26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 77:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4dd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample fa0a470a4f76… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fa0a470a4f76…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 11/25 AV engines flagged this file. 26 malicious and 32 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5"],"about":{"@type":"SoftwareApplication","name":"4e5e41c05d7b9be4515a5885fbd52573.exe","applicationCategory":["peexe","executable"],"identifier":"fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":11,"total":25},"behavioralIndicators":{"malicious":26,"suspicious":32},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T25c4,Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolder"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBeep"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")28:Ta03,"1LX41PH4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008") "1LX41PH4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009") "1LX41PH4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000010") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000010") "1LX41PH4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000011") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000011") "1LX41PH4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000012") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000012") "1LX41PH4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000013") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000013") "1LX41PH4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000014") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000014") "1LX41PH4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000015") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000015") "1LX41PH4.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000016")29:T131e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-15-00A51F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-15-00A51F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-16-00A544B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-16-00A544B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-22-00A5681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-22-00A5681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-26-00A524E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-26-00A524E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-29-00A552B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-29-00A552B6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003960-39425-31-00A52390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003960-39425-31-00A52390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-33-00A52F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-33-00A52F1D Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003960-39425-36-00A53BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003960-39425-36-00A53BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-37-00A53FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-37-00A53FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-40-00A52267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-40-00A52267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-41-00A56495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-41-00A56495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-42-00A5202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00003960-39425-42-00A5202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-42-00A5202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-43-00A51AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-43-00A51AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-44-00A52AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-44-00A52AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-52-00A54EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-52-00A54EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-57-00A56298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-57-00A56298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-59-00A5621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-59-00A5621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-60-00A5597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-60-00A5597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-62-00A555A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-62-00A555A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-63-00A55467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-63-00A55467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-65-00A553A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-65-00A553A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-66-00A52630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-66-00A52630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-71-00A52CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-71-00A52CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-72-00A518A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-72-00A518A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003960-39425-73-00A517EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003960-39425-73-00A517EE2a:Tdcb8,Found XOR loop in file "gh4wl01.exe" at offset 265710; code bytes = 30d0 Found XOR loop in file "gh4wl01.exe" at offset 288515; code bytes = 30d0 Found XOR loop in file "gh4wl01.exe" at offset 305408; code bytes = 30d0 Found XOR loop in file "gh4wl01.exe" at offset 476331; code bytes = 30d0 Found XOR loop in file "gh4wl01.exe" at offset 581112; code bytes = 30d0 Found XOR loop in file "gh4wl01.exe" at offset 759466; code bytes = 30d0 Found XOR loop in file "gh4wl01.exe" at offset 816214; code bytes = 30d0 Found XOR loop in file "gh4wl01.exe" at offset 931165; code bytes = 30d0 Found XOR loop in file "gh4wl01.exe" at offset 1106065; code bytes = 30d0 Found XOR loop in file "gh4wl01.exe" at offset 1135383; code bytes = 30d0 Found XOR loop in file "gh4wl01.exe" at offset 1149960; code bytes = 30d0 Found XOR loop in file "gh4wl01.exe" at offset 1208382; code bytes = 30d0 Found XOR loop in file "gh4wl01.exe" at offset 1215984; code bytes = 30d0 Found XOR loop in file "gh4wl01.exe" at offset 1243643; code bytes = 30d0 Found XOR loop in file "gh4wl01.exe" at offset 1370600; code bytes = 30d0 Found XOR loop in file "gh4wl01.exe" at offset 1423450; code bytes = 30d0 Found XOR loop in file "gh4wl01.exe" at offset 1464857; code bytes = 30d0 Found XOR loop in file "gh4wl01.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "gh4wl01.exe" at offset 287944; code bytes = 33c1 Found XOR loop in file "gh4wl01.exe" at offset 372059; code bytes = 33c1 Found XOR loop in file "gh4wl01.exe" at offset 540385; code bytes = 33c1 Found XOR loop in file "gh4wl01.exe" at offset 567291; code bytes = 33c1 Found XOR loop in file "gh4wl01.exe" at offset 742153; code bytes = 33c1 Found XOR loop in file "gh4wl01.exe" at offset 764331; code bytes = 33c1 Found XOR loop in file "gh4wl01.exe" at offset 871142; code bytes = 33c1 Found XOR loop in file "gh4wl01.exe" at offset 892172; code bytes = 33c1 Found XOR loop in file "gh4wl01.exe" at offset 945232; code bytes = 33c1 Found XOR loop in file "gh4wl01.exe" at offset 1061799; code bytes = 33c1 Found XOR loop in file "gh4wl01.exe" at offset 1460182; code bytes = 33c1 Found XOR loop in file "gh4wl01.exe" at offset 1578384; code bytes = 33c1 Found XOR loop in file "gh4wl01.exe" at offset 1619033; code bytes = 33c1 Found XOR loop in file "gh4wl01.exe" at offset 1646009; code bytes = 33c1 Found XOR loop in file "gh4wl01.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 201749; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 223497; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 338002; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 556373; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 556657; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 660365; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 669713; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 684829; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 806633; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 858743; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 960128; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 1014480; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 1051914; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 1113260; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 1207033; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 1225959; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 1252057; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 1294579; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 1294645; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 1424055; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 1443781; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 1468058; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 1560274; code bytes = 8030 Found XOR loop in file "gh4wl01.exe" at offset 1593269; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 1274152; code bytes = 30d0 Found XOR loop in file "1LX41PH4.exe" at offset 1287765; code bytes = 30d0 Found XOR loop in file "1LX41PH4.exe" at offset 1485168; code bytes = 30d0 Found XOR loop in file "1LX41PH4.exe" at offset 1507775; code bytes = 30d0 Found XOR loop in file "1LX41PH4.exe" at offset 1514635; code bytes = 30d0 Found XOR loop in file "1LX41PH4.exe" at offset 1514887; code bytes = 30d0 Found XOR loop in file "1LX41PH4.exe" at offset 1515347; code bytes = 30d0 Found XOR loop in file "1LX41PH4.exe" at offset 1516553; code bytes = 30d0 Found XOR loop in file "1LX41PH4.exe" at offset 1521461; code bytes = 30d0 Found XOR loop in file "1LX41PH4.exe" at offset 1522625; code bytes = 30d0 Found XOR loop in file "1LX41PH4.exe" at offset 1538921; code bytes = 30d0 Found XOR loop in file "1LX41PH4.exe" at offset 688249; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 688345; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 688444; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 688500; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 688526; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 688604; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 688747; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 688843; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 689850; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 690446; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 764137; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 817238; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 817472; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 909588; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 924330; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 942350; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 948128; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 953465; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 953616; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 969842; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 971092; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 983876; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 985045; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 985160; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 989471; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 989786; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 990362; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 992172; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 992479; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 992865; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 992957; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 993612; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 995617; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 999815; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 1000389; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 1001271; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 1001375; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 1002055; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 1002170; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 1006463; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 1007340; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 1027259; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 1033356; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 1034159; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 1289436; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 1441388; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 1505345; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 1507059; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 1513223; code bytes = 33c1 Found XOR loop in file "1LX41PH4.exe" at offset 735579; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 735612; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 735686; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 735764; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 735781; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 735802; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 735842; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 735923; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 735946; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 735963; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 736030; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 736068; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 736997; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 737018; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 833270; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 838380; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 845494; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 845523; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 857223; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 869347; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 869366; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 869863; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 925121; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 925175; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 925196; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 925223; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 925256; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 925280; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 925297; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 925319; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 925429; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 925471; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 1337260; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 1349610; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 1362066; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 1495860; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 1517374; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 1521442; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 1522614; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 1523404; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 1537116; code bytes = 8030 Found XOR loop in file "1LX41PH4.exe" at offset 1538890; code bytes = 8030 Found XOR loop in file "2Cg5677.exe" at offset 834088; code bytes = 30d0 Found XOR loop in file "2Cg5677.exe" at offset 1141197; code bytes = 30d0 Found XOR loop in file "2Cg5677.exe" at offset 1152317; code bytes = 30d0 Found XOR loop in file "2Cg5677.exe" at offset 1154881; code bytes = 30d0 Found XOR loop in file "2Cg5677.exe" at offset 1155743; code bytes = 30d0 Found XOR loop in file "2Cg5677.exe" at offset 1157399; code bytes = 30d0 Found XOR loop in file "2Cg5677.exe" at offset 89010; code bytes = 33c1 Found XOR loop in file "2Cg5677.exe" at offset 148580; code bytes = 33c1 Found XOR loop in file "2Cg5677.exe" at offset 148752; code bytes = 33c1 Found XOR loop in file "2Cg5677.exe" at offset 149045; code bytes = 33c1 Found XOR loop in file "2Cg5677.exe" at offset 154932; code bytes = 33c1 Found XOR loop in file "2Cg5677.exe" at offset 155104; code bytes = 33c1 Found XOR loop in file "2Cg5677.exe" at offset 155397; code bytes = 33c1 Found XOR loop in file "2Cg5677.exe" at offset 181222; code bytes = 33c1 Found XOR loop in file "2Cg5677.exe" at offset 277995; code bytes = 33c1 Found XOR loop in file "2Cg5677.exe" at offset 678287; code bytes = 33c1 Found XOR loop in file "2Cg5677.exe" at offset 915158; code bytes = 33c1 Found XOR loop in file "2Cg5677.exe" at offset 1149387; code bytes = 33c1 Found XOR loop in file "2Cg5677.exe" at offset 622993; code bytes = 8030 Found XOR loop in file "2Cg5677.exe" at offset 625199; code bytes = 8030 Found XOR loop in file "2Cg5677.exe" at offset 629564; code bytes = 8030 Found XOR loop in file "2Cg5677.exe" at offset 632680; code bytes = 8030 Found XOR loop in file "2Cg5677.exe" at offset 796692; code bytes = 8030 Found XOR loop in file "2Cg5677.exe" at offset 811562; code bytes = 8030 Found XOR loop in file "2Cg5677.exe" at offset 951066; code bytes = 8030 Found XOR loop in file "2Cg5677.exe" at offset 967668; code bytes = 8030 Found XOR loop in file "2Cg5677.exe" at offset 1146358; code bytes = 8030 Found XOR loop in file "2Cg5677.exe" at offset 1152284; code bytes = 8030 Found XOR loop in file "2Cg5677.exe" at offset 1156962; code bytes = 8030 Found XOR loop in file "2Cg5677.exe" at offset 1164451; code bytes = 8030 Found XOR loop in file "2Cg5677.exe" at offset 1165667; code bytes = 8030 Found XOR loop in file "IU0bP67.exe" at offset 144820; code bytes = 30d0 Found XOR loop in file "IU0bP67.exe" at offset 148265; code bytes = 30d0 Found XOR loop in file "IU0bP67.exe" at offset 209594; code bytes = 30d0 Found XOR loop in file "IU0bP67.exe" at offset 380444; code bytes = 30d0 Found XOR loop in file "IU0bP67.exe" at offset 485169; code bytes = 30d0 Found XOR loop in file "IU0bP67.exe" at offset 663443; code bytes = 30d0 Found XOR loop in file "IU0bP67.exe" at offset 720166; code bytes = 30d0 Found XOR loop in file "IU0bP67.exe" at offset 835052; code bytes = 30d0 Found XOR loop in file "IU0bP67.exe" at offset 1009864; code bytes = 30d0 Found XOR loop in file "IU0bP67.exe" at offset 1039174; code bytes = 30d0 Found XOR loop in file "IU0bP67.exe" at offset 1053743; code bytes = 30d0 Found XOR loop in file "IU0bP67.exe" at offset 1112140; code bytes = 30d0 Found XOR loop in file "IU0bP67.exe" at offset 1119734; code bytes = 30d0 Found XOR loop in file "IU0bP67.exe" at offset 1147368; code bytes = 30d0 Found XOR loop in file "IU0bP67.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "IU0bP67.exe" at offset 175297; code bytes = 33c1 Found XOR loop in file "IU0bP67.exe" at offset 276213; code bytes = 33c1 Found XOR loop in file "IU0bP67.exe" at offset 444466; code bytes = 33c1 Found XOR loop in file "IU0bP67.exe" at offset 471348; code bytes = 33c1 Found XOR loop in file "IU0bP67.exe" at offset 646138; code bytes = 33c1 Found XOR loop in file "IU0bP67.exe" at offset 668291; code bytes = 33c1 Found XOR loop in file "IU0bP67.exe" at offset 775062; code bytes = 33c1 Found XOR loop in file "IU0bP67.exe" at offset 796084; code bytes = 33c1 Found XOR loop in file "IU0bP67.exe" at offset 849119; code bytes = 33c1 Found XOR loop in file "IU0bP67.exe" at offset 965622; code bytes = 33c1 Found XOR loop in file "IU0bP67.exe" at offset 1155001; code bytes = 33c1 Found XOR loop in file "IU0bP67.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "IU0bP67.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "IU0bP67.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "IU0bP67.exe" at offset 242180; code bytes = 8030 Found XOR loop in file "IU0bP67.exe" at offset 460446; code bytes = 8030 Found XOR loop in file "IU0bP67.exe" at offset 460730; code bytes = 8030 Found XOR loop in file "IU0bP67.exe" at offset 564382; code bytes = 8030 Found XOR loop in file "IU0bP67.exe" at offset 573730; code bytes = 8030 Found XOR loop in file "IU0bP67.exe" at offset 588846; code bytes = 8030 Found XOR loop in file "IU0bP67.exe" at offset 710585; code bytes = 8030 Found XOR loop in file "IU0bP67.exe" at offset 762663; code bytes = 8030 Found XOR loop in file "IU0bP67.exe" at offset 863991; code bytes = 8030 Found XOR loop in file "IU0bP67.exe" at offset 918327; code bytes = 8030 Found XOR loop in file "IU0bP67.exe" at offset 955737; code bytes = 8030 Found XOR loop in file "IU0bP67.exe" at offset 1017051; code bytes = 8030 Found XOR loop in file "IU0bP67.exe" at offset 1110791; code bytes = 8030 Found XOR loop in file "IU0bP67.exe" at offset 1129692; code bytes = 8030 Found XOR loop in file "VF0xM38.exe" at offset 273895; code bytes = 30d0 Found XOR loop in file "VF0xM38.exe" at offset 329386; code bytes = 30d0 Found XOR loop in file "VF0xM38.exe" at offset 390149; code bytes = 30d0 Found XOR loop in file "VF0xM38.exe" at offset 568326; code bytes = 30d0 Found XOR loop in file "VF0xM38.exe" at offset 625016; code bytes = 30d0 Found XOR loop in file "VF0xM38.exe" at offset 739845; code bytes = 30d0 Found XOR loop in file "VF0xM38.exe" at offset 914585; code bytes = 30d0 Found XOR loop in file "VF0xM38.exe" at offset 943870; code bytes = 30d0 Found XOR loop in file "VF0xM38.exe" at offset 958431; code bytes = 30d0 Found XOR loop in file "VF0xM38.exe" at offset 1005612; code bytes = 30d0 Found XOR loop in file "VF0xM38.