNhk3YXdtsSQ:B9zQdfhM8WQLk9eO"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?continue=https://accounts.google.com/&dsh=S202950553:1789349816514593&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/ HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 245DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:sXQMKdRyFQAdUO0Us-fNhk3YXdtsSQ:B9zQdfhM8WQLk9eOidentifier=&hiddenPassword=&usi=S202950553%3A1789349816514593&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=&checkedDomains=youtube&action=1&at=ALTjPXN0RcIFDC0u-axg6qh-xREx%3A1789349816641"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?checkConnection&checkedDomains=youtube&continue=https://accounts.google.com/&dsh=S202950553:1789349816514593&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/&pstMsg=1 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 245DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:sXQMKdRyFQAdUO0Us-fNhk3YXdtsSQ:B9zQdfhM8WQLk9eOidentifier=&hiddenPassword=&usi=S202950553%3A1789349816514593&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=&checkedDomains=youtube&action=1&at=ALTjPXOwcamON876ZWc9RABBrF-v%3A1789349839243"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?checkConnection&checkedDomains=youtube&continue=https://accounts.google.com/&dsh=S202950553:1789349816514593&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/&pstMsg=1 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 245DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:sXQMKdRyFQAdUO0Us-fNhk3YXdtsSQ:B9zQdfhM8WQLk9eOidentifier=&hiddenPassword=&usi=S202950553%3A1789349816514593&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=&checkedDomains=youtube&action=1&at=ALTjPXMPK4wBMqBUFtjAdtvBLCD7%3A1789349869243"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?checkConnection&checkedDomains=youtube&continue=https://accounts.google.com/&dsh=S202950553:1789349816514593&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/&pstMsg=1 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 245DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:sXQMKdRyFQAdUO0Us-fNhk3YXdtsSQ:B9zQdfhM8WQLk9eOidentifier=&hiddenPassword=&usi=S202950553%3A1789349816514593&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=&checkedDomains=youtube&action=1&at=ALTjPXORJexTyDucOfo5UHa2a4H6%3A1789349899234"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v5/yz/l/0,cross/q22hRfcuyI1m63XDkQrw2Sxgo-3469oiGGxG-roDaQsdT9DWDYPz6DhfgQe914iiBfONMKn3YhINqU49pVNahkCkvx2I9b7Pb8KWpaE_brMCJG.css HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yP/r/b_lEtPAUPMI.webp HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yP/r/kUc6oHI0fJd.woff HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yf/r/ipwqPKyH2FY.ttf HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yH/r/uR_TIYVE0g0.eot HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/y1/r/ay1hV6OlegS.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /images/branding/googlelogo/2x/googlelogo_color_74x24dp.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: ssl.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=1934389192×tamp=1789349793250 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=450016142×tamp=1789349794251 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=-2110845750×tamp=1789349933509 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=rWN2ZoBl27X8_7UFqINcEI1LvvlaNqotgFrv0CR5R47e3SaQmd5zlzwBDuQN2wvLOBxNuSvgOf1RvLVWVzRc8KLROFeIfXVnyJrrusrA0WXecMVPxhcCwgzIFqgNcMpcip2_GOs_pFMsuIelMZlGQ5pF-7m_kNvf0thK5PXUixoOq2IN4ah5B2L0PyfiYO--KcNtrkQlgzcTiCrA917_ssGqRpZhf8BUzc0t-wtCk_WZ88nvciLEeBrJ_mVyMhP2Q8y4Zxpe4sZW40P6u_O06Kd1TbW8p3LUbLaRwCWZRm1VVSqiYBQVDrR12kOj3Dz9c7sVdhzGpQP2hvgaXpDjbg; hideBrowserUpgradeBox=true; VISITOR_INFO1_LIVE=UpLqMjiLGYI; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgUA%3D%3D; __Secure-ROLLOUT_TOKEN=CJPBxc2Mrs-hOhClm66_9-yWAxilm66_9-yWAw%3D%3D; YSC=VGYVcNbZBlc"; in File: "SSL")55:T856,Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp")56:T87b,file/memory contains long string with (Indicator: " connect "; File: "dnserror_1_") Found reference to API "gethostname" (Indicator: "gethostname"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00002532.00000000.78734.00E90000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00003948.00000000.78374.00DE0000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00005708.00000000.76287.014F0000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00005816.00000000.76171.00890000.00000002.mdmp, 00000000-00005816.00000001.78095.00890000.00000002.mdmp") Found reference to API "Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement." (Indicator: " accept "; Source: "00000000-00005816.00000001.78095.0006A000.00000002.mdmp")57:T8927,"GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:sXQMKdRyFQAdUO0Us-fNhk3YXdtsSQ:B9zQdfhM8WQLk9eOConnection: Keep-AliveDNT: 1" "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:IPSZTLTSEv_K8CyddWEzCgNIwBn48w:jY9pVLeH1J-Y0xteConnection: Keep-AliveDNT: 1" "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S202950553:1789349795473302 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:IPSZTLTSEv_K8CyddWEzCgNIwBn48w:jY9pVLeH1J-Y0xte" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:sXQMKdRyFQAdUO0Us-fNhk3YXdtsSQ:B9zQdfhM8WQLk9eO;Path=/;Expires=Wed, 13-Sep-2028 01:36:35 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-Up2XbeRAfEJd28US9WiKGw' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Mon, 14 Sep 2026 01:36:35 GMTExpires: Mon, 14 Sep 2026 01:36:35 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "0000000100000001�00000001000000010000000110fb��P�j�@��[Kz�5)ڮS�X0��㲙��6��f�y�X!�eⱂ��m�C�<��'"�QK�v?��S�1r�-�.��Ig9w�p�Q� �X�o٭' 'Ts�!��H�x %Ł��3N/�J�p�ֈu�A/��vx�4��M��E�_�f�ݗ�c��n��[�8c��<�K�'h`4MB��%&��K�Y��m", "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:IPSZTLTSEv_K8CyddWEzCgNIwBn48w:jY9pVLeH1J-Y0xte;Path=/;Expires=Wed, 13-Sep-2028 01:36:35 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-rgS231LNZXzOVzpYkoZpnA' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Mon, 14 Sep 2026 01:36:35 GMTExpires: Mon, 14 Sep 2026 01:36:35 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�00000001P00000001�0f4j�@��[Kz�5)ڮS�X0��㲙��6��f�y�X!�eⱂ��m�C�<��'"�QK�v?��S�1r�-�.��Ig9w�p�Q� �X�o٭' 'Ts�!��H�x,%Ł��3N/�J�p�ֈu�A/��vx�4��M��E�_�f�ݗ�c��n��[�8c��<�K�'h`4MB��%&��K�Y��m" "HTTP/1.1 302 FoundContent-Type: application/binaryCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 14 Sep 2026 01:36:35 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S202950553:1789349795473302Strict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Opener-Policy: unsafe-noneContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportContent-Security-Policy: script-src 'nonce-3Cr-2OQSZ2SNwqjhVmiuFg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Resource-Policy: cross-originPermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*Server: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Frame-Options: DENYVary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Sitex-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/x-ua-compatible: IE=edgeCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 14 Sep 2026 01:36:35 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Resource-Policy: same-siteContent-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreportContent-Security-Policy: script-src 'nonce-bhofgGLTmzT3vA5j08_L-g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Versionreporting-endpoints: default="/v3/signin/_/AccountsSignInUi/web-reports?context=eJwNw09IU3EAB_Ax_X0R8bD-qS2I4akJ2stwGQaSkrLm5h5vz9miXuoWDmLT7U3IIv-hB4sIypJKhAoqxEoPHRbZxUgRi3LiXFEeChQLM1SMPPT9wCdzMi0_02woP2A2jOfFjcfPfDee4NtZy8a73LPwXtxk_cEH0cV9PMBN5z6KC3zI8kmUcbV3Vrg5kpsQHWwtSYgCnrAmxST_aUsK06WkqNhMiirOTn0WZp5KfBEzvN1hh6HTjqUqB35y-7QD3bzxzYG__Hi2GtZCJwp4M-pEuu7ESq8Lqzzc78JzfvayBmOc_qsGT7vdGOEUf-W3825MsWaR0cjFHhkV_Oi6jCccfiMjyr_3KFhnU66C3bxmU7DBJ48pcPGPegXLvMXbvKtBQQ43ax7oHL7sQdsOFVe4Nahi5aqKVW55pyLGfTMqOl_Xooev8Q2-w_e4dp8XPh655cUoD6S8uM9H9tahlMuH61DJ_n-nELf4MM5n7T4cXvRB3n8aO7MyHg4NzsG0-OJVvzHvYEO4RQv6AyE9qF88HwmH9EDIXx_Tm2LBaCDSGohoRVKRTToqlRRKNq1Z-g8oub84"Content-Encoding: gzipServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "o%��3�b�H�I��I�j��Q��5�}9��c�t�U'~�ټ̝�A��G�~��c�i'O��/�+��+��g�*��?