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "VF0xM38.exe" at offset 147919; code bytes = 33c1 Found XOR loop in file "VF0xM38.exe" at offset 349454; code bytes = 33c1 Found XOR loop in file "VF0xM38.exe" at offset 376328; code bytes = 33c1 Found XOR loop in file "VF0xM38.exe" at offset 551029; code bytes = 33c1 Found XOR loop in file "VF0xM38.exe" at offset 573174; code bytes = 33c1 Found XOR loop in file "VF0xM38.exe" at offset 679887; code bytes = 33c1 Found XOR loop in file "VF0xM38.exe" at offset 700901; code bytes = 33c1 Found XOR loop in file "VF0xM38.exe" at offset 753904; code bytes = 33c1 Found XOR loop in file "VF0xM38.exe" at offset 870351; code bytes = 33c1 Found XOR loop in file "VF0xM38.exe" at offset 1028537; code bytes = 33c1 Found XOR loop in file "VF0xM38.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "VF0xM38.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "VF0xM38.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "VF0xM38.exe" at offset 185308; code bytes = 8030 Found XOR loop in file "VF0xM38.exe" at offset 288876; code bytes = 8030 Found XOR loop in file "VF0xM38.exe" at offset 365426; code bytes = 8030 Found XOR loop in file "VF0xM38.exe" at offset 365710; code bytes = 8030 Found XOR loop in file "VF0xM38.exe" at offset 469321; code bytes = 8030 Found XOR loop in file "VF0xM38.exe" at offset 478653; code bytes = 8030 Found XOR loop in file "VF0xM38.exe" at offset 493761; code bytes = 8030 Found XOR loop in file "VF0xM38.exe" at offset 615443; code bytes = 8030 Found XOR loop in file "VF0xM38.exe" at offset 667505; code bytes = 8030 Found XOR loop in file "VF0xM38.exe" at offset 768776; code bytes = 8030 Found XOR loop in file "VF0xM38.exe" at offset 823080; code bytes = 8030 Found XOR loop in file "VF0xM38.exe" at offset 860482; code bytes = 8030 Found XOR loop in file "VF0xM38.exe" at offset 921764; code bytes = 8030 Found XOR loop in file "5QU4Dk7.exe" at offset 916941; code bytes = 30d0 Found XOR loop in file "5QU4Dk7.exe" at offset 928061; code bytes = 30d0 Found XOR loop in file "5QU4Dk7.exe" at offset 930625; code bytes = 30d0 Found XOR loop in file "5QU4Dk7.exe" at offset 931481; code bytes = 30d0 Found XOR loop in file "5QU4Dk7.exe" at offset 932265; code bytes = 30d0 Found XOR loop in file "5QU4Dk7.exe" at offset 89010; code bytes = 33c1 Found XOR loop in file "5QU4Dk7.exe" at offset 148580; code bytes = 33c1 Found XOR loop in file "5QU4Dk7.exe" at offset 148752; code bytes = 33c1 Found XOR loop in file "5QU4Dk7.exe" at offset 149045; code bytes = 33c1 Found XOR loop in file "5QU4Dk7.exe" at offset 154932; code bytes = 33c1 Found XOR loop in file "5QU4Dk7.exe" at offset 155104; code bytes = 33c1 Found XOR loop in file "5QU4Dk7.exe" at offset 155397; code bytes = 33c1 Found XOR loop in file "5QU4Dk7.exe" at offset 181222; code bytes = 33c1 Found XOR loop in file "5QU4Dk7.exe" at offset 277995; code bytes = 33c1 Found XOR loop in file "5QU4Dk7.exe" at offset 678287; code bytes = 33c1 Found XOR loop in file "5QU4Dk7.exe" at offset 925131; code bytes = 33c1 Found XOR loop in file "5QU4Dk7.exe" at offset 622993; code bytes = 8030 Found XOR loop in file "5QU4Dk7.exe" at offset 625199; code bytes = 8030 Found XOR loop in file "5QU4Dk7.exe" at offset 629564; code bytes = 8030 Found XOR loop in file "5QU4Dk7.exe" at offset 632680; code bytes = 8030 Found XOR loop in file "5QU4Dk7.exe" at offset 796692; code bytes = 8030 Found XOR loop in file "5QU4Dk7.exe" at offset 811562; code bytes = 8030 Found XOR loop in file "5QU4Dk7.exe" at offset 922102; code bytes = 8030 Found XOR loop in file "5QU4Dk7.exe" at offset 928028; code bytes = 8030 Found XOR loop in file "5QU4Dk7.exe" at offset 939683; code bytes = 8030 Found XOR loop in file "5QU4Dk7.exe" at offset 940899; code bytes = 8030 Found XOR loop in file "4yx631Rh.exe" at offset 72323; code bytes = 30d0 Found XOR loop in file "4yx631Rh.exe" at offset 122082; code bytes = 30d0 Found XOR loop in file "4yx631Rh.exe" at offset 376916; code bytes = 30d0 Found XOR loop in file "4yx631Rh.exe" at offset 376937; code bytes = 30d0 Found XOR loop in file "4yx631Rh.exe" at offset 691258; code bytes = 30d0 Found XOR loop in file "4yx631Rh.exe" at offset 887915; code bytes = 30d0 Found XOR loop in file "4yx631Rh.exe" at offset 888929; code bytes = 30d0 Found XOR loop in file "4yx631Rh.exe" at offset 891921; code bytes = 30d0 Found XOR loop in file "4yx631Rh.exe" at offset 900833; code bytes = 30d0 Found XOR loop in file "4yx631Rh.exe" at offset 913601; code bytes = 30d0 Found XOR loop in file "4yx631Rh.exe" at offset 130790; code bytes = 33c1 Found XOR loop in file "4yx631Rh.exe" at offset 140043; code bytes = 33c1 Found XOR loop in file "4yx631Rh.exe" at offset 140172; code bytes = 33c1 Found XOR loop in file "4yx631Rh.exe" at offset 351053; code bytes = 33c1 Found XOR loop in file "4yx631Rh.exe" at offset 463773; code bytes = 33c1 Found XOR loop in file "4yx631Rh.exe" at offset 463848; code bytes = 33c1 Found XOR loop in file "4yx631Rh.exe" at offset 597022; code bytes = 33c1 Found XOR loop in file "4yx631Rh.exe" at offset 701978; code bytes = 33c1 Found XOR loop in file "4yx631Rh.exe" at offset 709317; code bytes = 33c1 Found XOR loop in file "4yx631Rh.exe" at offset 709765; code bytes = 33c1 Found XOR loop in file "4yx631Rh.exe" at offset 710341; code bytes = 33c1 Found XOR loop in file "4yx631Rh.exe" at offset 710789; code bytes = 33c1 Found XOR loop in file "4yx631Rh.exe" at offset 895349; code bytes = 33c1 Found XOR loop in file "4yx631Rh.exe" at offset 905289; code bytes = 33c1 Found XOR loop in file "4yx631Rh.exe" at offset 1330; code bytes = 8030 Found XOR loop in file "4yx631Rh.exe" at offset 1959; code bytes = 8030 Found XOR loop in file "4yx631Rh.exe" at offset 232120; code bytes = 8030 Found XOR loop in file "4yx631Rh.exe" at offset 356589; code bytes = 8030 Found XOR loop in file "4yx631Rh.exe" at offset 674772; code bytes = 8030 Found XOR loop in file "4yx631Rh.exe" at offset 687130; code bytes = 8030 Found XOR loop in file "4yx631Rh.exe" at offset 887876; code bytes = 8030 Found XOR loop in file "4yx631Rh.exe" at offset 890824; code bytes = 8030 Found XOR loop in file "4yx631Rh.exe" at offset 894056; code bytes = 8030 Found XOR loop in file "4yx631Rh.exe" at offset 913562; code bytes = 8030 Found XOR loop in file "3fH86hE.exe" at offset 1293; code bytes = 30d0 Found XOR loop in file "3fH86hE.exe" at offset 1173; code bytes = 8030 Found XOR loop in file "3fH86hE.exe" at offset 24690; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1274152; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1287765; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1485168; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1507775; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1514635; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1514887; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1515347; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1516553; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1521461; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1522625; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1538921; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 688249; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688345; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688444; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688500; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688526; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688604; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688747; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688843; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 689850; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 690446; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 764137; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 817238; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 817472; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 909588; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 924330; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 942350; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 948128; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 953465; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 953616; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 969842; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 971092; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 983876; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 985045; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 985160; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 989471; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 989786; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 990362; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 992172; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 992479; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 992865; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 992957; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 993612; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 995617; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 999815; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1000389; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1001271; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1001375; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1002055; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1002170; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1006463; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1007340; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1027259; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1033356; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1034159; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1289436; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1441388; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1505345; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1507059; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1513223; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 735579; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735612; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735686; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735764; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735781; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735802; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735842; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735923; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735946; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735963; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 736030; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 736068; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 736997; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 737018; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 833270; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 838380; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 845494; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 845523; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 857223; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 869347; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 869366; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 869863; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925121; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925175; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925196; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925223; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925256; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925280; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925297; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925319; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925429; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925471; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1337260; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1349610; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1362066; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1495860; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1517374; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1521442; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1522614; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1523404; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1537116; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1538890; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1274152; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1287765; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1485168; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1507775; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1514635; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1514887; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1515347; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1516553; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1521461; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1522625; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1538921; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688249; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688345; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688444; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688500; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688526; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688604; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688747; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688843; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 689850; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 690446; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 764137; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 817238; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 817472; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 909588; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 924330; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 942350; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 948128; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 953465; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 953616; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 969842; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 971092; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 983876; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 985045; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 985160; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 989471; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 989786; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 990362; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 992172; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 992479; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 992865; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 992957; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 993612; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 995617; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 999815; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1000389; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1001271; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1001375; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1002055; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1002170; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1006463; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1007340; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1027259; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1033356; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1034159; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1289436; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1441388; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1505345; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1507059; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1513223; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735579; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735612; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735686; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735764; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735781; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735802; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735842; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735923; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735946; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735963; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 736030; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 736068; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 736997; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 737018; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 833270; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 838380; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 845494; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 845523; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 857223; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 869347; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 869366; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 869863; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925121; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925175; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925196; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925223; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925256; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925280; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925297; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925319; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925429; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925471; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1337260; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1349610; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1362066; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1495860; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1517374; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1521442; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1522614; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1523404; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1537116; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1538890; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1274152; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1287765; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1485168; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1507775; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1514635; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1514887; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1515347; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1516553; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1521461; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1522625; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1538921; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688249; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688345; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688444; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688500; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688526; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688604; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688747; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688843; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 689850; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 690446; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 764137; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 817238; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 817472; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 909588; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 924330; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 942350; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 948128; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 953465; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 953616; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 969842; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 971092; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 983876; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 985045; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 985160; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 989471; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 989786; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 990362; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 992172; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 992479; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 992865; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 992957; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 993612; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 995617; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 999815; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1000389; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1001271; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1001375; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1002055; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1002170; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1006463; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1007340; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1027259; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1033356; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1034159; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1289436; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1441388; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1505345; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1507059; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1513223; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735579; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735612; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735686; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735764; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735781; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735802; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735842; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735923; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735946; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735963; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 736030; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 736068; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 736997; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 737018; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 833270; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 838380; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 845494; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 845523; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 857223; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 869347; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 869366; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 869863; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925121; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925175; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925196; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925223; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925256; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925280; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925297; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925319; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925429; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925471; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1337260; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1349610; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1362066; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1495860; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1517374; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1521442; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1522614; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1523404; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1537116; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1538890; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 361252; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 384074; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 400975; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 571989; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 676810; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 855261; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 912033; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1027048; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1202021; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1274962; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1286375; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1304382; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1311992; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1339651; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1466674; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1519556; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1560988; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1775640; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1906799; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1972514; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 26031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 175490; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 210389; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 383503; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 467659; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 636075; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 662989; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 837940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 860126; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 966993; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 988031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1041115; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1157730; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1556313; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1674564; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1715238; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1775909; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1797211; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1813633; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1895896; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1901596; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1904570; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1906041; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2001959; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2019475; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2024889; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 90891; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 102399; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 103104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 143652; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 297259; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 319023; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 433577; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 652063; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 652347; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 756103; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 765467; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 780583; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 902452; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 954578; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1056019; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1110395; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1147845; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1209216; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1253199; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1268815; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1270540; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1270777; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1303033; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1321967; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1348073; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1390620; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1390686; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1520161; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1539895; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1564189; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1656446; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1689466; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1737851; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1808901; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1813899; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1832777; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1900501; code bytes = 80302b:T774,Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00002860.00000002.87723.010C7000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00002860.00000002.87723.010C7000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002860.00000002.87723.010C7000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00002860.00000002.87723.010C7000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00002860.00000002.87723.010C7000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002860.00000002.87723.010C7000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00002860.00000002.87723.010C7000.00000002.mdmp")2c:T3de9,"fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003960) "gh4wl01.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001544) "gh4wl01.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001544) "IU0bP67.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003192) "IU0bP67.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003192) "VF0xM38.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003612) "1LX41PH4.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002860) "1LX41PH4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002860) "1LX41PH4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000ee6ae17e4ccd23004ccd23001e750f6800000000a851300084d423008401000000000000000000000000000028d223005ecbdb758401000000000000005dd97584d423000e5dd9751cd02300dcaadd75010000000000000072000000ffffffffffffffffa4cd2300780200000000000025000000a4cd23007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036006b82f97efccd23006d82a3750c57300004010000 (UID: 00000000-00002860) "1LX41PH4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005c0003000000000000000200000028973000a0312f00e86c28003200020001000000bc0200000e0000000000000000000000a8312f008a0200000d000000b0712800050000000000000032000000089f30001cb92300cc4123772897300028000000fc000000ff2b22770cdb1a77d8ebb776ac012800000028002c002000010000000000ffffa603000004000000010000002d001b000100000046000000010000000000000000000000f86f2800f8070000200000000000000000000000a0312f00e86c2800086e280008983000b07128000000000098b823000000000018ba2300 (UID: 00000000-00002860) "1LX41PH4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff2d000d0004000000620bdb7500000000f86f2800000000005000000024a3300002000000a8892f0000000000010000085039310020742800380bdb7530cc230002000000e4cc23003f08997502000000a8892f00000000000100001888fb9875d4cc2300c81cdd75aace230095fb987508ce2300a8892f0000000000000000000000000090cd2300000028007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036008782f97e50cd23006d82a3750c57300004010000 (UID: 00000000-00002860) "1LX41PH4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600ff89f97e68c623006d82a375e4b4320004010000 (UID: 00000000-00002860) "1LX41PH4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000d86f3300c82f2800d610000000c0230067e51f7700002800b8c33200000000000000280000000000b8c33200000000005c10004c0000000090c73200d86f330078b33200003b00000000280000000000b8c332000000280078c032000000000034000135e8a21a770000000000002800a8c5320000000000000028000000100078c0320028c12300046422777b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600338ff97ea4c023006d82a37524b9320004010000 (UID: 00000000-00002860) "1LX41PH4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000230098cf0f76a033db75fe57db75054000803cda23000000000043003a005c00550073006500720073005c0048004100500055004200570053000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600d7f5f97e80ba23006d82a375d4d3330004010000 (UID: 00000000-00002860) "1LX41PH4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003300f83b0000ff07000000002800000000007f070000c4002800c82f28009c760000f0b9230067e51f770000280000db330000000000000028000000000000db3300000000004876003e80000000a8dd3300c4002800d0493300003b0000000028000000000000db3300201f000000002800f8d73300f83b0000ff07000000002800000000007f070000c40028007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600d7f5f97e80ba23006d82a375f4d5330004010000 (UID: 00000000-00002860) "1LX41PH4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003300f83b0000ff07000000002800000000007f070000c4002800c82f280058760000f0b9230067e51f770000280020dd330000000000000028000000000020dd3300000000000476007280000000c8df3300c4002800d0493300003b0000000028000000000020dd3300201f00000000280018da3300f83b0000ff07000000002800000000007f070000c40028007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600d7f5f97e80ba23006d82a3759cd7330004010000 (UID: 00000000-00002860) "1LX41PH4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003300f83b0000ff07000000002800000000007f070000c4002800c82f280023760000f0b9230067e51f7700002800c8de3300000000000000280000000000c8de330000000000cf7500ba8000000070e13300c400280048fd3200003b00000000280000000000c8de3300201f000000002800c0db3300f83b0000ff07000000002800000000007f070000c40028007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600d7f5f97e80ba23006d82a375ccd8330004010000 (UID: 00000000-00002860) "1LX41PH4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003300f83b0000ff07000000002800000000007f070000c4002800c82f2800fd750000f0b9230067e51f7700002800f8df3300000000000000280000000000f8df330000000000a97500dc80000000a0e23300c400280048fd3200003b00000000280000000000f8df3300201f000000002800f0dc3300f83b0000ff07000000002800000000007f070000c40028007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600d7f5f97e80ba23006d82a375fcd9330004010000 (UID: 00000000-00002860) "1LX41PH4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003300f83b0000ff07000000002800000000007f070000c4002800c82f2800d7750000f0b9230067e51f770000280028e1330000000000000028000000000028e1330000000000837500f680000000d0e33300c400280048fd3200003b0000000028000000000028e13300201f00000000280020de3300f83b0000ff07000000002800000000007f070000c40028007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600d7f5f97e80ba23006d82a37524db330004010000 (UID: 00000000-00002860) "1LX41PH4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003300f83b0000ff07000000002800000000007f070000c4002800c82f2800b2750000f0b9230067e51f770000280050e2330000000000000028000000000050e23300000000005e75002b80000000f8e43300c400280048fd3200003b0000000028000000000050e23300201f00000000280048df3300f83b0000ff07000000002800000000007f070000c40028007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600d7f5f97e80ba23006d82a37554dc330004010000 (UID: 00000000-00002860) "1LX41PH4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003300f83b0000ff07000000002800000000007f070000c4002800c82f28008c750000f0b9230067e51f770000280080e3330000000000000028000000000080e33300000000003875004d8000000028e63300c400280048fd3200003b0000000028000000000080e33300201f00000000280078e03300f83b0000ff07000000002800000000007f070000c40028007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600d7f5f97e80ba23006d82a37584dd330004010000 (UID: 00000000-00002860) "1LX41PH4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003300f83b0000ff07000000002800000000007f070000c4002800c82f280066750000f0b9230067e51f7700002800b0e43300000000000000280000000000b0e4330000000000127500678000000058e73300c400280048fd3200003b00000000280000000000b0e43300201f000000002800a8e13300f83b0000ff07000000002800000000007f070000c40028007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600d7f5f97e80ba23006d82a375acde330004010000 (UID: 00000000-00002860) "1LX41PH4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003300f83b0000ff07000000002800000000007f070000c4002800c82f280041750000f0b9230067e51f7700002800d8e53300000000000000280000000000d8e5330000000000ed7400998000000080e83300c400280048fd3200003b00000000280000000000d8e53300201f000000002800d0e23300f83b0000ff07000000002800000000007f070000c40028007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600d7f5f97e80ba23006d82a375e4df330004010000 (UID: 00000000-00002860) "1LX41PH4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000b264e17ea0c32300a0c323001e750f680000000030b93400d8ca23001c0200000000000000000000000000007cc823005ecbdb751c02000000000000005dd975d8ca23000e5dd97570c62300dcaadd75010000000000000072000000fffffffffffffffff8c32300780200000000000025000000f8c323007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600878bf97e50c423006d82a3756454340004010000 (UID: 00000000-00002860) "1LX41PH4.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff1500990156000000620bdb7500000000f86f2800000000005000000024a3300002000000a8892f000000000001000008b045310020742800380bdb7584c223000200000038c323003f08997502000000a8892f00000000000100001888fb987528c32300c81cdd75fec4230095fb98755cc42300a8892f00000000000000000000000000e4c32300000028007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600338cf97ea4c323006d82a3756454340004010000 (UID: 00000000-00002860)2d:T574,"fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "gh4wl01.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "gh4wl01.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "IU0bP67.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "IU0bP67.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "VF0xM38.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "VF0xM38.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1LX41PH4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1LX41PH4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "OfficeTrackerNMP131.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2e:Ta0c,"fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003960) "gh4wl01.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00001544) "IU0bP67.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003192) "VF0xM38.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003612) "1LX41PH4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002860) "1LX41PH4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002860) "1LX41PH4.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002860) "1LX41PH4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002860) "1LX41PH4.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002860) "1LX41PH4.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002860) "1LX41PH4.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002860) "1LX41PH4.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00002860) "1LX41PH4.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00002860) "1LX41PH4.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002860) "1LX41PH4.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002860) "1LX41PH4.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00002860) "1LX41PH4.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00002860) "1LX41PH4.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00002860) "1LX41PH4.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00002860) "1LX41PH4.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002860) "1LX41PH4.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00002860) "1LX41PH4.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002860) "1LX41PH4.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002860) "1LX41PH4.exe" called "LoadLibrary" with a parameter WININET.DLL (UID: 00000000-00002860) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001972) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001972)2f:T2d83,"fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003960) "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003960) "gh4wl01.