��K׮�b��4H��]h�_Z�:�]t�`M��V�qy>R.Dj��s�|1^�VN>$qMnB��s̨��~R��a�j��I��$�w��v��i��T�ڐLM><�)��f��:�OQLD��M5��̽�3>�[��Bcm8"9ZW=�SZ�N82��7H�P�N�.��_W�z~M��0��6c��۪;��p�ʽ�*�ddf��py�4�G6�u��J�t*ã�V��xa��*3eu5��^�<��V�'��N�H��Xb�&Qw��{r�5��\+��Y�YX�.S��o��S�l:/��gO�ַ��?�7��{��h&ڣ�m�j|6!��U�=ZW.�]��X9��C[rY��g��u��$�s�Lú�C-��;��A�ܘ��~��pn�+[k��M��u��[D�x>�3|g��i1��:��=��0��(I��?��pR�X�~�]lNՉ��ߢaol��2��q�T�֬��y)��L��ݤcޛ�E�lE��YSU��<��q��'�Q��L�/u#x��։ua^Y;V��_Y;��m��̚�X��V��0��d�,��&�ބ�#K]��o��,4�OC��WeF��Y��A��A�t��tڸ��oZ5��'��qNMu��]�xu��|��4� ��)AoG=��]MT��]��*%��"��m �N*��pج=�&��=��a�6�;x|��V}��Q�xV9��$F0�W�K脃Y��\��QW��M*{7|v^�ߋ9��,�w�c��/ ��G$�B��N*寮�d�-��x�F�ޱn�!�q��+��3��!��4<Ày�m�|�T��0y��ì{f��]�M�+��Z�̜;��" "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001,00000001�00000001A000091�0�|�>pCM?�x@HMj�8�c��=��e/3��i�Ѿ;��J^�c]�<��7p+��lRX��ڰ��6��]C��-֦Tk�4�Z�s��IXp��唲�])V��x��/d�I(�a8�JntFb�rb��" "00000001�1054s�8��xz�3�,8�W]�z�N�vӦ�4}�� ۬y��H`H��k'�#$}}�O��~��@��M�"D�x��Ӊ�]6��l�Y�1R��FO �ͻ;&��R��9��h�O*!��/4��Đ��L��ݵ>O�/��_��b��r�2��2�[`�c��$�bN��x�(��g܂��@[�ss6��O ��zCo6�N)��ݚ�%�sh��0�N�z�M�I�g7��ϵ��Z��&�g+ʰ��5��d��J��6J�G�X`H�ް��l��[�h�b�A�c ��G?��`Y��~忈�x�R��؉��_t��b�(��}$�XRIXJ�>��EuX�'O~��x��4�Ap0��pT��1��3d��7:��X�!è7��Pj n5��%��kT��!�T�i3�P<�a�3C xk0��Q�xS˽�M��M��¨`ӗW�$4I��%+ɥl=㚙:�� 6��R��U�s�aVaA��V��)V2j�cKumG$�ң�k1a<��^��9�@u�G�)�2ʍ�茆�p2�{C��x��<�1�2��ZJ�G+��N��xǿ��k]�Y:��@1��P�j��\�'+��'��vA�n��Jm�|\:8~ɇ��C�Qf�]��6�B��>�TLr�'%�쇪�u�r6��n�z�&��u��?��nC��7�Ʋz��t�zs��b��륎�QWIA?ۚ��(A��A��-�D6�{t�O�)\1?;��6rݍ��{h��m��%��Π9"Q06tU`��JJ_�CJ�b�17L{&џ��}$q��ⰴ��tB}�'��/F��l�nB��pg�8ZK�n9C��R�`F3�¤x��g�S�#ә�F�7@w�>��u��p�eG��F��ɲ", "��pi;�&�t;��>`��*�}��ђ�0F��w��05� x8�1'p�0�|l��B�/w�RO��R7Q�I�XE�tW�9�p0�VV@+X�w�e%��Sc��{`�W��N�Z��fl��#B�،�^��9��qф�˩�]��@�ۀrd��Vd+8��&�sr�tliL$�Hb��#�t��5�#��agVa��/?�0%Ԩ�`΋X�a"��o��4�q�@��:̄Jܥr�t�X��s�5��XY.>��W��h;�l�Q�`v;e-�/��b��废�*��3�.h��_�)5�B?��B"��Yq�z��s��bm�<��pż2�Z��A*[��tXu��Lu��c�܅qF5�J8��J�Q�H�0��cWE�R��@Crl��:��E��T;c��QE��C+�u%��'С�**/��ދ��p��Z.G��&5��hR��J)��2 �j֫��#+X?��Uʏ{�2�ԡn�!��T�9!�J��ii`y�dQ�� `̬��Sy��턨-$sqڟ��d��u�i��t�HB� )uMz�Q׷M�=��eA�?��|��-�P4G'�|�:��08�#��iV��,�e��t�q�K�i"ىUj�&��Y�]�!AΩR��i҃+{�&��R��?Û�^`�%%��dώd(��D;T־��=ȫ��/f��BS��Zp�v��o.�,�Ӂ��͂BJKk�E��q�f�Н�&CEj*��v�hz�ՠ$�%�VF��d��ҩ��}�..��(��_ψ��=��,QԴK]��|�s�i�l��Ȕۮ�C�6�mT�Kbb��&��\��Hg#��A�bp�|��#c;��j��œ=��P�g��P��du5K�^�9t�7굻�wyD��M�|~��c�A��V`��["H#��#�q&\ܹ{HBI�zI��=ƚjS��Y��P�3�U��>�j�B��oRv?�Rn�5�7�D�\I�8:��_;�nJ[��J�M�&��ݜfnJ��E�jr��\��wF�a��-��y�A)��j|�.��{��g�n��U��|��E͖��}o�^F�ݸ��A�A��35K0TP'��By��.�!THN��ȷw�>.��%޹��ݗT�'�;�&�Ù��dXC$b�&��&1bon:��F8q�WIE��H��(�74Q�!6��A�M~'��&C*��x+<�N[�t�N��-��O6Y�`V=��L��>�ˣj��[��*%�G�q�U8J�Y��y`��=�v��U�s��N첦�{�5��Rz��w��2��9�R_^��|�0Ʈ|f(�˜(Z��讟�|��*�o��t�2#+�i~_�8.��T22/D�-K�Ġf+Z)cZ:�rG��2�މf7`�f2L{�G�D�'fxô`#�V�nIKčZ*fO��.��=ipu��|��?��;ƫ�5��]�iuw'��1��G� �W�5�#��s��q��+�P�6�n��"�B�#�B;�s2}"��fz��R�|�D�B"N��@j��mf�a�U�4��,ȉ#�I�E�Ft8�E$m��@R��*��(o��,)��Ȱ��G�֝8�{;��Û��%7"��!r��$��|!�/g�%熿q��}c<�a闵�m�^T9MN�|�[�D��R5�XMK.]O��S)ʤKTw��JL|%DB6�B�!V��Xޫ��2Q�Q��ub�>V�O�h��C�ub�)Vp|~��ŘV�凕G�#u�d?�<��h�#'O��ƃ��*��嗡�f��%7�3��J1IE9&SS'�� N#q�M7�PK��p#��Sz��:޺�}��X��狀��D|�Z<ɋ�yr'�3a��1O0X}o��O�(�ڈj:�~��/��Čp�W��u�'s`��P�\�o'�juF&;L6", "�W�x;5�1�66R#lг��)$��T9�/��", "00000001�001]10e4is�<�+��/ìI��ڭ�I !��p8cC��W��d�&y�ݚ�LaK�V��t�l&Tֶ.r�&��zag�4�7��|*��EL&"��)��S4��;�+E��D{e�R4Q�6I��e�p��0�Y��s.�e�-�S��L낖�sZ6�e��*�A[&�K��yrW��`�4/�Xg��7�j"G角nϊoӘ'�ʇ�5�'��x�4b��'x� ��Z��1��Ih3��2a��$��q+��l��x��p�ȓ$T�ǉ̥:Ħ��W|]<��c��L%�#�DY�$�@�=|9َG1+_`ʡ��ty�H�W�N1B��)��)9�s��K�8w�i%�؈2("6rW�1��J�R��*��L�>��io��ഷt�b�uv=6�U��&�g=�>��M{,_´��/k�ׁ�`N��љJ��J�,mPZ{9^��q��SV;�JA�T�p�CY3��@�0W==Y��A�BL��w)Kq��E|��">�ex��V��^O��Mz˳e�1��+��(�ې�EI�3�f|lk��v�o��+�l#�n�-z��Y5>�!�y��Xg��=��ΎG#��IbiK񃒏�Ұ��<�K��;�^�Ǔ��~*t6r�)0)M�QZ��_bGļVѵL��=Ͳ]c��"||]��&�w*Eh>I{��lNk�w�<�C�18�[�~M^ܓ��~��O�e4�f��ە�#Cџ7��^_;�?�", "��>^��V�o|7�sG�:��;L��f�B��[��r��qc�N��3��$��t�t��#�M��|��/��jv��|/CɣO��e��)�4�ta��l��-g��9s�7Q��B%@��:��(��ާBȗB��7wnh�'�_4sU;�w��ۣ`f�oC4/�R$H㓐��@�g�qD��/�L�9��rH��Ak8��kd�.gv��v��)��-��V��V�H�r�U&�U�Bg�ϟ0�N��ZA�O�/w��w��B��Eh��m~��1cf'5uT0&}\��*tc=}��愅�if��='J3`�l�wn��À�cd��)�*^��r9硚W��.��`hYl��;�;K��&�ף��a��l;�H֨M�]wj��f��P�N�^�)��'��·��V\#��gp;��j��I�vw��46b#�lL��t��B�60��9<�qi�Y��aRo�z��O�bY�b*�?�G$��c��e�:�e��uTDt^h,��&&�5E��[*#�qP ��|7�_��g��u�)d(�ޑ��&:r��R�}��-��>�:��**�M�IHƩ�*��r��}�8��d�t�M�*ip}p��]|�8�s>X=�4f��j�v�j�n��LMq[�v��7�t��o�Cxd�[h��e��JzRhîq~Pgbl��F'�8��ݗ�6&�!�M��-)�o��N��u!�+G�v\k��$|�eysqbiq��p�ҝ�9��@�F��Dy�&pF8P�-P\��o��o/ˏN1� ��O��A�Cg׏�Aĥ�n��l��֦S��#�w)��Һ�&߁/rayܴ�@��rK^��=��[W��zA��7KfaeE�g@kri��2�cf�]�Q5��P�E��7�2�A��-�6k�f�̴;D��F?�FCc�X^=zjg�vi��9x��5�!��S��?y^��j^UNr��R�+�K:�f�;�v�10�L��~ki?��a��[q�X=�h$�M10�_=�4�F��Fo�*>s�4��6Jx(n!��Q�%B%J�x��k�ml��N��R�^��Lg�y� ��6��Ux6�3b��?��f�ܝ_��E78��؛�p˲��խ��>�٧�]�j�g)_*�^LQw�.Rx��QhZ��e7ߦ��l�X7~]|��.�9��/AW�#��~R��s��>�)AH��q�i�g�xe�A�� 5h��/��9T�[�/�5wZ�=�G`", "��`��>\g}��x�x�w��d�e�'�� 0��f��[�?JC��Z��<��xkS��O�Lx�Ƿ��"�(Z��]��j�{�8}*��ֲ�f�ӫb�SQ9}ܐ�J�#V�p��B��h!/��,q��,��6�Tn�F_-Z�V�1Q&ˬ0�#�j��4W�%�lS\�(\`<��@��~>Ʀ�Ԋ�)�[��CV�j/��e�"Bʶ]v��Ѩ��t�t��V"��~�A�N*�4�A��>�%J�28��u=2z��͛��u�⩝�5k/m��#x�B*�1�NǺ��E7rN'Fk?3�/%��K~ȠpGO@�R<;w�&��u[�'�b�� 1D�`DP��o/f\|܎��܂\��o�@,햳�zT�AH偑��{��4m@ܱ5��aW~�}�~P��Z��{3{��xu��s�E��כ��O�=÷�f��J��@*Z.�@͜�O�|x!�a|'��7�j�gJ�=�I��k�/p��|��E�&�=��(��:P?m�|��l�̄��R+;��z�$q�A��y�\ή^�uW�x��$�1CZM��فnFMDRe��}�~'H�O��4�+��27�9�#��'.��B\�-��X_S)�/�'y^��:w��l�*��.ע�u��toW'��7��cl��>N:HL��(>Z%\B��q�ug�ʳǧ�^�S�&��\�ʹ[/��֠�1y��*��q9�Tx!�ϫ2�2�q�i*��5k�Rҡ�_�ȗ��Tnt��!v�C��\&g�T&�'4�I�H��E�P�'r��7��O�}T~��0�,)��M2��N.9z�%c\�J�ҙcD^b��W��_��tnY#չ��>�R�&r�%ެ9�iK��XR�5��uel��+�r�Uv�*܃��{Ɛ�nk`T�;��-��b��9L��BMf'o?;8�M�z�;��Q��=�f��iwLHʗ�;��D$��m��=2ՠw�В|$��N*In��V��>z�w�U��_N��W��o��Fޣ��Tcxv�?��)�X��YT7�h4�1:��*ौ4_x��Qz�%��B�J�B��$��]O��r��ȝ�� P�!̢��RqпQ�V�>_b֑Czܞ��=�>ʅ��?n�z��9�DZ��6O%�s�n��w��Z��I�6j��)��ˮvo��a;p��'g �H%��a%6;��@RL"��1N�"{?�ǳ��ɀ)��!��k��,��l��@��f�pZ�|�4br�ט��n��ܨ�7�l�`� ��S�޸��3�=��l��y�z��Vg��۰��PE�g�i6�i��4��Q@�E��++�9��iw4Po��I_�G�w>��o�>��:�E��g��_�p�)��S��_2��[�( ��Σ��"Od/�e�qd�+R$�0��M�H��]�T��0荽��&�?��w|f]��u�1��W�+WM�`�$�z�>�", "��Q�8��P��%�1�Wv��j�n˖ڀ/q|��/�ٲ?��#��ju��'�h�/��/8�=P�F�x��ͫ��pG*��׾,)�ne��2�f�}��L��&}�؇�2��H�Q ��Sr֒��$�~�RRF�[��{m��W�/�fr�e" _��L��YG�l��a/g�y B�~�e��r�9�U2�&�!*uk�g%��~�y��lA�D��Un��E#I�aNY�8Up�5hI��iQ��x(�UÞ��+1��-n��%(υ��b�W��'Jr4=6��*��(��\Bo�1�J�\UT�5%'�"��`�0ǕZ�XC� G��"�.�&Eba�*�R�)viy��;��c�+SQT�AXX��M0��w��p)��Y��8c0l�ș��G��uDp�ew��A��2BS��koq��9��۽��Xe5�:e��y7�H�[�]�v�7�U͐��s��~��:��eI�&T�Q�C�$�N2~k@Q�ʪ"��D��!k�ۋ N��Ǟ�nzX@ /�l��д�EY��ʁ�҄y��0V��/��cٍ�D�J2?IՆ��`�s��'��W��D��W�L�RYZy�Mr�)�K��o��,ŨP��ft_��4`��2|�Sx�9�3��`��th��|:�b8�>VC�%�ݑՅ5Y3��L�}�e�x��wQ*=��γpx��쟝-��Z�ΎO"�ѫ~�㎭yZXj��q�]�\-z>3~�%|��}��x�Z=v6S��%�Y�\Ll�3��櫢Ae�3��,ȭ�z��Wr�C��?7�J-��T�Z�AR��/�e�V�m5�-d��2]LbA0�D�u�N��n�}RtO�i�I�íN>�1�ń�E�c��Mq�0N)��;�b�c�7x)�c��!��M+C�Զ��n��%M3�.��-�%O6��w��l�p�Χ9_�Ƕ���I��s�$*��7��rNu_�J��=5��)~��6Qc�Q��=]�CO{��HK��vjH��s�J�9p��l�9��p��р��qr:�=ۓٓ=��.��f��ob��p�7�ALmLe�ƚg)�6��Z�Q'��=�g1��1ބ�(��^��4��9L��y��f5b��ieB�WX�s�ܞ[��)\�뎳��FDB&b9�\k+�7s�93��hIN53�4eY|��TL&��Ë�k�-�(�q�8��=�rs�l�-�/��c�P��(=�,��>�w��'��R�N��c2��ۏ@�8.��'Ph��$_$䴒��h�?��c��]TcЛ�u�j'��Ml�ێ�ʹa�:� gX+��:��q��q��2A0�ή��f�9�:�"u��i�-��tϓ��ܟI+RdS��J8��*}=`A��w�X�J��n��@,�6��^�>�~��x�BGe�$�責�A��ٷQ�%�ؓ��fR�߇^�K��5�~�cʼ�oHiDm� ԚƯJBpE#V�JoAa�ySR�Nr!�?�n�Lg��ָ��fKdJ}[˪?+�&?��x:гU"I�6��h�\+FVƯՕ6��ǵQe�L��8�B�a^�o��/��B|��>2�x��_��_h�Ȍ⍎�-*u��ߵoK�1�^��*��ˀ9&�%��3��/4J��;��'ܐd<��Ӭ�h��4�nџ�V*r�u", "��#��5��z��W�(VhS��fSwn��ke&��Ua�g-Jd��5�Sf%t��U}�K�<��ܬ�l��!�Vdk�I0��i�f+J�X]��7,�j�=lNӕ�hP��A��!