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001544) "gh4wl01.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001544) "gh4wl01.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001544) "gh4wl01.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001544) "gh4wl01.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00001544) "IU0bP67.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003192) "IU0bP67.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003192) "IU0bP67.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003192) "IU0bP67.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003192) "IU0bP67.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003192) "VF0xM38.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003612) "VF0xM38.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003612) "1LX41PH4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CreateLinkInfoW (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter IsCharAlphaW (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CharPrevW (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter GetNetResourceFromLocalPathW (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter NetShareEnum (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CscNetApiGetInterface (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter SLGetWindowsInformationDWORD (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecW (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CharNextW (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter DestroyLinkInfo (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter O/ (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter O (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter ?/ (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter ? (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00002860) "1LX41PH4.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00002860) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000556) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000556) "schtasks.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000556) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000556) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001972) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001972) "schtasks.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001972) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001972) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00001972) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001972) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003244) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003244) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003244) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003244)30:Tb79,"CREATE TABLE sqlite_master(" (Source: 00000000-00002860.00000002.87723.010C7000.00000002.mdmp, Indicator: "create table sqlite_master(") "CREATE TABLE" (Source: 00000000-00002860.00000002.87723.010C7000.00000002.mdmp, Indicator: "create table") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 00000000-00002860.00000002.87723.010C7000.00000002.mdmp, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00002860.00000002.87723.010C7000.00000002.mdmp, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 00000000-00002860.00000002.87723.010C7000.00000002.mdmp, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00002860.00000002.87723.010C7000.00000002.mdmp, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 00000000-00002860.00000002.87723.010C7000.00000002.mdmp, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 00000000-00002860.00000002.87723.010C7000.00000002.mdmp, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 00000000-00002860.00000002.87723.010C7000.00000002.mdmp, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 00000000-00002860.00000002.87723.010C7000.00000002.mdmp, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 00000000-00002860.00000002.87723.010C7000.00000002.mdmp, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 00000000-00002860.00000002.87723.010C7000.00000002.mdmp, Indicator: "select name rootpage sql from '%q'.%s"), "UPDATE %Q.%s SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 00000000-00002860.00000002.87723.010C7000.00000002.mdmp, Indicator: "update %q.%s set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d")31:T9da,":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002860.00000000.83880.00280000.00000004.mdmp 00000000-00002860.00000001.85802.00280000.00000004.mdmp 00000000-00002860.00000002.87723.00280000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002860.00000000.83880.00280000.00000004.mdmp 00000000-00002860.00000001.85802.00280000.00000004.mdmp 00000000-00002860.00000002.87723.00280000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002860.00000000.83880.00280000.00000004.mdmp 00000000-00002860.00000000.83880.00590000.00000002.mdmp 00000000-00002860.00000001.85802.00280000.00000004.mdmp 00000000-00002860.00000002.87723.00280000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002860.00000000.83880.00280000.00000004.mdmp 00000000-00002860.00000001.85802.00280000.00000004.mdmp 00000000-00002860.00000002.87723.00280000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002860.00000000.83880.00280000.00000004.mdmp 00000000-00002860.00000000.83880.00590000.00000002.mdmp 00000000-00002860.00000001.85802.00280000.00000004.mdmp 00000000-00002860.00000002.87723.00280000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\fanbooster131.lnk") in Source: 00000000-00002860.00000000.83880.00280000.00000004.mdmp "sers\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk" (Indicator: "sers\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\fanbooster131.lnk") in Source: 00000000-00002860.00000001.85802.00280000.00000004.mdmp 00000000-00002860.00000002.87723.00280000.00000004.mdmp32:T455,"fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "gh4wl01.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "2Cg5677.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "IU0bP67.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "VF0xM38.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "5QU4Dk7.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE33:T1537,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00001544.00000002.87593.00A01000.00000020.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002860.00000000.83880.00280000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002860.00000000.83880.00280000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002860.00000000.83880.00280000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002860.00000000.83880.00280000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002860.00000001.85802.00280000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002860.00000001.85802.00280000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002860.00000001.85802.00280000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002860.00000001.85802.00280000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002860.00000001.85802.00280000.00000004.mdmp "2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00002860.00000001.85802.00280000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002860.00000002.87723.00280000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002860.00000002.87723.00280000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002860.00000002.87723.00280000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002860.00000002.87723.00280000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002860.00000002.87723.00280000.00000004.mdmp "2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00002860.00000002.87723.00280000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003192.00000002.87631.00A41000.00000020.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003244.00000000.85937.00340000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003244.00000000.85937.00340000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003244.00000000.85937.00340000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003244.00000000.85937.00340000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003244.00000001.87859.00340000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003244.00000001.87859.00340000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003244.00000001.87859.00340000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003244.00000001.87859.00340000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003244.00000002.89784.00340000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003244.00000002.89784.00340000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003244.00000002.89784.00340000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003244.00000002.89784.00340000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003612.00000001.85755.013B1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003960.00000000.83641.00A51000.00000020.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003960.00000002.87487.00310000.00000004.mdmp34:Te54,"fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6a820000 "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74f80000 "gh4wl01.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 68240000 "gh4wl01.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74f80000 "IU0bP67.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 68270000 "IU0bP67.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6c300000 "IU0bP67.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74f80000 "VF0xM38.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6bfd0000 "VF0xM38.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74f80000 "1LX41PH4.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 68270000 "1LX41PH4.exe" loaded module "ADVAPI32.DLL" at base 76990000 "1LX41PH4.exe" loaded module "KERNEL32.DLL" at base 75940000 "1LX41PH4.exe" loaded module "CRYPTBASE.DLL" at base 74fd0000 "1LX41PH4.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73c50000 "1LX41PH4.exe" loaded module "CLBCATQ.DLL" at base 76f10000 "1LX41PH4.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75d30000 "1LX41PH4.exe" loaded module "PROPSYS.DLL" at base 73df0000 "1LX41PH4.exe" loaded module "OLE32.DLL" at base 77070000 "1LX41PH4.exe" loaded module "COMCTL32.DLL" at base 73f70000 "1LX41PH4.exe" loaded module "OLEAUT32.DLL" at base 76bb0000 "1LX41PH4.exe" loaded module "SETUPAPI.DLL" at base 75410000 "1LX41PH4.exe" loaded module "RPCRT4.DLL" at base 755c0000 "1LX41PH4.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73df0000 "1LX41PH4.exe" loaded module "NTMARTA.DLL" at base 74540000 "1LX41PH4.exe" loaded module "SHELL32.DLL" at base 75d30000 "1LX41PH4.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77320000 "1LX41PH4.exe" loaded module "PROFAPI.DLL" at base 750e0000 "1LX41PH4.exe" loaded module "APPHELP.DLL" at base 74f80000 "1LX41PH4.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6f260000 "1LX41PH4.exe" loaded module "LINKINFO.DLL" at base 6e0f0000 "1LX41PH4.exe" loaded module "USER32.DLL" at base 76fa0000 "1LX41PH4.exe" loaded module "NTSHRUI.DLL" at base 71f30000 "1LX41PH4.exe" loaded module "SRVCLI.DLL" at base 74cd0000 "1LX41PH4.exe" loaded module "CSCAPI.DLL" at base 70350000 "1LX41PH4.exe" loaded module "SLC.DLL" at base 735d0000 "1LX41PH4.exe" loaded module "SHLWAPI.DLL" at base 75a20000 "1LX41PH4.exe" loaded module "SSPICLI.DLL" at base 74f60000 "1LX41PH4.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74f80000 "1LX41PH4.exe" loaded module "WINHTTP.DLL" at base 70f10000 "1LX41PH4.exe" loaded module "WININET.DLL" at base 75a80000 "1LX41PH4.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74aa0000 "1LX41PH4.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74600000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 76990000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77320000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 76f10000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 736e0000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 74f60000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 738f0000 "OfficeTrackerNMP131.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 68270000 "OfficeTrackerNMP131.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74600000 "OfficeTrackerNMP131.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74aa000035:Te37,"fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5" was detected as "Microsoft Cabinet" and name: "sfx" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5" was detected as "Microsoft Visual C/C++" and name: "Compiler" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5" was detected as "Microsoft Cabinet File" and name: "Archive" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5" was detected as "Microsoft Linker" and name: "Linker" "gh4wl01.exe" was detected as "Microsoft Cabinet" and name: "sfx" "gh4wl01.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "gh4wl01.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "gh4wl01.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "gh4wl01.exe" was detected as "Microsoft Linker" and name: "Linker" "1LX41PH4.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1LX41PH4.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1LX41PH4.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1LX41PH4.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1LX41PH4.exe" was detected as "Microsoft Linker" and name: "Linker" "2Cg5677.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2Cg5677.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2Cg5677.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2Cg5677.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2Cg5677.exe" was detected as "Microsoft Linker" and name: "Linker" "IU0bP67.exe" was detected as "Microsoft Cabinet" and name: "sfx" "IU0bP67.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "IU0bP67.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "IU0bP67.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "IU0bP67.exe" was detected as "Microsoft Linker" and name: "Linker" "VF0xM38.exe" was detected as "Microsoft Cabinet" and name: "sfx" "VF0xM38.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "VF0xM38.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "VF0xM38.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "VF0xM38.exe" was detected as "Microsoft Linker" and name: "Linker" "5QU4Dk7.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5QU4Dk7.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5QU4Dk7.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5QU4Dk7.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5QU4Dk7.exe" was detected as "Microsoft Linker" and name: "Linker" "4yx631Rh.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4yx631Rh.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4yx631Rh.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4yx631Rh.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4yx631Rh.exe" was detected as "Microsoft Linker" and name: "Linker" "3fH86hE.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3fH86hE.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3fH86hE.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3fH86hE.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3fH86hE.exe" was detected as "Microsoft Linker" and name: "Linker"36:T131f,"fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "gh4wl01.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "1LX41PH4.exe" file has an entrypoint instructions - "call 0x4e6d12,jmp 0x4e64df,cmp ecx, dword ptr [0x56d048],jne 0x4e666e,ret ,jmp 0x4e6e45,push ebp,mov ebp, esp,and dword ptr [0x56f3d0], 0,sub esp, 0x24,or dword ptr [0x56d050], 1,push 0xa,call dword ptr [0x5370d8],test eax, eax,je 0x4e6843,and dword ptr [ebp - 0x10], 0,xor eax, eax,push ebx,push esi,push edi,xor ecx, ecx,lea edi, [ebp - 0x24],push ebx,cpuid ,mov esi, ebx,pop ebx,nop ,mov dword ptr [edi], eax,mov dword ptr [edi + 4], esi,mov dword ptr [edi + 8], ecx,xor ecx, ecx,mov dword ptr [edi + 0xc], edx,mov eax, dword ptr [ebp - 0x24],mov edi, dword ptr [ebp - 0x20]," "2Cg5677.exe" file has an entrypoint instructions - "jmp 0x415f30,jmp 0x46b9b9,jmp 0x44a550,jmp 0x4364c9,jmp 0x4209c7,jmp 0x4a87f0,jmp 0x436a6a,jmp 0x46c75a,jmp 0x4a377a,jmp 0x41c05f,jmp 0x416984,jmp 0x452ee7,jmp 0x42c224,jmp 0x459d4b,jmp 0x41cc67,jmp 0x419015,jmp 0x492f8b,jmp 0x40de90,jmp 0x466efc,jmp 0x4838f0," "IU0bP67.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "VF0xM38.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "5QU4Dk7.exe" file has an entrypoint instructions - "jmp 0x415f30,jmp 0x46b9b9,jmp 0x44a550,jmp 0x4364c9,jmp 0x4209c7,jmp 0x4a87f0,jmp 0x436a6a,jmp 0x46c75a,jmp 0x4a377a,jmp 0x41c05f,jmp 0x416984,jmp 0x452ee7,jmp 0x42c224,jmp 0x459d4b,jmp 0x41cc67,jmp 0x419015,jmp 0x492f8b,jmp 0x40de90,jmp 0x466efc,jmp 0x4838f0," "4yx631Rh.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "3fH86hE.exe" file has an entrypoint instructions - "call 0x4032e6,jne 0x4032ed,je 0x4032ed,test eax, 0xeb5b9ba5,or al, byte ptr [ecx + eax*4 - 0x15],out 0x32, al,add byte ptr [eax], al,jmp 0x4032fe,and ch, bl,cmc ,inc esp,and dh, byte ptr [esi + eax + 0x75],add al, 0x94,push ss,xor dword ptr [ecx - 0x3dbbb39], ebx,xor byte ptr [eax], al,add byte ptr [eax], al,sub esp, 4,jne 0x403317,je 0x403317,dec ebp,lahf ,mov edx, dword ptr [esp],add esp, 4,jmp 0x403325,mov byte ptr [ecx], ch,shr bl, 5,test al, 0xeb,stc ,mov byte ptr [eax - 0x4373fa15], ch,shr bl, 1,pop es,add eax, dword ptr fs:[edx],je 0x40333c,jne 0x40333c,jb 0x40337c,and dh, byte ptr [esi],in eax, dx,push dword ptr [eax + 0xa4],jne 0x403349,"37:T4ce,"fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "gh4wl01.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "gh4wl01.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "IU0bP67.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "IU0bP67.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "VF0xM38.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "VF0xM38.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1LX41PH4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1LX41PH4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "OfficeTrackerNMP131.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "OfficeTrackerNMP131.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")38:T45b,Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00003960-00000C2B-311952314] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00003960-00000BC1-312091391] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00001544-00000BC1-312818787] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00003192-00000BC1-313546656] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00003612-00000BC1-314239010] Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00001544.00000608.1624898.00050000.wprm] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00002860-00000C2B-314959427] Observed system executable string:"%WINDIR%\System32\shdocvw.dll" [Source: 00000000-00002860-00000C2B-318745445]39:Ta43,"gh4wl01.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\gh4wl01.exe]- [targetUID: 00000000-00001544] "1LX41PH4.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1LX41PH4.exe]- [targetUID: 00000000-00003612] "2Cg5677.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 8 sections"- Location: [%TEMP%\IXP003.TMP\2Cg5677.exe]- [targetUID: 00000000-00003612] "IU0bP67.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\IU0bP67.exe]- [targetUID: 00000000-00001544] "VF0xM38.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\VF0xM38.exe]- [targetUID: 00000000-00003612] "5QU4Dk7.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 8 sections"- Location: [%TEMP%\IXP000.TMP\5QU4Dk7.exe]- [targetUID: 00000000-00003960] "4yx631Rh.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4yx631Rh.exe]- [targetUID: 00000000-00001544] "3fH86hE.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\3fH86hE.exe]- [targetUID: 00000000-00003192] "FANBooster131.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Unicoded MachineID hapubws-pc KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive NeedIndexed ctime=Wed Sep 16 06:49:00 2026 atime=Wed Sep 16 06:49:00 2026 mtime=Tue Nov 28 13:52:20 2023 length=1539633 window=normal IDListSize 0x01f6 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00002860] "rise131M9Asphalt.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\rise131M9Asphalt.tmp]- [targetUID: 00000000-00002860] "FANBooster131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00002860] "OfficeTrackerNMP131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00002860] "MaxLoonaFest131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00002860]3a:Tb94,"fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")3b:T10d8,"fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "FA0A470A4F7620E2A74F1DB0EB7581183C52B39EB662EA28C50258D0F8D529B5"; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "")3c:Tc9a,"fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe.Local\" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\Cabinet.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\VERSION.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\SspiCli.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\WINSPOOL.DRV" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\MPR.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\Windows\system32\MPR.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\UxTheme.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\WINMM.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\samcli.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\Windows\system32\samcli.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\MSACM32.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to touch file "C:\Windows\system32\MSACM32.dll"3d:Td25,"fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\Cabinet.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\VERSION.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\SspiCli.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\MPR.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\UxTheme.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\WINMM.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\samcli.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\MSACM32.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\sfc.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\sfc_os.DLL" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\dwmapi.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\gh4wl01.exe" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5QU4Dk7.exe" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\FLTLIB.DLL" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\MSVCP140.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\ucrtbase.DLL" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll"3e:T87a,"fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe.Local\" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe.Config" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\FA0A470A4F7620E2A74F1DB0EB7581183C52B39EB662EA28C50258D0F8D529B5.EXE.LOCAL" "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" trying to access non-existent file "C:\FA0A470A4F7620E2A74F1DB0EB7581183C52B39EB662EA28C50258D0F8D529B5.EXE.CONFIG" "gh4wl01.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\gh4wl01.exe.Local\" "gh4wl01.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "gh4wl01.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\gh4wl01.exe.Config" "gh4wl01.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "gh4wl01.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\GH4WL01.EXE.LOCAL" "gh4wl01.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\GH4WL01.EXE.CONFIG" "IU0bP67.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\IU0bP67.exe.Local\" "IU0bP67.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "IU0bP67.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\IU0bP67.exe.Config" "IU0bP67.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"3f:T487,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5")40:T8e3,Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "gethostname" (Indicator: "gethostname"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00001544.00000001.85671.00BA0000.00000002.mdmp, 00000000-00001544.00000002.87593.00BA0000.00000002.mdmp") Found reference to API "Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement." (Indicator: " accept "; Source: "00000000-00001544.00000002.87593.00A0A000.00000002.mdmp") Found reference to API "ile System Bind Data" (Indicator: " bind "; Source: "00000000-00002860.00000000.83880.00280000.00000004.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00002860.00000000.83880.01110000.00000002.mdmp, 00000000-00002860.00000001.85802.01110000.00000002.mdmp, 00000000-00002860.00000002.87723.01110000.00000002.mdmp") Found reference to API "Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement." (Indicator: " accept "; Source: "00000000-00003192.00000000.83786.00A4A000.00000002.mdmp")41:T112e,Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localtemp=c:\users\hapubws\appdata\local\temp1spscertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey" - Source: "00000000-00002860.00000000.83880.00280000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00002860.00000000.83880.00280000.00000004.mdmp") Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localtemp=c:\users\hapubws\appdata\local\tempcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey" - Source: "00000000-00002860.00000001.85802.00280000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00002860.00000001.85802.00280000.00000004.mdmp") Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localtemp=c:\users\hapubws\appdata\local\tempcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey" - Source: "00000000-00002860.00000002.87723.00280000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00002860.00000002.87723.00280000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00002860.00000002.87723.010C7000.00000002.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00002860.00000002.87723.010C7000.00000002.mdmp") Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localtemp=c:\users\hapubws\appdata\local\tempcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey1" - Source: "00000000-00003244.00000000.85937.00340000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00003244.00000000.85937.00340000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00003244.00000000.85937.01307000.00000002.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00003244.00000000.85937.01307000.00000002.mdmp") Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localtemp=c:\users\hapubws\appdata\local\tempcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey1" - Source: "00000000-00003244.00000001.87859.00340000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00003244.00000001.87859.00340000.00000004.mdmp") Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localtemp=c:\users\hapubws\appdata\local\tempcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey1" - Source: "00000000-00003244.00000002.89784.00340000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00003244.00000002.89784.00340000.00000004.mdmp") Found URL "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%symantec" - Source: "00000000-00003612.00000000.83833.00370000.00000004.mdmp") Found URL "http://ts-ocsp.ws.symantec.com07+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<50301+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(timestamp-2048-20b07x,&c3\vno^efany3+." - Source: "00000000-00003612.00000000.83833.00370000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0kd0b070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0fuscdigicert" - Source: "00000000-00003612.00000000.83833.00370000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0oh0f080*0(https://www.digicert.com/cps0," - Source: "00000000-00003612.00000000.83833.00370000.00000004.mdmp")42:T488,Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; File: "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5")43:Ta4c,"fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00003960) "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003960) "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" called "FindNextFileW" with parameter 5QU4Dk7.exe (UID: 00000000-00003960) "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" called "FindNextFileW" with parameter gh4wl01.exe (UID: 00000000-00003960) "gh4wl01.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00001544) "gh4wl01.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001544) "gh4wl01.exe" called "FindNextFileW" with parameter 4yx631Rh.exe (UID: 00000000-00001544) "gh4wl01.exe" called "FindNextFileW" with parameter IU0bP67.exe (UID: 00000000-00001544) "IU0bP67.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00003192) "IU0bP67.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003192) "IU0bP67.exe" called "FindNextFileW" with parameter 3fH86hE.exe (UID: 00000000-00003192) "IU0bP67.exe" called "FindNextFileW" with parameter VF0xM38.exe (UID: 00000000-00003192) "VF0xM38.exe" called "FindFirstFileW" with parameter %TEMP%\IXP003.TMP\*.* (UID: 00000000-00003612) "VF0xM38.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003612) "VF0xM38.exe" called "FindNextFileW" with parameter 1LX41PH4.exe (UID: 00000000-00003612) "VF0xM38.exe" called "FindNextFileW" with parameter 2Cg5677.exe (UID: 00000000-00003612) "1LX41PH4.exe" called "FindFirstFileW" with parameter %WINDIR%\System32\*.* (UID: 00000000-00002860) "1LX41PH4.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002860) "1LX41PH4.exe" called "FindNextFileW" with parameter 0409 (UID: 00000000-00002860) "1LX41PH4.exe" called "FindNextFileW" with parameter 12520437.cpx (UID: 00000000-00002860) "1LX41PH4.exe" called "FindNextFileW" with parameter 12520850.cpx (UID: 00000000-00002860) "1LX41PH4.exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00002860) "1LX41PH4.exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00002860) "1LX41PH4.exe" called "FindNextFileW" with parameter aaclient.dll (UID: 00000000-00002860) "1LX41PH4.exe" called "FindNextFileW" with parameter accessibilitycpl.dll (UID: 00000000-00002860)44:T784,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002860.00000000.83880.00280000.00000004.mdmp, 00000000-00002860.00000001.85802.00280000.00000004.mdmp, 00000000-00002860.00000002.87723.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002860.00000000.83880.00280000.00000004.mdmp, 00000000-00002860.00000001.85802.00280000.00000004.mdmp, 00000000-00002860.00000002.87723.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002860.00000000.83880.00280000.00000004.mdmp, 00000000-00002860.00000001.85802.00280000.00000004.mdmp, 00000000-00002860.00000002.87723.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002860.00000000.83880.00280000.00000004.mdmp, 00000000-00002860.00000001.85802.00280000.00000004.mdmp, 00000000-00002860.00000002.87723.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002860.00000000.83880.00280000.00000004.mdmp, 00000000-00002860.00000001.85802.00280000.00000004.mdmp, 00000000-00002860.00000002.87723.00280000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002860.00000000.83880.00280000.00000004.mdmp, 00000000-00002860.00000001.85802.00280000.00000004.mdmp, 00000000-00002860.00000002.87723.00280000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP003.TMP\1LX41PH4.exe" (Indicator: "\Device\"; Source: "00000000-00002860.00000000.83880.00280000.00000004.mdmp, 00000000-00002860.00000001.85802.00280000.00000004.mdmp, 00000000-00002860.00000002.87723.00280000.00000004.mdmp")45:T14d9,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: gh4wl01.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: gh4wl01.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: gh4wl01.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: gh4wl01.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: gh4wl01.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: IU0bP67.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: IU0bP67.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: IU0bP67.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: IU0bP67.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: IU0bP67.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: VF0xM38.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: VF0xM38.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: VF0xM38.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: VF0xM38.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: VF0xM38.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 4yx631Rh.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 4yx631Rh.exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: 4yx631Rh.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: 4yx631Rh.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: 4yx631Rh.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: 4yx631Rh.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 4yx631Rh.exe] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 4yx631Rh.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: 4yx631Rh.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: 4yx631Rh.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 4yx631Rh.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 4yx631Rh.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: 4yx631Rh.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: 4yx631Rh.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 4yx631Rh.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: 4yx631Rh.exe]46:Ta86,"1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANSERVER\DEFAULTSECURITY"; Key: "SRVSVCDEFAULTSHAREINFO"; Value: "") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "1LX41PH4.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "")47:T45c,"fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "gh4wl01.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "IU0bP67.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "VF0xM38.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "1LX41PH4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "MAXLOONAFEST131"; Value: "%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe")48:T5db,"gh4wl01.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\gh4wl01.exe]- [targetUID: 00000000-00001544] "1LX41PH4.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1LX41PH4.exe]- [targetUID: 00000000-00003612] "2Cg5677.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 8 sections"- Location: [%TEMP%\IXP003.TMP\2Cg5677.exe]- [targetUID: 00000000-00003612] "IU0bP67.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\IU0bP67.exe]- [targetUID: 00000000-00001544] "VF0xM38.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\VF0xM38.exe]- [targetUID: 00000000-00003612] "5QU4Dk7.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 8 sections"- Location: [%TEMP%\IXP000.TMP\5QU4Dk7.exe]- [targetUID: 00000000-00003960] "4yx631Rh.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4yx631Rh.exe]- [targetUID: 00000000-00001544] "3fH86hE.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\3fH86hE.exe]- [targetUID: 00000000-00003192] "FANBooster131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00002860]49:T76e,"gh4wl01.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\gh4wl01.exe]- [targetUID: 00000000-00001544] "1LX41PH4.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1LX41PH4.exe]- [targetUID: 00000000-00003612] "2Cg5677.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 8 sections"- Location: [%TEMP%\IXP003.TMP\2Cg5677.exe]- [targetUID: 00000000-00003612] "IU0bP67.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\IU0bP67.exe]- [targetUID: 00000000-00001544] "VF0xM38.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\VF0xM38.exe]- [targetUID: 00000000-00003612] "5QU4Dk7.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 8 sections"- Location: [%TEMP%\IXP000.TMP\5QU4Dk7.exe]- [targetUID: 00000000-00003960] "4yx631Rh.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4yx631Rh.exe]- [targetUID: 00000000-00001544] "3fH86hE.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\3fH86hE.exe]- [targetUID: 00000000-00003192] "FANBooster131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00002860] "OfficeTrackerNMP131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00002860] "MaxLoonaFest131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00002860]4a:T631,"fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "gh4wl01.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "gh4wl01.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "IU0bP67.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "IU0bP67.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "VF0xM38.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "VF0xM38.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "1LX41PH4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "MAXLOONAFEST131"; Value: "%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe")4b:Tce8,"fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\gh4wl01.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "fa0a470a4f7620e2a74f1db0eb7581183c52b39eb662ea28c50258d0f8d529b5.exe" wrote 24064 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5QU4Dk7.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "gh4wl01.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\IU0bP67.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "gh4wl01.exe" wrote 23552 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4yx631Rh.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "IU0bP67.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\VF0xM38.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "IU0bP67.exe" wrote 18944 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3fH86hE.exe": 4d5aff000100000004001000ffff00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0a240000000000000000 ... "VF0xM38.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1LX41PH4.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000300100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "VF0xM38.exe" wrote 463 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2Cg5677.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...4c:T84b,OpenProcessToken RegDeleteValueA RegCloseKey RegOpenKeyExA RegCreateKeyExA FindResourceA WriteFile CreateFileA GetTempFileNameA GetModuleFileNameA GetFileAttributesA GetTickCount Sleep LoadLibraryA DeleteFileA GetModuleHandleW GetStartupInfoW FindNextFileA GetProcAddress GetSystemDirectoryA GetVersionExA GetSystemInfo CreateThread GetTempPathA CreateProcessA TerminateProcess LoadLibraryExA FindFirstFileA CreateDirectoryA GetDriveTypeA UnhandledExceptionFilter LockResource CredEnumerateA RegEnumKeyExA GetUserNameA RegEnumKeyA GetTickCount64 CreateFileW CreateRemoteThread GetCommandLineA WriteProcessMemory GetModuleHandleExA FindNextFileW CreateToolhelp32Snapshot GetModuleFileNameW GetTempPathW CopyFileA Process32First VirtualAllocEx GetModuleHandleA FindFirstFileW GetComputerNameA GetCommandLineW GetFileAttributesW DeleteFileW IsDebuggerPresent Process32Next FindFirstFileExW GetFileSizeEx GetFileSize GetFileAttributesExW OpenProcess GetModuleHandleExW LoadLibraryExW ShellExecuteA connect closesocket recv send socket WSAStartup CreateThreadpoolWork SleepConditionVariableCS CreateThreadpoolTimer ExitThread GetNativeSystemInfo CreateThreadpoolWait SleepConditionVariableSRW OutputDebugStringW RegOpenKeyExW GetUserNameW RegDeleteKeyW CreateProcessAsUserW RegEnumKeyExW RegCreateKeyExW CreateProcessWithLogonW SetSecurityDescriptorDacl RegDeleteValueW IcmpSendEcho GetComputerNameW ReadProcessMemory CreateDirectoryW VirtualAlloc Process32FirstW CopyFileW LoadLibraryW GetSystemDirectoryW GetVersionExW DeviceIoControl GetDriveTypeW CreateProcessW FindResourceExW Process32NextW GetTempFileNameW CopyFileExW ShellExecuteW ShellExecuteExW GetWindowThreadProcessId FindWindowW SetKeyboardState GetClipboardData FindWindowExW GetCursorPos HttpQueryInfoW InternetOpenW InternetReadFile InternetQueryOptionW InternetOpenUrlW FtpGetFileSize InternetCloseHandle HttpSendRequestW FtpOpenFileW InternetConnectW InternetQueryDataAvailable InternetCrackUrlW sendto accept recvfrom bind listen4d:Tbde,"4e5e41c05d7b9be4515a5885fbd52573.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007848) "gh4wl01.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007996) "gh4wl01.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007996) "IU0bP67.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00008048) "IU0bP67.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00008048) "IU0bP67.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00008048) "VF0xM38.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00004216) "VF0xM38.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00004216) "VF0xM38.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00004216) "VF0xM38.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00004216) "VF0xM38.