�r�&�EZ(�U��j�Ҕ�ؠ/%�j��SYlS�5��T+��*��", "00000001�00000001]00000001m00000001s000084d�8�+�ܗd��/wC{m�K/m�Izߌm.Sl2I��,��+J�|�0��j�h��-�:n�'��gے�*S�ל�#�E6��&�:��>y�-��h�L�˳H풑4={d²�r��t�'�3��1��c���9�ovF��xU��@w�{��Biٮ�Ry�̑��705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0i" - Source: "00000000-00005980.00000000.76235.00180000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0xw70iq,xcu" - Source: "00000000-00005980.00000000.76235.00180000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00005980.00000000.76235.00180000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00005980.00000000.76235.00180000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00005980.00000001.78159.00180000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0i" - Source: "00000000-00005980.00000001.78159.00180000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0xw70iq,xcu" - Source: "00000000-00005980.00000001.78159.00180000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00005980.00000001.78159.00180000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00005980.00000001.78159.00180000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00005980.00000002.78408.00180000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0i" - Source: "00000000-00005980.00000002.78408.00180000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0xw70iq,xcu" - Source: "00000000-00005980.00000002.78408.00180000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00005980.00000002.78408.00180000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00005980.00000002.78408.00180000.00000004.mdmp")5a:T5b4,Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /rsrc.php/y1/r/ay1hV6OlegS.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /id/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.epicgames.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL")5b:T9dc,GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.cn GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog GET /r/r1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/75r4ZyA3vA0.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /r/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /r/r4.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /we1/pl4XiTjSDSk.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /we1/G0k-BqpOX8k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /we1/x6Eg-8TSwUw.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /rootg2.cer HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crt.rootg2.amazontrust.com GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootg2.amazontrust.com GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootca1.amazontrust.com GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.r2m04.amazontrust.com 5c:Td6b,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEA59dSNcqDd" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIf" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "aREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPW" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTih" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base62 string in header "uFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYV" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base62 string in header "2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com"5d:Ta64,Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; Source: "00000000-00002532.00000000.78734.003AD000.00000004.mdmp, 00000000-00002532.00000001.78771.003AD000.00000004.mdmp") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; Source: "00000000-00002532.00000000.78734.003AD000.00000004.mdmp, 00000000-00002532.00000001.78771.003AD000.00000004.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; Source: "00000000-00005708.00000001.78045.00D5C000.00000002.mdmp")5e:T755,"df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00005816) "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005816) "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" called "FindNextFileW" with parameter 3oJ78sj.exe (UID: 00000000-00005816) "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" called "FindNextFileW" with parameter DB3VT84.exe (UID: 00000000-00005816) "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00005816) "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00005816) "DB3VT84.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00005980) "DB3VT84.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005980) "DB3VT84.exe" called "FindNextFileW" with parameter 1xv00Bc4.exe (UID: 00000000-00005980) "DB3VT84.exe" called "FindNextFileW" with parameter 2TW6263.exe (UID: 00000000-00005980) "DB3VT84.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00005980) "DB3VT84.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00005980) "1xv00Bc4.exe" called "FindFirstFileW" with parameter %WINDIR%\System32\*.* (UID: 00000000-00005708) "1xv00Bc4.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005708) "1xv00Bc4.exe" called "FindNextFileW" with parameter 0409 (UID: 00000000-00005708) "1xv00Bc4.exe" called "FindNextFileW" with parameter 12520437.cpx (UID: 00000000-00005708) "1xv00Bc4.exe" called "FindNextFileW" with parameter 12520850.cpx (UID: 00000000-00005708)5f:Tfde,file/memory contains long string with (Indicator: "aes"; File: "SSL") file/memory contains long string with (Indicator: "aes256"; File: "SSL") Found string "FromBase64" (Indicator: "base64"; File: "00003492.00000DA4.5540554.00402000.wprm") Found string "AesGcm256" (Indicator: "aes"; File: "00003492.00000DA4.5540554.00402000.wprm") Found string "AesFastEngine" (Indicator: "aes"; File: "00003492.00000DA4.5540554.00402000.wprm") Found string "FromBase64String" (Indicator: "base64"; File: "00003492.00000DA4.5540554.00402000.wprm") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "00003492.00000DA4.5540554.00402000.wprm") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00003492.00000DA4.5540554.00402000.wprm") Found string "base64str" (Indicator: "base64"; File: "00003492.00000DA4.5540554.00402000.wprm") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "00003492.00000DA4.5540554.00402000.wprm") Found string "FromBase64CharArray" (Indicator: "base64"; File: "00003492.00000DA4.5540554.00402000.wprm") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00003492.00000DA4.5540554.00402000.wprm") Found string "FromBase64" (Indicator: "base64"; Source: "00000000-00002532.00000000.78734.003AD000.00000004.mdmp, 00000000-00002532.00000001.78771.003AD000.00000004.mdmp") Found string "AesGcm256" (Indicator: "aes"; Source: "00000000-00002532.00000000.78734.003AD000.00000004.mdmp, 00000000-00002532.00000001.78771.003AD000.00000004.mdmp") Found string "AesFastEngine" (Indicator: "aes"; Source: "00000000-00002532.00000000.78734.003AD000.00000004.mdmp, 00000000-00002532.00000001.78771.003AD000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00002532.00000000.78734.003AD000.00000004.mdmp, 00000000-00002532.00000001.78771.003AD000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00002532.00000000.78734.003AD000.00000004.mdmp, 00000000-00002532.00000001.78771.003AD000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00002532.00000000.78734.003AD000.00000004.mdmp, 00000000-00002532.00000001.78771.003AD000.00000004.mdmp") Found string "base64str" (Indicator: "base64"; Source: "00000000-00002532.00000000.78734.003AD000.00000004.mdmp, 00000000-00002532.00000001.78771.003AD000.00000004.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002532.00000000.78734.003AD000.00000004.mdmp, 00000000-00002532.00000001.78771.003AD000.00000004.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; Source: "00000000-00002532.00000000.78734.003AD000.00000004.mdmp, 00000000-00002532.00000001.78771.003AD000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002532.00000000.78734.003AD000.00000004.mdmp, 00000000-00002532.00000001.78771.003AD000.00000004.mdmp") Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002532.00000001.78771.000A0000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Indicator: "zipfile"; Source: "00000000-00002532.00000001.78771.000A0000.00000004.mdmp") Found string "system.security.cryptography.x509certificates.