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP\ (UID: 00000000-00004216) "1LX41PH4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAoxp9fYzpwA3_E\Files\My Music (UID: 00000000-00007616) "1LX41PH4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAoxp9fYzpwA3_E\Files\My Pictures (UID: 00000000-00007616) "1LX41PH4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAoxp9fYzpwA3_E\Files\My Videos (UID: 00000000-00007616) "1LX41PH4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAoxp9fYzpwA3_E\Files\OneNote Notebooks\My Notebook (UID: 00000000-00007616) "1LX41PH4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAoxp9fYzpwA3_E\Files\OneNote Notebooks\OneNote 2010 Guide (UID: 00000000-00007616) "1LX41PH4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAoxp9fYzpwA3_E\Files\OneNote Notebooks (UID: 00000000-00007616) "1LX41PH4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAoxp9fYzpwA3_E\Files\Outlook Files (UID: 00000000-00007616) "1LX41PH4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAoxp9fYzpwA3_E\Files (UID: 00000000-00007616) "1LX41PH4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAoxp9fYzpwA3_E\Files\.mitmproxy (UID: 00000000-00007616) "1LX41PH4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAoxp9fYzpwA3_E\Files\3D Objects (UID: 00000000-00007616) "1LX41PH4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAoxp9fYzpwA3_E\Files\AppData\Local\Adobe\Acrobat\11.0\Cache (UID: 00000000-00007616) "1LX41PH4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAoxp9fYzpwA3_E\Files\AppData\Local\Adobe\Acrobat\11.0 (UID: 00000000-00007616) "1LX41PH4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAoxp9fYzpwA3_E\Files\AppData\Local\Adobe\Acrobat (UID: 00000000-00007616) "1LX41PH4.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAoxp9fYzpwA3_E\Files\AppData\Local\Adobe\Color\Profiles (UID: 00000000-00007616)4e:T42b,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "4e5e41c05d7b9be4515a5885fbd52573.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004216.00000000.66667.00B3A000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00007616.00000000.66731.00447000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007616.00000000.66731.00447000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00007616.00000000.66731.00447000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00007616.00000000.66731.00447000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00007616.00000000.66731.00447000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007848.00000000.66518.00ADA000.00000002.mdmp")4f:T898,"1LX41PH4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "1LX41PH4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1LX41PH4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1LX41PH4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "1LX41PH4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "1LX41PH4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "1LX41PH4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "1LX41PH4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "1LX41PH4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "1LX41PH4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "1LX41PH4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "1LX41PH4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "1LX41PH4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")50:T4f7,"1LX41PH4.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")51:Tb3d,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "4e5e41c05d7b9be4515a5885fbd52573.exe") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00004216.00000000.66667.00B3A000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004216.00000000.66667.03210000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004216.00000000.66667.03210000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004216.00000000.66667.03210000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00004216.00000000.66667.03210000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00007616.00000000.66731.00447000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007616.00000000.66731.03370000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007616.00000000.66731.03370000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007616.00000000.66731.03370000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007616.00000000.66731.03370000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007768.00000001.70418.02E00000.00000004.mdmp, 00000000-00007768.00000002.72340.02E00000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007768.00000001.70418.02E00000.00000004.mdmp, 00000000-00007768.00000002.72340.02E00000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007768.00000001.70418.02E00000.00000004.mdmp, 00000000-00007768.00000002.72340.02E00000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00007768.00000001.70418.02E00000.00000004.mdmp, 00000000-00007768.00000002.72340.02E00000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00007848.00000000.66518.00ADA000.00000002.mdmp")52:T40c,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "4e5e41c05d7b9be4515a5885fbd52573.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "4e5e41c05d7b9be4515a5885fbd52573.exe") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00004216.00000000.66667.00B3A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004216.00000000.66667.00B3A000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00007616.00000000.66731.00447000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00007616.00000000.66731.00447000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00007848.00000000.66518.00ADA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00007848.00000000.66518.00ADA000.00000002.mdmp")53:T593,"AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135]54:T559,"4e5e41c05d7b9be4515a5885fbd52573.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74A60000 "4e5e41c05d7b9be4515a5885fbd52573.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73030000 "gh4wl01.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74A60000 "gh4wl01.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73030000 "IU0bP67.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74A60000 "IU0bP67.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73030000 "VF0xM38.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74A60000 "VF0xM38.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73030000 "1LX41PH4.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74A60000 "1LX41PH4.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73030000 "schtasks.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74A60000 "2Cg5677.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74A60000 "2Cg5677.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73030000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74A60000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73030000 "3fH86hE.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74A60000 "3fH86hE.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 7303000055:T9dd,"CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)" (Source: 31774-2265-004D6790, Indicator: "create table sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 31774-2265-004D6790, Indicator: "select name rootpage sql from '%q'.%s"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 31774-2736-004CD570, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q) tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='" (Source: 31774-2734-004CD2C0, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 31774-2310-004C2E90, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 31774-2662-004CF800, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'") "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 31774-2662-004CF800, Indicator: "delete from %q.sqlite_stat1 where tbl=%q") "CREATE TABLE" (Source: 31774-2466-004CF340, Indicator: "create table") "DELETE FROM %Q.%s WHERE name=%Q" (Source: 31774-2708-004D0320, Indicator: "delete from %q.%s where name=%q") "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 31774-2708-004D0320, Indicator: "delete from %q.sqlite_stat1 where idx=%q") "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 31774-2649-004CFB70, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 31774-2460-004CF4F0, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "UPDATE %Q.%s SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 31774-2739-004DC570, Indicator: "update %q.%s set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d")56:Tfff,Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00007848-00000C25-46042678] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00007848-00000C25-46198932] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00007848-00000BC1-46227218] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00007996-00000BC1-46919762] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00008048-00000BC1-47650113] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00004216-00000BC1-48572345] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005872-00000C25-76238292] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005872-00000C25-76715957] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005872-00000C25-76853139] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005872-00000C25-76948992] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005872-00000C25-77149069] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005872-00000C25-77219969] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005872-00000C25-77295831] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005872-00000C25-77510817] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00005872-00000C25-77704572] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00005872-00000C25-77811043] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00005872-00000C25-78036108] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005872-00000C25-78232670] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00005872-00000C25-78284125] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00005872-00000C25-78382562] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005872-00000C25-78569884] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00005872-00000C25-79036985] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll" [Source: 00000000-00005872-00000C25-79121026] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll" [Source: 00000000-00005872-00000C25-79203984] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" [Source: 00000000-00005872-00000C25-79723827]57:T49c,"4e5e41c05d7b9be4515a5885fbd52573.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\gh4wl01.exe" (UID: 7848) "gh4wl01.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\IU0bP67.exe" (UID: 7996) "IU0bP67.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\VF0xM38.exe" (UID: 8048) "IU0bP67.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3fH86hE.exe" (UID: 8048) "VF0xM38.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1LX41PH4.exe" (UID: 4216) "1LX41PH4.exe" queries basic process information of the "C:\Windows\SysWOW64\schtasks.exe" (UID: 7616) "1LX41PH4.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1LX41PH4.exe" (UID: 7616) "2Cg5677.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 588) "AppLaunch.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 5872)58:T550,"VF0xM38.exe" called "FindFirstFileA" with parameter %TEMP%\IXP003.TMP\* (UID: 00000000-00004216) "VF0xM38.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00004216) "1LX41PH4.exe" called "FindFirstFileA" with parameter %USERPROFILE%\Desktop/\* (UID: 00000000-00007616) "1LX41PH4.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00007616) "1LX41PH4.exe" called "FindNextFileA" with parameter desktop.ini (UID: 00000000-00007616) "1LX41PH4.exe" called "FindFirstFileA" with parameter %USERPROFILE%\Documents/\* (UID: 00000000-00007616) "1LX41PH4.exe" called "FindNextFileA" with parameter Database1.accdb (UID: 00000000-00007616) "1LX41PH4.exe" called "FindNextFileA" with parameter My Music (UID: 00000000-00007616) "1LX41PH4.exe" called "FindNextFileA" with parameter My Pictures (UID: 00000000-00007616) "1LX41PH4.exe" called "FindNextFileA" with parameter My Videos (UID: 00000000-00007616) "1LX41PH4.exe" called "FindNextFileA" with parameter OneNote Notebooks (UID: 00000000-00007616) "1LX41PH4.exe" called "FindNextFileA" with parameter Outlook Files (UID: 00000000-00007616) "1LX41PH4.exe" called "FindFirstFileA" with parameter %USERPROFILE%\Documents/\My Music\* (UID: 00000000-00007616) "1LX41PH4.exe" called "FindFirstFileA" with parameter %TEMP%\grandUIAoxp9fYzpwA3_E\Files\My Music\*.* (UID: 00000000-00007616)59:T10ee,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "4e5e41c05d7b9be4515a5885fbd52573.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "4e5e41c05d7b9be4515a5885fbd52573.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004216.00000000.66667.00B3A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004216.00000000.66667.00B3A000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00007616.00000000.66731.00447000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00007616.00000000.66731.00447000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007616.00000000.66731.00447000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007616.00000000.66731.00447000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00007616.00000000.66731.00447000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007616.00000000.66731.03370000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007616.00000000.66731.03370000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007616.00000000.66731.03370000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007616.00000000.66731.03370000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007616.00000000.66731.03370000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007616.00000000.66731.03370000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007616.00000000.66731.03370000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007616.00000000.66731.03370000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007768.00000001.70418.02E00000.00000004.mdmp, 00000000-00007768.00000002.72340.02E00000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007768.00000001.70418.02E00000.00000004.mdmp, 00000000-00007768.00000002.72340.02E00000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007768.00000001.70418.02E00000.00000004.mdmp, 00000000-00007768.00000002.72340.02E00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007768.00000001.70418.02E00000.00000004.mdmp, 00000000-00007768.00000002.72340.02E00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007768.00000001.70418.02E00000.00000004.mdmp, 00000000-00007768.00000002.72340.02E00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007768.00000001.70418.02E00000.00000004.mdmp, 00000000-00007768.00000002.72340.02E00000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007768.00000001.70418.02E00000.00000004.mdmp, 00000000-00007768.00000002.72340.02E00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007768.00000001.70418.02E00000.00000004.mdmp, 00000000-00007768.00000002.72340.02E00000.00000004.mdmp")5a:Tb34,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "4e5e41c05d7b9be4515a5885fbd52573.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "4e5e41c05d7b9be4515a5885fbd52573.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "4e5e41c05d7b9be4515a5885fbd52573.exe") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00004216.00000000.66667.00B3A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00004216.00000000.66667.00B3A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00004216.00000000.66667.00B3A000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004216.00000000.66667.03210000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00004216.00000000.66667.03210000.00000004.mdmp") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; Source: "00000000-00007616.00000000.66731.00447000.00000002.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00007616.00000000.66731.00447000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00007616.00000000.66731.00447000.00000002.mdmp") Found reference to API "RegEnumKeyA" (Indicator: "RegEnumKey"; Source: "00000000-00007616.00000000.66731.00447000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00007616.00000000.66731.03370000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00007616.00000000.66731.03370000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00007768.00000001.70418.02E00000.00000004.mdmp, 00000000-00007768.00000002.72340.02E00000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00007768.00000001.70418.02E00000.00000004.mdmp, 00000000-00007768.00000002.72340.02E00000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00007848.00000000.66518.00ADA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00007848.00000000.66518.00ADA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00007848.00000000.66518.00ADA000.00000002.mdmp")5b:T548,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "4e5e41c05d7b9be4515a5885fbd52573.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "4e5e41c05d7b9be4515a5885fbd52573.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "4e5e41c05d7b9be4515a5885fbd52573.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00004216.00000000.66667.00B3A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004216.00000000.66667.00B3A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004216.00000000.66667.00B3A000.00000002.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00007616.00000000.66731.00447000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcessToken"; Source: "00000000-00007848.00000000.66518.00ADA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007848.00000000.66518.00ADA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007848.00000000.66518.00ADA000.00000002.mdmp")5c:T634,Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "4e5e41c05d7b9be4515a5885fbd52573.exe") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00004216.00000000.66667.00B3A000.00000002.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004216.00000000.66667.03210000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00004216.00000000.66667.03210000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00007616.00000000.66731.03370000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00007616.00000000.66731.03370000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00007768.00000001.70418.02E00000.00000004.mdmp, 00000000-00007768.00000002.72340.02E00000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00007768.00000001.70418.02E00000.00000004.mdmp, 00000000-00007768.00000002.72340.02E00000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00007848.00000000.66518.00ADA000.00000002.mdmp")5d:T41e,"4e5e41c05d7b9be4515a5885fbd52573.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "gh4wl01.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "IU0bP67.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "VF0xM38.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1LX41PH4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "2Cg5677.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "3fH86hE.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK")5e:Te13,"1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "80000000a8973e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "90000000a8973e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "a0000000a8973e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "b0000000a8973e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "c0000000a8973e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "d0000000a8973e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "e0000000a8973e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "f0000000a8973e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "00010000a8973e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "10010000a8973e03" "pDataOut": "20000000f89bec05" "$dataout": "b41f53fd7c91eeb41677c8b431507aa71d8a8df3f42de5625b7d75a16322b842"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "80000000d8993e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "90000000d8993e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "a0000000d8993e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "b0000000d8993e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "c0000000d8993e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "d0000000d8993e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "e0000000d8993e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "f0000000d8993e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "00010000d8993e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "10010000d8993e03" "pDataOut": "200000007897ec05" "$dataout": "b41f53fd7c91eeb41677c8b431507aa71d8a8df3f42de5625b7d75a16322b842"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "80000000389e3e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "90000000389e3e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "a0000000389e3e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "b0000000389e3e03" "pDataOut": "0000000000000000" "$error": "d"} "1LX41PH4.exe" called "CryptUnprotectData" with parameters {"pDataIn": "c0000000389e3e03" "pDataOut": "0000000000000000" "$error": "d"}5f:T7d0,"VF0xM38.