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002532.00000001.78771.000A0000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Indicator: "zipfile"; Source: "00000000-00003948.00000000.78374.00510000.00000004.mdmp, 00000000-00003948.00000001.78403.00510000.00000004.mdmp") Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003948.00000000.78374.00510000.00000004.mdmp, 00000000-00003948.00000001.78403.00510000.00000004.mdmp")60:T1168,Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002532.00000001.78771.000A0000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002532.00000001.78771.000A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002532.00000001.78771.000A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002532.00000001.78771.000A0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002532.00000001.78771.000A0000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002532.00000001.78771.000A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP000.TMP\3oJ78sj.exe" (Indicator: "\Device\"; Source: "00000000-00002532.00000001.78771.000A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Temp\BCDD5F28-97B0-4F8C-9F7D-3AF5DBC1D217\DismHost.exe" (Indicator: "\Device\"; Source: "00000000-00003124.00000000.86915.002D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003124.00000001.87481.0031A000.00000004.mdmp") Found string ":\Windows\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003124.00000001.87481.0031A000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003124.00000001.87481.0031A000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf" (Indicator: "system32\drivers"; Source: "00000000-00003124.00000001.87481.0031A000.00000004.mdmp") Found string "C:\Windows\System32\DriverStore\FileRepository\vm3d.inf_x86_neutral_abfe51358467898f\vm3d.inf" (Indicator: "system32\drivers"; Source: "00000000-00003124.00000001.87481.0031A000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003124.00000001.87481.0031A000.00000004.mdmp") Found string "indows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003124.00000001.87481.0031A000.00000004.mdmp") Found string "indows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003124.00000001.87481.0031A000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003124.00000001.87481.0031A000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003124.00000001.87481.0031A000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003124.00000001.87481.0031A000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003124.00000001.87481.0031A000.00000004.mdmp") Found string "PID=3124 Driver C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "system32\drivers"; Source: "00000000-00003124.00000001.87481.0031A000.00000004.mdmp") Found string "PID=3124 Successfully opened driver package file 'C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf'. - CDriverManager::OpenPackageByFile" (Indicator: "system32\drivers"; Source: "00000000-00003124.00000001.87481.0031A000.00000004.mdmp") Found string "PID=3124 Building driver collection for package 'C:\Windows\System32\DriverStore\FileRepository\pvscsi.inf_x86_neutral_2e237bca5c8036a7\pvscsi.inf'. - CDriverPackage::CreateDriverCollection" (Indicator: "system32\drivers"; Source: "00000000-00003124.00000001.87481.0031A000.00000004.mdmp") file/memory contains long string with (Indicator: "system32\drivers"; Source: "00000000-00003124.00000001.87481.0031A000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003948.00000000.78374.00510000.00000004.mdmp")61:T1d72,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 1xv00Bc4.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 1xv00Bc4.exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: 1xv00Bc4.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: 1xv00Bc4.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: 1xv00Bc4.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: 1xv00Bc4.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 1xv00Bc4.exe] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 1xv00Bc4.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: 1xv00Bc4.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: 1xv00Bc4.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 1xv00Bc4.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 1xv00Bc4.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: 1xv00Bc4.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: 1xv00Bc4.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 1xv00Bc4.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: 1xv00Bc4.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: DB3VT84.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: DB3VT84.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: DB3VT84.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: DB3VT84.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: DB3VT84.exe] Observed import api "IsValidAcl" which can "validate an access control list (ACL)" [Source: 3oJ78sj.exe] Observed import api "IsValidAcl" which can "validate an access control list (ACL)" [Source: 2TW6263.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: DISMHOST.EXE.6AA76FB6.bin] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: DISMHOST.EXE.6AA76FB6.bin] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: DISMHOST.EXE.6AA76FB6.bin] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: DISMHOST.EXE.6AA76FB6.bin] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: DISMHOST.EXE.6AA76FB6.bin] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: DISMHOST.EXE.6AA76FB6.bin] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: DISMHOST.EXE.6AA76FB6.bin] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: DISMHOST.EXE.6AA76FB6.bin] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: DISMHOST.EXE.6AA76FB6.bin] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: DISMHOST.EXE.6AA76FB6.bin] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: DISMHOST.EXE.6AA76FB6.bin] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: DISMHOST.EXE.6AA76FB6.bin] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: DISMHOST.EXE.6AA76FB6.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: DISMHOST.EXE.6AA76FB6.bin] Observed import api "IsValidSecurityDescriptor" which can "determine whether the components of a security descriptor are valid" [Source: DISMHOST.EXE.6AA76FB6.bin] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: DISMHOST.EXE.6AA76FB6.bin] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: DISMHOST.EXE.6AA76FB6.bin] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: DISMHOST.EXE.6AA76FB6.bin] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: DISMHOST.EXE.6AA76FB6.bin] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: DISMHOST.EXE.6AA76FB6.bin]62:T6ab,"df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\DB3VT84.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "df5f1034f8c58e4a3cccabb50947abc1d1e6ddd774b5cd294176870cfab130ae.exe" wrote 30720 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\3oJ78sj.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DB3VT84.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\1xv00Bc4.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "DB3VT84.exe" wrote 959 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\2TW6263.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...63:T604,TCP traffic to 64.233.180.84 on port 443 is sent without HTTP header TCP traffic to 157.240.11.35 on port 443 is sent without HTTP header TCP traffic to 155.102.176.83 on port 80 is sent without HTTP header TCP traffic to 57.144.180.128 on port 443 is sent without HTTP header TCP traffic to 142.251.214.35 on port 80 is sent without HTTP header TCP traffic to 142.251.218.67 on port 443 is sent without HTTP header TCP traffic to 142.251.218.206 on port 443 is sent without HTTP header TCP traffic to 142.251.151.119 on port 443 is sent without HTTP header TCP traffic to 162.159.140.229 on port 443 is sent without HTTP header TCP traffic to 23.54.40.202 on port 443 is sent without HTTP header TCP traffic to 104.18.21.94 on port 443 is sent without HTTP header TCP traffic to 104.19.230.21 on port 443 is sent without HTTP header TCP traffic to 104.18.21.177 on port 443 is sent without HTTP header TCP traffic to 3.216.43.198 on port 443 is sent without HTTP header TCP traffic to 18.238.80.38 on port 80 is sent without HTTP header TCP traffic to 151.101.65.21 on port 443 is sent without HTTP header TCP traffic to 142.251.155.4 on port 443 is sent without HTTP header TCP traffic to 142.251.108.95 on port 443 is sent without HTTP header TCP traffic to 142.251.218.99 on port 443 is sent without HTTP header TCP traffic to 18.164.126.61 on port 80 is sent without HTTP header TCP traffic to 52.84.24.24 on port 80 is sent without HTTP header TCP traffic to 150.171.109.72 on port 443 is sent without HTTP header64:T733,RegDeleteValueA RegCloseKey RegCreateKeyExA OpenProcessToken RegOpenKeyExA CreateDirectoryA GetStartupInfoW UnhandledExceptionFilter CreateProcessA LockResource GetFileAttributesA CreateThread GetTempPathA WriteFile GetTempFileNameA GetDriveTypeA Sleep GetSystemInfo GetProcAddress GetTickCount DeleteFileA GetSystemDirectoryA LoadLibraryA GetModuleFileNameA FindNextFileA FindResourceA CreateFileA TerminateProcess FindFirstFileA GetVersionExA LoadLibraryExA GetModuleHandleW RegOpenKeyExW GetUserNameW CreateProcessAsUserW RegCreateKeyExW RegEnumKeyExW CreateProcessWithLogonW SetSecurityDescriptorDacl RegDeleteValueW RegDeleteKeyW IcmpSendEcho DeleteFileW CopyFileExW CreateFileW LoadLibraryW CreateToolhelp32Snapshot Process32NextW ReadProcessMemory GetFileSize GetModuleFileNameW OpenProcess GetSystemDirectoryW CreateDirectoryW GetVersionExW DeviceIoControl ExitThread FindResourceExW WriteProcessMemory GetModuleHandleExW FindNextFileW GetTempFileNameW GetComputerNameW FindFirstFileW GetFileAttributesW FindFirstFileExW CopyFileW CreateProcessW VirtualAllocEx Process32FirstW IsDebuggerPresent GetTempPathW GetCommandLineA OutputDebugStringW VirtualAlloc GetDriveTypeW LoadLibraryExW GetCommandLineW ShellExecuteExW ShellExecuteW GetClipboardData GetWindowThreadProcessId GetCursorPos SetKeyboardState FindWindowExW FindWindowW InternetOpenUrlW InternetCrackUrlW InternetOpenW FtpGetFileSize InternetReadFile InternetCloseHandle InternetQueryDataAvailable InternetConnectW InternetQueryOptionW HttpQueryInfoW FtpOpenFileW HttpSendRequestW connect closesocket listen recv send bind accept socket WSAStartup recvfrom sendto GetFileSizeEx MapViewOfFile GetStartupInfoA GetModuleHandleA OutputDebugStringA CreateFileMappingW65:T632,Wrote 112 instructions to a remote process Wrote 73 instructions to a remote process Wrote 2 instructions to a remote process Wrote 89 instructions to a remote process Wrote 10 instructions to a remote process Wrote 94 instructions to a remote process Wrote 42 instructions to a remote process Wrote 12 instructions to a remote process Wrote 22 instructions to a remote process Wrote 23 instructions to a remote process Wrote 57 instructions to a remote process Wrote 13 instructions to a remote process Wrote 74 instructions to a remote process Wrote 27 instructions to a remote process Wrote 20 instructions to a remote process Wrote 5 instructions to a remote process Wrote 9 instructions to a remote process Wrote 67 instructions to a remote process Wrote 21 instructions to a remote process Wrote 11 instructions to a remote process Wrote 24 instructions to a remote process Wrote 87 instructions to a remote process Wrote 7 instructions to a remote process Wrote 54 instructions to a remote process Wrote 30 instructions to a remote process Wrote 46 instructions to a remote process Wrote 17 instructions to a remote process Wrote 113 instructions to a remote process Wrote 65 instructions to a remote process Wrote 19 instructions to a remote process Wrote 40 instructions to a remote process Wrote 88 instructions to a remote process Wrote 48 instructions to a remote process Wrote 16 instructions to a remote process Wrote 39 instructions to a remote process Wrote 25 instructions to a remote process Wrote 4 instructions to a remote process66:T4af,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "3989b9cdb7533f6a4224d826075e7b68.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002380.00000000.65826.00BEA000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp")67:T471,Found string - str = str.replace(/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g ']');; Source: "prototype-1.7_1_.js") Found string - if ((/^(?:-)?\d+(\.\d+)?(px)?$/i).test(value)) {; Source: "prototype-1.7_1_.js") Found string - !\uff01]/[!\uff01];["\uff02]/["\uff02];[\#\uff03]/[\#\uff03];[\$\uff04]/[\$\uff04];[%\uff05]/[%\uff05];[&\uff06]/[&\uff06];[\u0027\uff07]/[\u0027\uff07];[$\uff08]/[\(\uff08];[$\uff09]/[\)\uff09];[\*\uff0a]/[\*\uff0a];[\+\uff0b]/[\+\uff0b];[ \uff0c]/[ \uff0c];[-\uff0d]/[-\uff0d];[\.\uff0e]/[\.\uff0e];[\u002f\uff0f]/[\u002f\uff0f];[:\uff1a]/[:\uff1a];[\u003b\uff1b]/[\u003b\uff1b];[<\uff1c]/[<\uff1c];[=\uff1d]/[=\uff1d];[>\uff1e]/[>\uff1e];[\?\uff1f]/[\?\uff1f];[@\uff20]/[@\uff20];[\[\uff3b]/[\[\uff3b];[\\\\uff3c]/[\\\\uff3c];[]\uff3d]/[]\uff3d];[\^\uff3e]/[\^\uff3e];[_\uff3f]/[_\uff3f];[`\uff40]/[`\uff40];[\{\uff5b]/[\{\uff5b];[\|\uff5c]/[\|\uff5c];[}\uff5d]/[}\uff5d];[~\uff5e]/[~\uff5e];[\u3002\uff61]/[\u3002\uff61];[\u300C\uff62]/[\u300C\uff62];[\u300D\uff63]/[\u300D\uff63];[\u3001\uff64]/[\u3001\uff64]M; Source: "00000000-00002512.00000001.67053.02CF0000.00000002.mdmp")68:T4d4,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "3989b9cdb7533f6a4224d826075e7b68.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "3989b9cdb7533f6a4224d826075e7b68.exe") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; File: "00000000-00002512.00000000.65906.008B1000.00000020.mdmp") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; File: "00002856.00000B28.48512290.00402000.wprm") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00002380.00000000.65826.00BEA000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00002380.00000000.65826.00BEA000.00000002.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp")69:T536,"AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")6a:Td47,"Select Your Wireless NetworkySelect the network name (SSID) of your wireless network from the list. Network names may take up to 60 seconds to appear." (Source: 00000000-00002512.00000001.67053.02CF0000.00000002.mdmp, Indicator: "select your wireless networkyselect the network name (ssid) of your wireless network from the list. network names may take up to 60 seconds to appear."), "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password and be available to all users." (Source: 00000000-00002512.00000001.67053.02CF0000.00000002.mdmp, Indicator: "select your connection}select your connection from the list. the connection must have a saved user name and password and be available to all users."), "Select Your Set-top Box Brand}Select the brand of your set-top box from the list. If your brand is not listed select Not Listed at the bottom of the list." (Source: 00000000-00002512.00000001.67053.02CF0000.00000002.mdmp, Indicator: "select your set-top box brand}select the brand of your set-top box from the list. if your brand is not listed select not listed at the bottom of the list."), "Select the appropriate display resolution from the list below. For best results use the resolution recommended by the manufacturer in the display hardware documentation." (Source: 00000000-00002512.00000001.67053.02CF0000.00000002.mdmp, Indicator: "select the appropriate display resolution from the list below. for best results use the resolution recommended by the manufacturer in the display hardware documentation."), "insert it into the digital tuner and select Scan Again." (Source: 00000000-00002512.00000001.67053.02CF0000.00000002.mdmp, Indicator: "insert it into the digital tuner and select scan again."), "Select Add Channel to enter the name and channel number for a standard TV channel that is missing from the Guide. To add a digital TV channel select Add DTV Channel." (Source: 00000000-00002512.00000001.67053.02CF0000.00000002.mdmp, Indicator: "select add channel to enter the name and channel number for a standard tv channel that is missing from the guide. to add a digital tv channel select add dtv channel."), "Select OK for more information.ZYour Guide listings include one or more channels that share programming from two networks." (Source: 00000000-00002512.00000001.67053.02CF0000.00000002.mdmp, Indicator: "select ok for more information.zyour guide listings include one or more channels that share programming from two networks."), "Select a folder for backing up or restoring your media usage rights.ORequesting approval to restore media usage rights. This may take a few minutes.&Transferring media usage rights to %s.(Transferring media usage rights from %s." (Source: 00000000-00002512.00000001.67053.02CF0000.00000002.mdmp, Indicator: "select a folder for backing up or restoring your media usage rights.orequesting approval to restore media usage rights. this may take a few minutes.&transferring media usage rights to %s.