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2Cg5677.exe" for deletion "VF0xM38.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1LX41PH4.exe" for deletion "1LX41PH4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxoxp9fYzpwA3_E\8ghN89CsjOW1formhistory.sqlite" for deletion "1LX41PH4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxoxp9fYzpwA3_E\D87fZN3R3jFeplaces.sqlite" for deletion "1LX41PH4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxoxp9fYzpwA3_E\Ei8DrAmaYu9KLogin Data" for deletion "1LX41PH4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxoxp9fYzpwA3_E\02zdBXl47cvzcookies.sqlite" for deletion "1LX41PH4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxoxp9fYzpwA3_E\D87fZN3R3jFeWeb Data" for deletion "1LX41PH4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxoxp9fYzpwA3_E\02zdBXl47cvzHistory" for deletion "1LX41PH4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxoxp9fYzpwA3_E\3b6N2Xdh3CYwWeb Data" for deletion "1LX41PH4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxoxp9fYzpwA3_E\oOPEmFmu_xsJCookies" for deletion "1LX41PH4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\posterBoxoxp9fYzpwA3_E\IWPfiAXUTJTSHistory" for deletion "1LX41PH4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\wO7e4LDYNOPlg4yoIc47UWTDny2mcGYG.zip" for deletion "1LX41PH4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIAoxp9fYzpwA3_E\Cookies\Edge_Default.txt" for deletion "1LX41PH4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIAoxp9fYzpwA3_E\Cookies\Firefox_ywzu7870.default.txt" for deletion "1LX41PH4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIAoxp9fYzpwA3_E\Downloads\Edge_Default.txt" for deletion "1LX41PH4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIAoxp9fYzpwA3_E\information.txt" for deletion "1LX41PH4.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\grandUIAoxp9fYzpwA3_E\passwords.txt" for deletion60:T616,"4e5e41c05d7b9be4515a5885fbd52573.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\gh4wl01.exe" (Handle: 124) "gh4wl01.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\IU0bP67.exe" (Handle: 652) "IU0bP67.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\VF0xM38.exe" (Handle: 644) "IU0bP67.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3fH86hE.exe" (Handle: 632) "VF0xM38.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1LX41PH4.exe" (Handle: 644) "VF0xM38.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2Cg5677.exe" (Handle: 680) "1LX41PH4.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 1080) "1LX41PH4.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 1072) "2Cg5677.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 132) "2Cg5677.exe" wrote 00000200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 132) "2Cg5677.exe" wrote 0002C000 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 132) "2Cg5677.exe" wrote 0000AA00 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (Handle: 132)61:T46c,"1LX41PH4.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\BITCOIN" "1LX41PH4.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\ANONCOIN" "1LX41PH4.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\BBQCOIN" "1LX41PH4.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\FLORINCOIN" "1LX41PH4.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\GOLDCOIN (GLD)" "1LX41PH4.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\IOCOIN" "1LX41PH4.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\INFINITECOIN" "1LX41PH4.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\IXCOIN" "1LX41PH4.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\MEGACOIN" "1LX41PH4.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\MINCOIN" "1LX41PH4.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\YACOIN" "1LX41PH4.exe" opened file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\DIGITALCOIN"62:T404,"1LX41PH4.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\ATOMIC\LOCAL STORAGE" "1LX41PH4.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\ELECTRUM\WALLETS" "1LX41PH4.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\EXODUS\EXODUS.WALLET" "1LX41PH4.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\MONERO\WALLETS" "1LX41PH4.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COINOMI\COINOMI\WALLETS" "1LX41PH4.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\ELECTRONCASH\WALLETS" "1LX41PH4.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\BINANCE\APP-STORE.JSON" "1LX41PH4.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\ETHEREUM\WALLETS" "1LX41PH4.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\MULTIDOGE\MULTIDOGE.WALLET"63:T420,"1LX41PH4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "EMAIL") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "1LX41PH4.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "EMAIL")64:T26c5,"1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Kids Mode\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Kids Mode\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Travel\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Travel\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\hyphen-data\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\hyphen-data\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Nurturing\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Nurturing\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\OriginTrials\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\OriginTrials\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SafetyTips\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SafetyTips\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\ShaderCache\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\ShaderCache\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SmartScreen\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SmartScreen\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Speech Recognition\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Speech Recognition\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\UrlParamClassifications\SYNC EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT" "1LX41PH4.exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\UrlParamClassifications\LOCAL EXTENSION SETTINGS\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI\CURRENT"65:T29e5,1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Kids Mode\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Kids Mode\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Travel\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Travel\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\hyphen-data\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\hyphen-data\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Nurturing\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Nurturing\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\OriginTrials\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\OriginTrials\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SafetyTips\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SafetyTips\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\ShaderCache\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\ShaderCache\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SmartScreen\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SmartScreen\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Speech Recognition\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Speech Recognition\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\UrlParamClassifications\SYNC EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask 1LX41PH4.exe trying to open a file \Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\UrlParamClassifications\LOCAL EXTENSION SETTINGS\NKBIHFBEOGAEAOEHLEFNKODBEFGPGKNN\CURRENT related to MetaMask66:T475,Spawned process "4e5e41c05d7b9be4515a5885fbd52573.exe" (UID: 00000000-00007848) Spawned process "gh4wl01.exe" (UID: 00000000-00007996) Spawned process "IU0bP67.exe" (UID: 00000000-00008048) Spawned process "VF0xM38.exe" (UID: 00000000-00004216) Spawned process "1LX41PH4.exe" (UID: 00000000-00007616) Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\OfficeTrackerNMP131\\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST" (UID: 00000000-00007980) Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\OfficeTrackerNMP131\\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST" (UID: 00000000-00006668) Spawned process "WerFault.exe" with commandline "-pss -s 440 -p 7616 -ip 7616" (UID: 00000000-00002332) Spawned process "WerFault.exe" with commandline "-u -p 7616 -s 2192" (UID: 00000000-00000416) Spawned process "2Cg5677.exe" (UID: 00000000-00000588) Spawned process "AppLaunch.exe" (UID: 00000000-00005872) Spawned process "3fH86hE.exe" (UID: 00000000-00007768)67:T379a,Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "User" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "digicert" in header "GET /DigiCertGlobalRootG3.crt HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cacerts.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BWU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"68:T320b,"enforce_policyccpapaypal.com/102513722163231146258276202665631072839cookie_checkpaypal.com/9217331869376031807690277171415631072839d_id97c41a89d0e740588b8e94d601ba6fcb1701206364095paypal.com/9217331869376031807690337205790631072839LANGen_US%3BUSpaypal.com/921713831782431072906337955790631072839tsrceunifiedloginnodewebpaypal.com/921723565094431073436338237040631072839vreXpYrS%3D1795900764%26vteXpYrS%3D1701208164%26vr%3D17cd0f8818c0aa30b8625e0dfb1ed36e%26vt%3D17cd0f8818c0aa30b8625e0dfb1ed36d%26vtyp%3Dnewpaypal.com/9217418980403231293108398396415631072839ts_cvr%3D17cd0f8818c0aa30b8625e0dfb1ed36e%26vt%3D17cd0f8818c0aa30b8625e0dfb1ed36dpaypal.com/1025418980403231293108398412040631072839" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102513722163231146258276202665631072839cookie_checkpaypal.com/9217331869376031807690277171415631072839d_id97c41a89d0e740588b8e94d601ba6fcb1701206364095paypal.com/9217331869376031807690337205790631072839LANGen_US%3BUSpaypal.com/921713831782431072906337955790631072839tsrceunifiedloginnodewebpaypal.com/921723565094431073436338237040631072839vreXpYrS%3D1795814396%26vteXpYrS%3D1701208196%26vr%3D17cd0f8818c0aa30b8625e0dfb1ed36e%26vt%3D17cd0f8818c0aa30b8625e0dfb1ed36d%26vtyp%3Dnewpaypal.com/921721483673631293109110559933431072846ts_cvr%3D17cd0f8818c0aa30b8625e0dfb1ed36e%26vt%3D17cd0f8818c0aa30b8625e0dfb1ed36dpaypal.com/1025418980403231293108398412040631072839" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102513722163231146258276202665631072839cookie_checkpaypal.com/9217331869376031807690277171415631072839d_id97c41a89d0e740588b8e94d601ba6fcb1701206364095paypal.com/9217331869376031807690337205790631072839LANGen_US%3BUSpaypal.com/921713831782431072906337955790631072839tsrceunifiedloginnodewebpaypal.com/921723565094431073436338237040631072839vreXpYrS%3D1795814397%26vteXpYrS%3D1701208197%26vr%3D17cd0f8818c0aa30b8625e0dfb1ed36e%26vt%3D17cd0f8818c0aa30b8625e0dfb1ed36d%26vtyp%3Dnewpaypal.com/921722483673631293109171469308431072846ts_cvr%3D17cd0f8818c0aa30b8625e0dfb1ed36e%26vt%3D17cd0f8818c0aa30b8625e0dfb1ed36dpaypal.com/102522483673631293109231456808431072846" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102513722163231146258276202665631072839cookie_checkpaypal.com/9217331869376031807690277171415631072839d_id97c41a89d0e740588b8e94d601ba6fcb1701206364095paypal.com/9217331869376031807690337205790631072839LANGen_US%3BUSpaypal.com/921713831782431072906337955790631072839tsrceunifiedloginnodewebpaypal.com/921723565094431073436338237040631072839vreXpYrS%3D1795814397%26vteXpYrS%3D1701208197%26vr%3D17cd0f8818c0aa30b8625e0dfb1ed36e%26vt%3D17cd0f8818c0aa30b8625e0dfb1ed36d%26vtyp%3Dnewpaypal.com/921722483673631293109171469308431072846ts_cvr%3D17cd0f8818c0aa30b8625e0dfb1ed36e%26vt%3D17cd0f8818c0aa30b8625e0dfb1ed36dpaypal.com/102521483673631293109171344308431072846" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102513722163231146258276202665631072839cookie_checkpaypal.com/9217331869376031807690277171415631072839d_id97c41a89d0e740588b8e94d601ba6fcb1701206364095paypal.com/9217331869376031807690337205790631072839LANGen_US%3BUSpaypal.com/921713831782431072906337955790631072839tsrceunifiedloginnodewebpaypal.com/921723565094431073436338237040631072839vreXpYrS%3D1795814396%26vteXpYrS%3D1701208196%26vr%3D17cd0f8818c0aa30b8625e0dfb1ed36e%26vt%3D17cd0f8818c0aa30b8625e0dfb1ed36d%26vtyp%3Dnewpaypal.com/921721483673631293109110559933431072846ts_cvr%3D17cd0f8818c0aa30b8625e0dfb1ed36e%26vt%3D17cd0f8818c0aa30b8625e0dfb1ed36dpaypal.com/102521483673631293109111481808431072846" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102513722163231146258276202665631072839cookie_checkpaypal.com/9217331869376031807690277171415631072839d_id97c41a89d0e740588b8e94d601ba6fcb1701206364095paypal.com/9217331869376031807690337205790631072839LANGen_US%3BUSpaypal.com/921713831782431072906337955790631072839tsrceunifiedloginnodewebpaypal.com/921723565094431073436338237040631072839vreXpYrS%3D1795900764%26vteXpYrS%3D1701208164%26vr%3D17cd0f8818c0aa30b8625e0dfb1ed36e%26vt%3D17cd0f8818c0aa30b8625e0dfb1ed36d%26vtyp%3Dnewpaypal.com/9217418980403231293108398396415631072839" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102513722163231146258276202665631072839cookie_checkpaypal.com/9217331869376031807690277171415631072839d_id97c41a89d0e740588b8e94d601ba6fcb1701206364095paypal.com/9217331869376031807690337205790631072839LANGen_US%3BUSpaypal.com/921713831782431072906337955790631072839tsrceunifiedloginnodewebpaypal.com/921723565094431073436338237040631072839" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102513722163231146258276202665631072839cookie_checkpaypal.com/9217331869376031807690277171415631072839d_id97c41a89d0e740588b8e94d601ba6fcb1701206364095paypal.com/9217331869376031807690337205790631072839LANGen_US%3BUSpaypal.com/921713831782431072906337955790631072839" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102513722163231146258276202665631072839cookie_checkpaypal.com/9217331869376031807690277171415631072839d_id97c41a89d0e740588b8e94d601ba6fcb1701206364095paypal.com/9217331869376031807690337205790631072839" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102513722163231146258276202665631072839cookie_checkpaypal.com/9217331869376031807690277171415631072839" (Indicator: "paypal.com") "enforce_policyccpapaypal.com/102513722163231146258276202665631072839" (Indicator: "paypal.com") "GET /signin HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypal.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "6d; Path=/; Domain=paypal.com; Expires=Fri, 27 Nov 2026 21:19:24 GMT; SecureTraceparent: 00-0000000000000000000f166173509a87-cc054cb01b4607f5-01X-Content-Type-Options: nosniffX-Frame-Options: SAMEORIGINX-Xss-Protection: 1; mode=blockDC: ccg11-origin-www-1.paypal.comAccept-Ranges: bytesVia: 1.1 varnish, 1.1 varnish, 1.1 varnishDate: Tue, 28 Nov 2023 21:19:24 GMTStrict-Transport-Security: max-age=63072000; includeSubDomains; preloadX-Served-By: cache-bur-kbur8200176-BUR, cache-sjc1000085-SJC, cache-sjc1000085-SJCX-Cache: MISS, MISS, MISSX-Cache-Hits: 0, 0, 0X-Timer: S1701206364.019147,VS0,VE139Vary: Accept-EncodingServer-Timing: "traceparent;desc="00-0000000000000000000f166173509a87-178c8a4c615977a3-01"";content-encoding;desc="gzip",x-cdn;desc="fastly"transfer-encoding: chunked" (Indicator: "paypal.com") "GET /web/res/985/b7c27d784aef81253abdd166abc36/css/contextualLoginElementalUIv2.css HTTP/1.1Accept: text/css, */*Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /webcaptcha/grcenterprise_v3_static.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /web/res/985/b7c27d784aef81253abdd166abc36/js/lib/modernizr-2.6.1.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /web/res/985/b7c27d784aef81253abdd166abc36/js/lib/fn-sync-telemetry-min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "HTTP/1.1 200 OKContent-Encoding: gzipAccept-Ranges: bytesCache-Control: s-maxage=31536000, public,max-age=3600Content-Type: application/javascriptDate: Tue, 28 Nov 2023 21:19:42 GMTDC: ccg11-origin-www-1.paypal.comEtag: "64ecc60d-5a30+gzip"Expires: Tue, 28 Nov 2023 22:19:42 GMTLast-Modified: Mon, 28 Aug 2023 16:06:37 GMTPaypal-Debug-Id: 801f8414451b5Server: ECAcc (sac/2516)Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadTiming-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-0000000000000000000801f8414451b5-cdb914aef784ee15-01Vary: Accept-EncodingX-Cache: HITX-Content-Type-Options: nosniffContent-Length: 6752" (Indicator: "paypal.com") "HTTP/1.1 200 OKContent-Encoding: gzipAccept-Ranges: bytesAccess-Control-Allow-Headers: x-csrf-tokenAccess-Control-Allow-Methods: GETAccess-Control-Allow-Origin: *Cache-Control: max-age=31536000, s-maxage=31536000Content-Type: application/javascriptDate: Tue, 28 Nov 2023 21:19:43 GMTDC: ccg11-origin-www-1.paypal.comEtag: W/"65575377-159e"Expires: Wed, 27 Nov 2024 21:19:43 GMTLast-Modified: Fri, 17 Nov 2023 11:50:15 GMTPaypal-Debug-Id: 6fc2aa2665733Server: ECAcc (sac/253C)Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadTiming-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-00000000000000000006fc2aa2665733-ba5d82b6994a855f-01Vary: Accept-EncodingX-Cache: HITX-Content-Type-Options: nosniffContent-Length: 2303" (Indicator: "paypal.com") "HTTP/1.1 200 OKContent-Encoding: gzipAccept-Ranges: bytesAccess-Control-Allow-Headers: x-csrf-tokenAccess-Control-Allow-Methods: GETAccess-Control-Allow-Origin: *Cache-Control: max-age=31536000, s-maxage=31536000Content-Type: application/javascriptDate: Tue, 28 Nov 2023 21:19:42 GMTDC: ccg11-origin-www-1.paypal.comEtag: W/"65575377-edf"Expires: Wed, 27 Nov 2024 21:19:42 GMTLast-Modified: Fri, 17 Nov 2023 11:50:15 GMTPaypal-Debug-Id: d2a91e8917f03Server: ECAcc (sac/252E)Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadTiming-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-0000000000000000000d2a91e8917f03-f619c0ecd7d10662-01Vary: Accept-EncodingX-Cache: HITX-Content-Type-Options: nosniffContent-Length: 1788" (Indicator: "paypal.com") "GET /paypal-ui/icons/svg/chevron-right.svg HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /webstatic/mktg/2014design/font/PP-Sans/PayPalSansBig-Medium.eot? HTTP/1.1Accept: */*Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.paypal.comAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "GET /webstatic/mktg/2014design/font/PP-Sans/PayPalSansBig-Regular.eot? HTTP/1.1Accept: */*Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.paypal.comAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "paypal.com") "HTTP/1.1 200 OKContent-Encoding: gzipAccept-Ranges: bytesAccess-Control-Allow-Origin: *Cache-Control: s-maxage=31536000, public,max-age=3600Content-Type: application/vnd.ms-fontobjectDate: Tue, 28 Nov 2023 21:19:52 GMTDC: ccg11-origin-www-1.paypal.comEtag: W/"560b6e70-a4fc"Expires: Tue, 28 Nov 2023 22:19:52 GMTLast-Modified: Wed, 30 Sep 2015 05:09:04 GMTPaypal-Debug-Id: 2e052a3410145Server: ECAcc (sac/254B)Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadTiming-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-00000000000000000002e052a3410145-6c6d406fae8c4dea-01Vary: Accept-EncodingX-Cache: HITX-Content-Type-Options: nosniffContent-Length: 42180" (Indicator: "paypal.com") "HTTP/1.1 200 OKContent-Encoding: gzipAccept-Ranges: bytesAccess-Control-Allow-Origin: *Cache-Control: s-maxage=31536000, public,max-age=3600Content-Type: image/svg+xmlDate: Tue, 28 Nov 2023 21:19:52 GMTDC: ccg11-origin-www-1.paypal.comEtag: "60271cda-c5+gzip"Expires: Tue, 28 Nov 2023 22:19:52 GMTLast-Modified: Sat, 13 Feb 2021 00:27:06 GMTPaypal-Debug-Id: f2ff462d61cd3Server: ECAcc (sac/2518)Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadTiming-Allow-Origin: https://www.paypal.com,https://www.sandbox.paypal.comTraceparent: 00-0000000000000000000f2ff462d61cd3-666d99ad8b38a0d7-01Vary: Accept-EncodingX-Cache: HITX-Content-Type-Options: nosniffContent-Length: 163" (Indicator: "paypal.com")69:T3d2b,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5169 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 28 Nov 2023 21:19:10 GMT Last-Modified: Tue 28 Nov 2023 19:53:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 116996 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Tue 28 Nov 2023 21:19:11 GMT Etag: "614b5ba7-243" expires: Thu 30 Nov 2023 21:19:11 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5170 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 28 Nov 2023 21:19:11 GMT Last-Modified: Tue 28 Nov 2023 19:53:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 116997 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Tue 28 Nov 2023 21:19:12 GMT Etag: "614b5ba7-243" expires: Thu 30 Nov 2023 21:19:12 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 116998 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Tue 28 Nov 2023 21:19:13 GMT Etag: "614b5ba7-243" expires: Thu 30 Nov 2023 21:19:13 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5172 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 28 Nov 2023 21:19:13 GMT Last-Modified: Tue 28 Nov 2023 19:53:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /DigiCertGlobalRootG3.