(transferring media usage rights from %s.") "Delete from &library only$Delete from library and my &computer=Are you sure you want to delete these items from your device?" (Source: 00000000-00002512.00000001.67053.02CF0000.00000002.mdmp, Indicator: "delete from &library only$delete from library and my &computer=are you sure you want to delete these items from your device?")6b:T41b9,"GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 854 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri 10 Nov 2023 19:10:13 GMT Expires: Fri 10 Nov 2023 20:00:13 GMT Cache-Control: public max-age=3000 Age: 1035 Last-Modified: Mon 18 Sep 2023 16:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308203523082013A020101300D06092A864886F70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/moVDfISia2k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 12587 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri 10 Nov 2023 19:25:40 GMT Expires: Fri 10 Nov 2023 20:15:40 GMT Cache-Control: public max-age=3000 Last-Modified: Fri 10 Nov 2023 19:21:53 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 108 with response body ==>308231273082300F020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gsr1/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1739 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri 10 Nov 2023 18:47:28 GMT Expires: Fri 10 Nov 2023 19:37:28 GMT Cache-Control: public max-age=3000 Age: 2400 Last-Modified: Mon 09 Oct 2023 07:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308206C7308205AF020101300D06092A864886F70D01010B05003057310B300906035504061302424531193017060355040A1310476C6F62616C5369676E206E....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 10 Nov 2023 18:49:34 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2275 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 10 Nov 2023 19:00:34 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1616 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 110297 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Fri 10 Nov 2023 19:27:30 GMT Etag: "614b5ba7-243" expires: Sun 12 Nov 2023 19:27:30 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 10 Nov 2023 18:59:15 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1695 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 576 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Fri 10 Nov 2023 19:27:33 GMT Last-Modified: Fri 10 Nov 2023 19:17:57 GMT Server: ECAcc (sac/254E) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 577 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Fri 10 Nov 2023 19:27:34 GMT Last-Modified: Fri 10 Nov 2023 19:17:57 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 10 Nov 2023 18:59:15 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1701 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 10 Nov 2023 19:00:34 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1622 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Fri 10 Nov 2023 18:49:34 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2282 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 110304 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Fri 10 Nov 2023 19:27:37 GMT Etag: "614b5ba7-243" expires: Sun 12 Nov 2023 19:27:37 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 110305 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Fri 10 Nov 2023 19:27:38 GMT Etag: "614b5ba7-243" expires: Sun 12 Nov 2023 19:27:38 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /gts1c3/moVDfISia2k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 12587 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri 10 Nov 2023 19:25:40 GMT Expires: Fri 10 Nov 2023 20:15:40 GMT Cache-Control: public max-age=3000 Last-Modified: Fri 10 Nov 2023 19:21:53 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 124 with response body ==>308231273082300F020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 854 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri 10 Nov 2023 19:10:13 GMT Expires: Fri 10 Nov 2023 20:00:13 GMT Cache-Control: public max-age=3000 Age: 1051 Last-Modified: Mon 18 Sep 2023 16:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308203523082013A020101300D06092A864886F70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5473 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Fri 10 Nov 2023 19:27:44 GMT Last-Modified: Fri 10 Nov 2023 17:56:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /gsr1/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1739 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri 10 Nov 2023 18:47:28 GMT Expires: Fri 10 Nov 2023 19:37:28 GMT Cache-Control: public max-age=3000 Age: 2417 Last-Modified: Mon 09 Oct 2023 07:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308206C7308205AF020101300D06092A864886F70D01010B05003057310B300906035504061302424531193017060355040A1310476C6F62616C5369676E206E....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 110315 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Fri 10 Nov 2023 19:27:48 GMT Etag: "614b5ba7-243" expires: Sun 12 Nov 2023 19:27:48 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 591 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Fri 10 Nov 2023 19:27:48 GMT Last-Modified: Fri 10 Nov 2023 19:17:57 GMT Server: ECAcc (sac/254E) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 591 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Fri 10 Nov 2023 19:27:48 GMT Last-Modified: Fri 10 Nov 2023 19:17:57 GMT Server: ECAcc (sac/253F) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 6062 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Fri 10 Nov 2023 19:27:50 GMT Last-Modified: Fri 10 Nov 2023 17:46:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 110317 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Fri 10 Nov 2023 19:27:50 GMT Etag: "614b5ba7-243" expires: Sun 12 Nov 2023 19:27:50 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603.......6c:T624,file/memory contains long string with (Indicator: "text/javascript"; File: "urlref_httpstwitter.comiflowlogin") Found string "'Accept': 'text/javascript, text/html, application/xml, text/xml, */*'" (Indicator: "text/javascript"; File: "prototype-1.7_1_.js") Found string "" (Indicator: "text/javascript"; File: "WBGUKBSU.htm") Found string "" (Indicator: "text/javascript"; File: "WBGUKBSU.htm") Found string "" (Indicator: "text/javascript"; File: "WBGUKBSU.htm") Found string "" (Indicator: "text/javascript"; File: "WBGUKBSU.htm")6d:T104e,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00002736.00000AB0.10030855938774710.00050000.wprm] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00002380-00000BC1-26186033] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00002380-00000C25-28007407] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00002736-00000BC1-28544477] Observed system executable string:"%WINDIR%\System32\ieframe.dll" [Source: 00000000-00002512-00000C25-30177136] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00002856-00000C25-128799313] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00002856-00000C25-131959919] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00002856-00000C25-136443273] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00002856-00000C25-145773251] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00002856-00000C25-148639736] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00002856-00000C25-153371557] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00002856-00000C25-157334356] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00002856-00000C25-157592534] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00002856-00000C25-158746177] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00002856-00000C25-168574945] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll" [Source: 00000000-00002856-00000C25-170683971] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00002856-00000C25-175623449] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll" [Source: 00000000-00002856-00000C25-177501128] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll" [Source: 00000000-00002856-00000C25-184764710] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" [Source: 00000000-00002856-00000C25-185257922] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00002856-00000C25-191312636] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll" [Source: 00000000-00002856-00000C25-193818053] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" [Source: 00000000-00002856-00000C25-194654652] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll" [Source: 00000000-00002856-00000C25-196235078] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00002856-00000C25-196832737]6e:T430,Found http requests in header "GET /gtsr1/gtsr1.crl" Found http requests in header "GET /gts1c3/moVDfISia2k.crl" Found http requests in header "GET /gsr1/gsr1.crl" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D" Found http requests in header "GET /DigiCertGlobalRootG3.crt" Found http requests in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D" Found http requests in header "POST /loghub/master" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D"6f:T3819,Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.bing.comDNT: 1Connection: Keep-AliveCookie: SRCHD=AF=IESS4A; SRCHUID=V=2&GUID=DD3EB05AD9C54D24A2443E918EB9AD6D&dmnchg=1; SRCHUSR=DOB=20220131&T=1643622536000; _UR=D=0; SRCHHPGUSR=SRCHLANG=en&BRW=HTP&BRH=S&CW=1024&CH=472&SW=1024&SH=611&DPR=1&UTC=60&DM=3&WTS=63779219336&HV=1643615337"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.facebook.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:ZaEa4pcyqrF_yz8zBMkonEYbAX2UVg:Az6zk-P889kzyzL-Connection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyy3V1tc1fSIkDHR0rJpm2ywqyRPLHZ3dAvWT5GzrudlpfezxuMCIJ1USMbc9aGzqC0vaVaKEw HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:_hN1vyGbYWSCSrTF4Uj5fDny4QXPXg:AqqarfRhqc5Gby5ZConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzRbCp84k53nkHTkmNzQ0CqjPmngJeNVm5hnaHsOq2L51pTBU0ZXbZD54nSnd3JZ0cFYbUCsQ&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1274490813%3A1699644442273126&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:X1d34DDkJAWQonGkAijZqd8XvZmxfQ:EQxbwbitMizdkfzhConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:mdi8d8Hv8wEj1l7Ol6UG8lLA3rBeBQ:9huaPOpv4ZyjyYcWConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyxaLm-gVRhGq92CZ2CPHSsxd79Xaqu6km_prxxVrU88vVLgNEP-u8vjxEdrYRzwJIlLbVmw HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:BlddIb088YfXSmN6php6NjJloEsHzw:4lcr68Qzc2rF_JURConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyyULQBsVVSwKqomTmBeybX0rkCP6Lk2yv-H50uanUhLmKYe2GIuVJkE0rj-Z8BfWm_YjpXb_w&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-334715374%3A1699644461497194&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:BlddIb088YfXSmN6php6NjJloEsHzw:4lcr68Qzc2rF_JURConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:VeS9otVHkfFKSVe8ZWZojaoCCBrZbA:16-G95iejgfNpUwU; NID=511=veVG1IFHfCv1rQD7EmQjXvn_WgtwPI1hYibw4NhBoaC3lpVs3jw-h3Anc_IfAXSY6cx7jFWvwE9FL5DvvjKwO7Uc0vNP8v4-KMqzoUkO19X1C8vkpD23t6PduW-f3rKwsBR3HTmFLBwNLF0FExfTZIPPo5oR4UL7n8MEZmpt1Oc"; in File: "SSL") Found requests in header "GET /generate_204?7goxWQ HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:VeS9otVHkfFKSVe8ZWZojaoCCBrZbA:16-G95iejgfNpUwU; NID=511=veVG1IFHfCv1rQD7EmQjXvn_WgtwPI1hYibw4NhBoaC3lpVs3jw-h3Anc_IfAXSY6cx7jFWvwE9FL5DvvjKwO7Uc0vNP8v4-KMqzoUkO19X1C8vkpD23t6PduW-f3rKwsBR3HTmFLBwNLF0FExfTZIPPo5oR4UL7n8MEZmpt1Oc"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:VeS9otVHkfFKSVe8ZWZojaoCCBrZbA:16-G95iejgfNpUwU; OTZ=7289018_52_52_123900_48_436380; NID=511=veVG1IFHfCv1rQD7EmQjXvn_WgtwPI1hYibw4NhBoaC3lpVs3jw-h3Anc_IfAXSY6cx7jFWvwE9FL5DvvjKwO7Uc0vNP8v4-KMqzoUkO19X1C8vkpD23t6PduW-f3rKwsBR3HTmFLBwNLF0FExfTZIPPo5oR4UL7n8MEZmpt1Oc"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=5415972637084333361&bl=boq_identityfrontendauthuiserver_20231105.08_p1&hl=en-US&_reqid=75165&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-334715374:1699644461497194",null,null,"AVQVeyyULQBsVVSwKqomTmBeybX0rkCP6Lk2yv-H50uanUhLmKYe2GIuVJkE0rj-Z8BfWm_YjpXb_w"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:VeS9otVHkfFKSVe8ZWZojaoCCBrZbA:16-G95iejgfNpUwU; OTZ=7289018_52_52_123900_48_436380; NID=511=veVG1IFHfCv1rQD7EmQjXvn_WgtwPI1hYibw4NhBoaC3lpVs3jw-h3Anc_IfAXSY6cx7jFWvwE9FL5DvvjKwO7Uc0vNP8v4-KMqzoUkO19X1C8vkpD23t6PduW-f3rKwsBR3HTmFLBwNLF0FExfTZIPPo5oR4UL7n8MEZmpt1Oc"; in File: "SSL") Found requests in header "GET /generate_204?aO0jHw HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:Fet-j-wP8y4Osiy_O6kbXGaH_DPdig:G4LV-iEON8QRHmhB; OTZ=7289018_52_52_123900_48_436380; NID=511=veVG1IFHfCv1rQD7EmQjXvn_WgtwPI1hYibw4NhBoaC3lpVs3jw-h3Anc_IfAXSY6cx7jFWvwE9FL5DvvjKwO7Uc0vNP8v4-KMqzoUkO19X1C8vkpD23t6PduW-f3rKwsBR3HTmFLBwNLF0FExfTZIPPo5oR4UL7n8MEZmpt1Oc"; in File: "SSL") Found requests in header "GET /v3/signin/_/AccountsSignInUi/gen204/?tmambps=0.000010462807392698946&rtembps=-1&rttms=2 HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:Fet-j-wP8y4Osiy_O6kbXGaH_DPdig:G4LV-iEON8QRHmhB; OTZ=7289018_52_52_123900_48_436380; NID=511=veVG1IFHfCv1rQD7EmQjXvn_WgtwPI1hYibw4NhBoaC3lpVs3jw-h3Anc_IfAXSY6cx7jFWvwE9FL5DvvjKwO7Uc0vNP8v4-KMqzoUkO19X1C8vkpD23t6PduW-f3rKwsBR3HTmFLBwNLF0FExfTZIPPo5oR4UL7n8MEZmpt1Oc"; in File: "SSL") Found requests in header "GET /s/roboto/v18/KFOlCnqEu92Fr1MmWUlfBBc-.woff HTTP/1.1Accept: */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://accounts.google.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /s/roboto/v18/KFOlCnqEu92Fr1MmSU5fBBc-.woff HTTP/1.1Accept: */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://accounts.google.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /s/roboto/v18/KFOkCnqEu92Fr1MmgVxIIzQ.woff HTTP/1.1Accept: */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://accounts.google.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc-.woff HTTP/1.1Accept: */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://accounts.google.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /s/roboto/v18/KFOmCnqEu92Fr1Mu4mxM.woff HTTP/1.1Accept: */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://accounts.google.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comIf-Modified-Since: Mon, 16 Oct 2017 17:32:56 GMTDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLU94YtzCwA.woff HTTP/1.1Accept: */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://accounts.google.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /s/googlesans/v14/4UaGrENHsxJlGDuGo1OIlL3Owpg.woff HTTP/1.1Accept: */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://accounts.google.comAccept-Encoding: gzip, deflateHost: fonts.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.GCB8Z7VaEcs.es5.O/am=DoQVkTg2AIL_Q5Pn7xknhwEAAAAAAAAAANZAdg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHV0fT1U0MjWzo7GD5Q9TVBHIytSg/m=_b,_tp HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.GCB8Z7VaEcs.es5.O/ck=boq-identity.AccountsSignInUi.itPMMHlPnqQ.L.I11.O/am=DoQVkTg2AIL_Q5Pn7xknhwEAAAAAAAAAANZAdg/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEVXp7SRrLvOlyNFSjlGXtxGQiolA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.GCB8Z7VaEcs.es5.O/ck=boq-identity.AccountsSignInUi.itPMMHlPnqQ.L.I11.O/am=DoQVkTg2AIL_Q5Pn7xknhwEAAAAAAAAAANZAdg/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEVXp7SRrLvOlyNFSjlGXtxGQiolA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,Rusgnf,Ctsu,UPKV3d,bPkrc,W2YXuc,pxq3x,IZ1fbc,soHxf,kSPLL,qPfo0c,yRXbo,bTi8wc,ywOR5c,PHUIyb HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL")70:T58b,"" (Indicator: ".onion") in Source: urlref_httpstwitter.comiflowlogin "__d("LowerDomainRegex",[],(function(a,b,c,d,e,f){"use strict";a=/(^|\.)(facebook|facebookcorewwwi|facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd|workplace|bulletin|www.novi)\..*/;b=/\.(facebook\.(sg|net)|facebookcorewwwi\.(?:test)?onion|facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd\.onion|workplace\.com|novi\.com|bulletin\.com)$/;f.domainRegex=a;f.hostnameRegex=b}),66);" (Indicator: ".onion") in Source: sHD0U148vd0_1_.js71:T74c,Observed string: "__d("URISchemes",["$InternalEnum"],(function(a,b,c,d,e,f){"use strict";var g=new Set(["about","accountscenter","aidemos","aistudio","apk","blob","cmms","fb","fba","fbatwork","fb-ama","fb-internal","fb-workchat","fb-workchat-secure","fb-messenger","fb-messenger-public","fb-messenger-group-thread","fb-page-messages","fb-pma","fbcf","fbconnect","fbinternal","fbmobilehome","fbrpc","file","flipper","ftp","gtalk","http","https","mailto","wss","ms-app","intent","itms","itms-apps","itms-services","lasso","market","svn+ssh","fbstaging","tel","sms","pebblejs","sftp","whatsapp","moments","flash","fblite","chrome-extension","webcal","instagram","iglite","fb124024574287414","fb124024574287414rc","fb124024574287414master","fb1576585912599779","fb929757330408142","designpack","fbpixelcloud","fbapi20130214","fb1196383223757595","tbauth","oculus","oculus.store","oculus.feed","oculusstore","socialplatform","odh","com.oculus.rd","aria","skype","ms-windows-store","callto","messenger","workchat","fb236786383180508","fb1775440806014337","data","fb-mk","munki","origami-file","fb-nimble-vrsrecorder","fb-nimble-monohandtrackingvis","together","togetherbl","horizonlauncher","venues","whatsapp-consumer","whatsapp-smb","fb-ide-opener","fb-vscode","fb-vscode-insiders","editor","spark-studio","spark-player","spark-simulator","arstudio","manifold","origami-internal","origami-public","stella","mwa","mattermost","logaggregator","pcoip","cinema","home","oculus360photos","systemux"]),h=b("$InternalEnum")({EXPLICITLY_ALLOWED_SCHEMES_ONLY:"explicitly_allowed_schemes_only",INCLUDE_DEFAULTS:"include_defaults"});function a(a,b,c){b===void 0&&(b=h.INCLUDE_DEFAULTS);return a==null||a===""?!0:(c==null?void 0:c.has(a.toLowerCase()))||b===h.INCLUDE_DEFAULTS&&g.has(a.toLowerCase())}f.Options=h;f.isAllowed=a}),66);" (Indicator: ""sftp") in Source: sHD0U148vd0_1_.js72:T697,"3989b9cdb7533f6a4224d826075e7b68.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00002380) "3989b9cdb7533f6a4224d826075e7b68.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002380) "3989b9cdb7533f6a4224d826075e7b68.exe" called "FindNextFileW" with parameter 3oJ78sj.exe (UID: 00000000-00002380) "3989b9cdb7533f6a4224d826075e7b68.exe" called "FindNextFileW" with parameter DB3VT84.exe (UID: 00000000-00002380) "3989b9cdb7533f6a4224d826075e7b68.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00002380) "3989b9cdb7533f6a4224d826075e7b68.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00002380) "DB3VT84.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00002736) "DB3VT84.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002736) "DB3VT84.exe" called "FindNextFileW" with parameter 1xv00Bc4.exe (UID: 00000000-00002736) "DB3VT84.exe" called "FindNextFileW" with parameter 2TW6263.exe (UID: 00000000-00002736) "1xv00Bc4.exe" called "FindFirstFileW" with parameter %WINDIR%\System32\*.* (UID: 00000000-00002512) "1xv00Bc4.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002512) "1xv00Bc4.exe" called "FindNextFileW" with parameter 0409 (UID: 00000000-00002512) "1xv00Bc4.exe" called "FindNextFileW" with parameter aelupsvc.dll (UID: 00000000-00002512) "1xv00Bc4.exe" called "FindNextFileW" with parameter aepic.dll (UID: 00000000-00002512) "1xv00Bc4.exe" called "FindNextFileW" with parameter aitagent.exe (UID: 00000000-00002512) "1xv00Bc4.exe" called "FindNextFileW" with parameter aitstatic.exe (UID: 00000000-00002512)73:T753,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "3989b9cdb7533f6a4224d826075e7b68.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "3989b9cdb7533f6a4224d826075e7b68.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "00002856.00000B28.48512290.00402000.wprm") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; File: "00002856.00000B28.48512290.00402000.wprm") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "00002856.00000B28.48512290.00402000.wprm") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "00002856.00000B28.48512290.00402000.wprm") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002380.00000000.65826.00BEA000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002380.00000000.65826.00BEA000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp")74:T515,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "3989b9cdb7533f6a4224d826075e7b68.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "3989b9cdb7533f6a4224d826075e7b68.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "3989b9cdb7533f6a4224d826075e7b68.exe") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00002380.00000000.65826.00BEA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00002380.00000000.65826.00BEA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00002380.00000000.65826.00BEA000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp")75:T5f2,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "3989b9cdb7533f6a4224d826075e7b68.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "3989b9cdb7533f6a4224d826075e7b68.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "3989b9cdb7533f6a4224d826075e7b68.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00002380.00000000.65826.00BEA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002380.00000000.65826.00BEA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002380.00000000.65826.00BEA000.00000002.mdmp") Found reference to API "GetUserObjectSecurity" (Indicator: "GetUserObjectSecurity"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00002512.00000000.65906.0094C000.00000002.mdmp")76:Tac7,"AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000006"; Key: "DISPLAYSTRING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000006"; Key: "PROVIDERINFO"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "")77:T13ba,Dropped file: "9DFE38F0CF4E54F251E86E53D05E8885" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\9DFE38F0CF4E54F251E86E53D05E8885]- [targetUID: 00000000-00002988] Dropped file: "WBGUKBSU.htm" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\WBGUKBSU.htm]- [targetUID: 00000000-00003364] Dropped file: "imagestore.dat" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00002348] Dropped file: "77EC63BDA74BD0D0E0426DC8F8008506" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002348] Dropped file: "en-US.4" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00002884] Dropped file: "70DAE932E3BCB3C00656A27B544BA9CA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70DAE932E3BCB3C00656A27B544BA9CA]- [targetUID: 00000000-00003964] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00002348] Dropped file: "AE583B12017CC3ACE1D659336529BFB3" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\AE583B12017CC3ACE1D659336529BFB3]- [targetUID: 00000000-00003272] Dropped file: "4748633DC5731827D4B432DBAC7A3ECE" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\4748633DC5731827D4B432DBAC7A3ECE]- [targetUID: 00000000-00003696] Dropped file: "69C6F6EC64E114822DF688DC12CDD86C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C]- [targetUID: 00000000-00002348] Dropped file: "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00003696] Dropped file: "6B2043001D270792DFFD725518EAFE2C" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C]- [targetUID: 00000000-00003272] Dropped file: "MEE6ZHDN.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\MEE6ZHDN.txt]- [targetUID: 00000000-00002924] Dropped file: "DG2QWE1F.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\DG2QWE1F.txt]- [targetUID: 00000000-00003364] Dropped file: "A16C6C16D94F76E0808C087DFC657D99_5B226F2301FD399CF34ABA67B4DC6AC8" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_5B226F2301FD399CF34ABA67B4DC6AC8]- [targetUID: 00000000-00003696] Dropped file: "59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD]- [targetUID: 00000000-00002988] Dropped file: "E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF]- [targetUID: 00000000-00003644] Dropped file: "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00002348] Dropped file: "F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC]- [targetUID: 00000000-00003696] Dropped file: "A16C6C16D94F76E0808C087DFC657D99_5B226F2301FD399CF34ABA67B4DC6AC8" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_5B226F2301FD399CF34ABA67B4DC6AC8]- [targetUID: 00000000-00003696] Dropped file: "59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD]- [targetUID: 00000000-00002988] Dropped file: "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00002348] Dropped file: "E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF]- [targetUID: 00000000-00003644] Dropped file: "NUKWTTX4.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\NUKWTTX4.txt]- [targetUID: 00000000-00002988] Dropped file: "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00003696]78:Tc006,"initAft()