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 117000 cache-control: max-age=172800 public Content-Type: application/pkix-cert Date: Tue 28 Nov 2023 21:19:15 GMT Etag: "614b5ba7-243" expires: Thu 30 Nov 2023 21:19:15 GMT last-modified: Wed 22 Sep 2021 16:36:55 GMT Server: ECAcc (sac/253C) X-Cache: HIT Content-Length: 579 with response body ==>3082023F308201C5A0030201020210055556BCF25EA43535C3A40FD5AB4572300A06082A8648CE3D0403033061310B3009060355040613025553311530130603....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5177 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 28 Nov 2023 21:19:18 GMT Last-Modified: Tue 28 Nov 2023 19:53:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5182 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 28 Nov 2023 21:19:23 GMT Last-Modified: Tue 28 Nov 2023 19:53:01 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4377 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 28 Nov 2023 21:19:24 GMT Last-Modified: Tue 28 Nov 2023 20:06:28 GMT Server: ECAcc (sac/253E) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3306 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 28 Nov 2023 21:19:25 GMT Last-Modified: Tue 28 Nov 2023 20:24:19 GMT Server: ECAcc (sac/2507) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3309 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 28 Nov 2023 21:19:28 GMT Last-Modified: Tue 28 Nov 2023 20:24:19 GMT Server: ECAcc (sac/2507) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1199 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 28 Nov 2023 21:19:35 GMT Last-Modified: Tue 28 Nov 2023 20:59:36 GMT Server: ECAcc (sac/254D) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2922 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 28 Nov 2023 21:19:38 GMT Last-Modified: Tue 28 Nov 2023 20:30:56 GMT Server: ECAcc (sac/2505) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414748580C066C7DF37DECFBD2937AA031DBEEDCD17180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2951 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 28 Nov 2023 21:19:39 GMT Last-Modified: Tue 28 Nov 2023 20:30:28 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 313 with response body ==>308201350A0100A082012E3082012A06092B06010505073001010482011B3082011730819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2952 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 28 Nov 2023 21:19:40 GMT Last-Modified: Tue 28 Nov 2023 20:30:28 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 313 with response body ==>308201350A0100A082012E3082012A06092B06010505073001010482011B3082011730819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2953 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 28 Nov 2023 21:19:41 GMT Last-Modified: Tue 28 Nov 2023 20:30:28 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 313 with response body ==>308201350A0100A082012E3082012A06092B06010505073001010482011B3082011730819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2956 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 28 Nov 2023 21:19:44 GMT Last-Modified: Tue 28 Nov 2023 20:30:28 GMT Server: ECAcc (sac/2568) X-Cache: HIT Content-Length: 313 with response body ==>308201350A0100A082012E3082012A06092B06010505073001010482011B3082011730819EA2160414B3DB48A4F9A1C5D8AE3641CC1163696229BC4BC6180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 209 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 28 Nov 2023 21:19:57 GMT Last-Modified: Tue 28 Nov 2023 21:16:28 GMT Server: ECAcc (sac/252C) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1533 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 28 Nov 2023 21:20:03 GMT Last-Modified: Tue 28 Nov 2023 20:54:31 GMT Server: ECAcc (sac/253A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B76BA2EAA8AA848C79EAB4DA0F98B2C59576B9F4180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1534 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 28 Nov 2023 21:20:04 GMT Last-Modified: Tue 28 Nov 2023 20:54:31 GMT Server: ECAcc (sac/253A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B76BA2EAA8AA848C79EAB4DA0F98B2C59576B9F4180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1539 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 28 Nov 2023 21:20:09 GMT Last-Modified: Tue 28 Nov 2023 20:54:31 GMT Server: ECAcc (sac/253A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B76BA2EAA8AA848C79EAB4DA0F98B2C59576B9F4180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1150 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 28 Nov 2023 21:20:11 GMT Last-Modified: Tue 28 Nov 2023 21:01:01 GMT Server: ECAcc (sac/2561) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3212 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 28 Nov 2023 21:20:20 GMT Last-Modified: Tue 28 Nov 2023 20:26:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32.......6a:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")6b:T66f,Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D" Found http requests in header "GET /DigiCertGlobalRootG3.crt" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D"6c:T290f,Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:uW5JomQ-W3QrxkMUeAGU2fDsv0KmLA:ppo88yI-qC_C3RwuConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp0j-DmPMwTZfQGW-KiOJWDc69d_pbSIz2Feb0X9Xay_nVjMjkzIshwR_TXuTIfVkOAap-xr HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:3w7xAVbje2cl9Mw16AbNh-1vnqtVtg:khz3uj_eRlpky1GEConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp3oBw4X-MX4UMoTaEy5SDa1mAFbT-8GKqAA9hpruwivYzMNMBPSXkaWMzMgi2zHymRaVk0jPA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1912897530%3A1701206370425218&theme=glif HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:HzrA2w42ZiK5GQ60Vme-xysL6xe87Q:5L3DwRiBN_hGAx5vConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:RuiQG0Dn262LnvWrtTaBPWHRyH_Y7w:HkYx7A7d429TwCkOConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:7M4c3TK7Nn9YMVqTn6pj4QrXXKbKCg:7n_gjLtEDui65e8FConnection: Keep-AliveAccept-Language: en-US"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:PjO0ua236kEQ0tVvnnH0Ls6DWFsEOQ:s6fZ5Y8P2MZhV4_4"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:PjO0ua236kEQ0tVvnnH0Ls6DWFsEOQ:s6fZ5Y8P2MZhV4_4"; in File: "SSL") Found requests in header "POST /v3/signin/_/AccountsSignInUi/data/batchexecute?rpcids=UEkKwb&source-path=%2Fv3%2Fsignin%2Fidentifier&f.sid=5033728877809273410&bl=boq_identityfrontendauthuiserver_20231112.08_p0&hl=en-US&_reqid=1715&rt=c HTTP/1.1Accept: */*X-Same-Domain: 1x-goog-ext-278367001-jspb: ["GlifWebSignIn"]x-goog-ext-391502476-jspb: ["S1929671024:1701206383478479",null,null,"ASKXGp0GmhXy3asqN947xUazibfkUMAj5RMuzEKTe5DRv-hGmBmnOqxQX1sD6mQu5O99f8c5GLFx1w"]Content-Type: application/x-www-form-urlencoded;charset=utf-8Referer: https://accounts.google.com/Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comContent-Length: 165DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:PjO0ua236kEQ0tVvnnH0Ls6DWFsEOQ:s6fZ5Y8P2MZhV4_4"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:9HB1PQI6niMHXV8mLBqzXjk55ro5IQ:_8JMrhQjXkuB1AK0"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:9HB1PQI6niMHXV8mLBqzXjk55ro5IQ:_8JMrhQjXkuB1AK0; OTZ=7315176_52_52_123900_48_436380; NID=511=A2wBswRnSUYo54BAOa9s1hiwlFwSBTDOimm_TsOY646NFrqbx9ox6lCG1n-RIf7Da732h_WCIoI8Z2GIYP2L5OcxEnkr9-20wtkk_5DGqvsBzK0bGHyMIjpGZW2CFyuf33HSzeDuNB_c2LnG97gGhEciRkwsd9dMy8V9hVIHrvo"; in File: "SSL") Found requests in header "GET /generate_204?o_g43A HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:TCAxVDKmK8FV_HFerRppDfc1gBEoTg:exjOavor_yz9-FHv; OTZ=7315176_52_52_123900_48_436380; NID=511=A2wBswRnSUYo54BAOa9s1hiwlFwSBTDOimm_TsOY646NFrqbx9ox6lCG1n-RIf7Da732h_WCIoI8Z2GIYP2L5OcxEnkr9-20wtkk_5DGqvsBzK0bGHyMIjpGZW2CFyuf33HSzeDuNB_c2LnG97gGhEciRkwsd9dMy8V9hVIHrvo"; in File: "SSL") Found requests in header "GET /signin HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypal.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /openid/loginform HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: steamcommunity.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /web/res/985/b7c27d784aef81253abdd166abc36/css/contextualLoginElementalUIv2.css HTTP/1.1Accept: text/css, */*Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /webcaptcha/grcenterprise_v3_static.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /web/res/985/b7c27d784aef81253abdd166abc36/js/lib/modernizr-2.6.1.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /web/res/985/b7c27d784aef81253abdd166abc36/js/lib/fn-sync-telemetry-min.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /paypal-ui/icons/svg/chevron-right.svg HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /webstatic/mktg/2014design/font/PP-Sans/PayPalSansBig-Medium.eot? HTTP/1.1Accept: */*Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.paypal.comAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /webstatic/mktg/2014design/font/PP-Sans/PayPalSansBig-Regular.eot? HTTP/1.1Accept: */*Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.paypal.comAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /paypal-ui/logos/svg/paypal-mark-color.svg HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /webstatic/i/consumer/onboarding/sprite_form_2x.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /pa/mi/paypal/latmconf.js HTTP/1.1Accept: application/javascript, */*;q=0.8Referer: https://www.paypal.com/signinAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /en_US/i/icon/pp_favicon_x.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive"; in File: "SSL")6d:T7952,"GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:uW5JomQ-W3QrxkMUeAGU2fDsv0KmLA:ppo88yI-qC_C3Rwu;Path=/;Expires=Thu, 27-Nov-2025 21:19:24 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-by6WMllBlq-aI51qHP4Mew' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Tue, 28 Nov 2023 21:19:24 GMTExpires: Tue, 28 Nov 2023 21:19:24 GMTCache-Control: private, max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Transfer-Encoding: chunked" "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�00000001P00000001A00000001j00000001�000000010000000010000dc��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R", "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:uW5JomQ-W3QrxkMUeAGU2fDsv0KmLA:ppo88yI-qC_C3RwuConnection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 302 FoundContent-Type: application/binarySet-Cookie: __Host-GAPS=1:3w7xAVbje2cl9Mw16AbNh-1vnqtVtg:khz3uj_eRlpky1GE; Expires=Thu 27-Nov-2025 21:19:29 GMT; Path=/; Secure; HttpOnly; Priority=HIGHCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Tue 28 Nov 2023 21:19:29 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp0j-DmPMwTZfQGW-KiOJWDc69d_pbSIz2Feb0X9Xay_nVjMjkzIshwR_TXuTIfVkOAap-xrStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Opener-Policy: unsafe-noneContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportContent-Security-Policy: script-src 'nonce-WYdpjccN-_NJ4ER0G77yrw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Cross-Origin-Resource-Policy: cross-originAccept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factor Sec-CH-UA-Platform Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Server: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000", "GET /InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp0j-DmPMwTZfQGW-KiOJWDc69d_pbSIz2Feb0X9Xay_nVjMjkzIshwR_TXuTIfVkOAap-xr HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:3w7xAVbje2cl9Mw16AbNh-1vnqtVtg:khz3uj_eRlpky1GEConnection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Set-Cookie: __Host-GAPS=1:HzrA2w42ZiK5GQ60Vme-xysL6xe87Q:5L3DwRiBN_hGAx5v;Path=/;Expires=Thu 27-Nov-2025 21:19:30 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Tue 28 Nov 2023 21:19:30 GMTLocation: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp3oBw4X-MX4UMoTaEy5SDa1mAFbT-8GKqAA9hpruwivYzMNMBPSXkaWMzMgi2zHymRaVk0jPA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1912897530%3A1701206370425218&theme=glifStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk"Report-To: {"group":"coop_gse_qebhlk" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}Content-Security-Policy: require-trusted-types-for 'script';report-uri /cspreportContent-Security-Policy: script-src 'nonce-UEPx5a0zXV7UStwJNUv9pw' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportContent-Encoding: gzipX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "GET /v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp3oBw4X-MX4UMoTaEy5SDa1mAFbT-8GKqAA9hpruwivYzMNMBPSXkaWMzMgi2zHymRaVk0jPA&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1912897530%3A1701206370425218&theme=glif HTTP/1.1Accept: text/html application/xhtml+xml */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:HzrA2w42ZiK5GQ60Vme-xysL6xe87Q:5L3DwRiBN_hGAx5vConnection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 200 OKContent-Type: text/html; charset=utf-8X-Frame-Options: DENYVary: Sec-Fetch-Dest Sec-Fetch-Mode Sec-Fetch-SiteSet-Cookie: __Host-GAPS=1:RuiQG0Dn262LnvWrtTaBPWHRyH_Y7w:HkYx7A7d429TwCkO; Expires=Thu 27-Nov-2025 21:19:35 GMT; Path=/; Secure; HttpOnly; Priority=HIGHx-auto-login: realm=com.google&args=continue%3Dhttps://accounts.google.com/x-ua-compatible: IE=edgeCache-Control: no-cache no-store max-age=0 must-revalidatePragma: no-cacheExpires: Mon 01 Jan 1990 00:00:00 GMTDate: Tue 28 Nov 2023 21:19:35 GMTStrict-Transport-Security: max-age=31536000; includeSubDomainsCross-Origin-Resource-Policy: same-siteReport-To: {"group":"AccountsSignInUi" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}Content-Security-Policy: script-src 'nonce-XzKZF9IjoZs2suq3r7SpzA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreportPermissions-Policy: ch-ua-arch=* ch-ua-bitness=* ch-ua-full-version=* ch-ua-full-version-list=* ch-ua-model=* ch-ua-wow64=* ch-ua-form-factor=* ch-ua-platform=* ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Model Sec-CH-UA-WoW64 Sec-CH-UA-Form-Factor Sec-CH-UA-Platform Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"Content-Encoding: gzipServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000000100000001�000000010000000100000001000000010000000100000001000000010000000100000001�00000001R00000001�00000001n00000001�00000001@00000116d}�+�}Sn�h�f��FP#ۊ�+��X��wŦO>t��Μs2��.�c.��8�h�r7�pot4�h��{Μ��V��6xZ>dO��+=Rc��0w�A��"TpI��7�Z��Ge�/��ViY�CJ��"$LI*�#��[@Y�VXo�]te��|V}FI�z�qL/U�9�kxK�)Լ��>\��)�``o2[~�FY^]H��+��x��ܫ�:o�-�<�_��f�(H�uIՑ(ާc��P��YLN;|��Ƌ��e�e��k`��:��I�$O��P�R�Xd�#e,�,MZXa�2eވp�5}f��[�ցE�", "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�00000001X00000001Y00000001w00000001�00000001�000000010b9e~ﯠ^�)�C��u�%IH 2vyɶl+x�c��~� NN��}��֧��=�/��`�g�_��ߌ�|[��{ۗ2&�T�e��_��:*9��`oF0�-�A`��`�޴�G��vz��<�J�G��L��5"��%�*i�)e��7`��~i�Nƥh�.��`V�k?j��y��}��K��C�Zҁ�\��R�ZY�L��I��#}�K'ftr��[��r�R��r�ZS��b�w��f��E��f��>��-�}�a��P`�L��&��;ط��w��8k��f�D�($4Vh�ф9��&b�q��R��+%�@ٗ��\-��e��R\_��F�&�U��y��J�ZWJ@�t�2�z��C,��pX�v�[�v��IU۰�Ke�3��!l�T�o��ɟ�n��\)W�jE��h��,�"[m�J��~�$��j��ߌZ��m�u�g��T��hýT��[�9Vt_�S��|{[N��+��Vڋ�3��_��Ѐ-��ءc�� a+�k��3�PMq��bIQ�bA�i�;�?�Y"��łnM�{��3^꥚R�4i�>5:�:a;��.��ӌ��ѳ$��L�%��(�}l0��-�b^�=��[�a�F��E�Ie%�0K,��g�*"�P`A��?K�9�F�h�g��X�~��S&��n��j�#6�0��ǅE.w2��μ�j��f,�]&C�#��Ğ�Y2��7C��xPf��p�!SMO�W�:Na7P�r�D��v\Ѱyx��f�b�A�Q�y�=��?I&��]f��I��ʰ�_!��|-ֳK��a.L'a2�|E�y�Z'A4X��Fo��";�̠304��aCbN��k4MD�� 3Q��$�KL�ݽݵWx(JĎV.�M\F��q�%υ�~1��~C��j�bư��&$Jg&Ŕ��F�0��܊�pzKHp�7T|d15e?=�ro�Z��Z.�t"^+D�N�'g��;R��_��5x�,��2��;s�K;��[�xҿ��pB��2��7$�+�z��;]�Ky#�H�h��|1UG��2�7��ŀ%V�w2�O��#�np՟�\8�};+�PWh?��]�gH(��>�gpq�78pCu.��_�)�e� ܰ�̂0�>$T8R�j�嬅��0K$��5Y�H�s�Ƅ?y[n�b_��E͂�@{�%��)/湝c��'� �T��U��ܖ�z��i?[@�ٚ C(x�D��W.�x�F7R�{*}��6�\�_E,1yľ��7p?��YC�!�3T��~��;h��+��]壪�1F��-5x�%v�m��Pbag��ǓA��Dѻ��`F��y��B�oo��\�@��e��7��h|��s�ߖ;~�v�A��^d��g=��*��&N�;�֠ۅN��(�+Q9��Ӊ��o��k^��S^��Y?��V$�:-}��j��[s�I�ͼ2'f�x[��", "00000001�00000001]0000000100000001o00000001�00010268�+��1�䣮�&m�3i��d;�%;�ϑ�4��$QIQ��Π�#�|��{ҟIw�p��1� x^�>+��ُ��exp��c��A�߻��c��C?��Y��/��9ش/��Y��O��=��^�='��?�~X-F�u�?]8��y#�f��_��Pn�5xgK}l�^rg?8�|v�an|��o�8ֱ2��S�z@�sw��fO@#�&�bk>�:�S@�mj��#0�n��a�mX��`8�eR}�E�=�O{��w�p��l6Bh��In��m9��$z߁+.�i��o�{�\9#�빛5��x�DR�~Ѧ� �ġN��C�aͼ��:��`��6#+��A�2��5��K��V�zj��8��O��g30�p��A�3X-C$��(��@�!�`� ��}�ˈ��=8�gH��H�ۘ�3�3=C罀w�c>J��<�C�m�úY��/��36��Ϭ�q{�Åfd�Ò��D�.)�g�}Y4,�|D�'sV}~��.aqd"�`25JB��8�e��!� ��{z�_��,{�'��ێa�CjJ��Ϋ݃��+�Eq߲WW≄#��:�ǟF��ts�5�G�^<��Q��6��`V��v��p�^/�앀I.`��֗��x~荶s��ٽ�JĴ�pc�-wKU0:{&��V�9��>R��D#T��jp��b��rb��=V�(k�J�S+0�-GSA�?\^!�BZCrx��`��F�r��Y�", "�//�]*#q��z@d�~b��!|�V��~؄��Лy�5y&s!��eZ|��O��ۡ�@�I24lUXE�E��DE��G��,8�[4��gҨ�B�ٚ[��֋5)7��-)R+�O��C6��D��x�?��WZVz�w_7?z.8m�_m��L௽yH��g�w5��D��& ��@�ۀz��*�8Wwu��N��Վ�+�r#%Ĳ��]��?C��(DjT�$��٥��>��[zԨ8�/�#�8?��a�t��\��bd&o>wܷ��5��G�E��Qk��OǗ�-��}LE-��H��CE��Oo8��`��\;N2@&O1�j�_/X��/S�h��!�_��{h�N�FA~Ơ#��̀�d-U{@��K/�g��O�W��@a�IS��l�`��w��س��9�j�b�J�`)u�hZu1�f�~��M�]��A�piN0)��0Ժ�_��/�e�Du�5��r�c��T�[��)itiVGf�"�!0+�/��S��k��?�]wƂ� ��+٦��_=0|im��w��D�>�/o��Q�ʌ��Cc�ʋ��m��?S��A�9QȌmu��Nj�tj�=��}]Q��P2`(�Ɠ��=;~+�Y��G��ã��Qi�lR�f�[��-��ӛq��Z��:P_��+��X�F��iHEZ�Z��N�3,Z+iu9��D{��=�|M��X��.U8��+v�Y�^N8�2=tNx�^��$[��E7s��(�.�+@��|�\_ �5�k��9��X�0�8��*��)Yɴw�z˦�ؓ�/i�۽��z��C��IHX]L��.8ED|��_��6:CSu��ly=�f��|}r�w-B�fyhLZB oއ�8��7��8ZR2Bw��QN��1Rt��<�<=�Ǵ��&�$O�-�䫞F`-��=�Ƹki�!Tk[�x?��F\��ݶ�J��t��4�Yq��$��-/��Rѯ0E��v��y��i��ZJ�)�S�w�x"Iݨ�@�X��&R��n_�9V�+��", "@;6��:�A�=%~Ѝ�*<��*�6Ϣ��p)�t��^�_�j��ǒf�dv{��P��X��_N��I�'��9��y�*�Ņ(B��Ӂ)��Y�ڍ��@�K�ϯ�Ȋa@�Ȳ1!�0hE��gŚ!B2�P�И�h��뛍��a�?An��@�r�mt��d�I��H��D'��ļ�:^�z�E��*Fq�WR��G)*�a*��"N)��H�K��P��]�*��i�U�\{�u�x%4��b�RMR.d�E5�ߦ�2m�,Qj�CM�,�x"Gwt�N��P��%b��Y&|��ަA�gI�e�!�g��^&�ץti��!&LL�(�+z��뜞bh�Y*��Z�5g�FfQ3g�B�&'�9��SI��Q�;�B�)יs�/�n�Tc�4rz�T3��eS~t��C5IєC�S��D6j��B|OvNŊ�A�I��Th�ɋ)��v�_ßhO&m=z�@��%�g/��u:��+2�3h�4��3+�-�v��;>�Q��{�Ɋȉ4�f~K��~-ߘ�?`F3��&P��aY�n�M�;~�9��ߍY��MҔQO��|r1��#�&s�7]�趍�l�zˈ�I�nBB��.I&k̎oJ�"��ے�mN�6Z-��/��1�s%�Pi��~W��Ր-1�+0F�L%�2T2_�_hU8F��J[��ߣ��6�~5(��t��ԫ#�^�V�`�}��S�`��J��7��j��#�(=W��^�B� �{B��at��8r��H�x�:�4,`��Q0��Hf��wM��&ON4�3��U1dK� s�M�Ń�tY�f��a��!��p%6��-q�%�}��g5�a��;}�Y��jA��{ʻ|AYg{��͟o<�~�'��?��"k�EEEf�4|�� ͔8��IL�&�l�gض��?dD)��f�Q��=�/�W/@��į�e<�V�[fe�TO��H�%�0�P2��7i��mC�:��[��W�� 2�vc~�ٺ�2@��=-�hO��P2A�W�K�ѯ��DU5]N�~�ƕ�E��s��K��T�$�_I�'��~��=N]xH�ԩ��tʵƊ}_WQ��Y�N�cž�+��t�B+�Ǌ}��b+~�n�t��E5��E}��+u��J�8|zq��)�v�.Ƈ+C��L�@��]�d��#ר�'�(��M6��Ӫ�y��S.�I�yѭ��TsJ,JO\ᐛ*fU8t\�G��i��=�_x�", "%ν�(U�U9m��?�HS6�-k]J�%v�b��]wF�#(��?��", "00000001�00000001]00000001m00000001S00000001�0000000180000000100000001�00000001+00000001|00000001�00000001L00000001�00000001�00000001�00000001�0000000100000001j00000001�001�8bf��q�״��k�� ؼ��ϲ�X��LbZ�$�z�]�])R��T�h;�OJ@��k@�t��Q(c��GF��y�[ubE�)bRאX��a��(��%�f�gtŉ�Z&V*�_��!0UÕ^q�Fݻ��,U��bZ��M��v��-�c��"�[�m}�u;�m��oo�*R��u�^9fF�j%Y�,)��K��(h'��A�d�K?'y�^�(��q��e:�Z��՜8��B-8�R�Ъ��=q��,I`��#&�E��4K|�f�!?�I��S)��-�\��u��eq�*;�޲�2�6q��v�$� �);nYؙ#��u@��E��!��x��V�>�T\��Z9b�m2��(�4�H��RuV��e$��<��t8=`R��j��hZ�jN�zFW�W�e:��7@:�.��B�[R�T��w�@*dxm@��Q;��p�jPQ�K]h}��!}-��2$��289ପ9E֧��6��ij�Z�8�՜��q*��qrH�ׅ8ս[ht�'�*;�n��g��&��A�+g��<��ǵ>��Λ��k�rM��4>u)��At�=.o�q'2��/K��%u�*K��JX�zu�ccr��b�h�k驛��Z#-�>.��a��mҭ�v��ë��}�g/�$s'��ץ}�_��g�;�n��w3��*��/AWԂ\~��z�7�D�� [b�P�k��!��`X��q?nM�{��{��ҋ3D�q��@$:�� F�Ğ�w��*S$��>��v�� d6�L&WN�S�o�< �B��HHM1@�:H��Ǵ�+�( ˫r��n�e"�@�M�x~��ƶ��̆��e��9�st�[|�6��љ�d�", "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:RuiQG0Dn262LnvWrtTaBPWHRyH_Y7w:HkYx7A7d429TwCkOConnection: Keep-AliveAccept-Language: en-US", "HTTP/1.1 302 Moved TemporarilyContent-Type: text/html; charset=UTF-8Strict-Transport-Security: max-age=31536000; includeSubDomainsSet-Cookie: __Host-GAPS=1:7M4c3TK7Nn9YMVqTn6pj4QrXXKbKCg:7n_gjLtEDui65e8F;Path=/;Expires=Thu 27-Nov-2025 21:19:39 GMT;Secure;HttpOnly;Priority=HIGHX-Frame-Options: DENYContent-Security-Policy: script-src 'nonce-6Xoc3NooTqoBDAsw763gYQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreportLocation: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2FContent-Encoding: gzipDate: Tue 28 Nov 2023 21:19:39 GMTExpires: Tue 28 Nov 2023 21:19:39 GMTCache-Control: private max-age=0X-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockServer: GSEAlt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000Transfer-Encoding: chunked", "0000001ec��PAj�0��B!=ZN��u��X�K_E�1��ax%�u��~�7Q�8z�IN��#��_�o�d��)��2�Q|&��Ht@ΨfƑNZ��:eJ;�F�ĘTg�l�"��5{�i��f7Jk��6y|H�;��g��f�4��s%˳��À��x��fL�Y�ž�K��P�/��@�R" "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comCookie: __Host-GAPS=1:7M4c3TK7Nn9YMVqTn6pj4QrXXKbKCg:7n_gjLtEDui65e8FConnection: Keep-AliveAccept-Language: en-US" "HTTP/1.1 302 FoundContent-Type: application/binarySet-Cookie: __Host-GAPS=1:syIdqj9GmQFd04LZvixXfbn_OCaO0A:WUKfV38l2KrxXRET; Expires=Thu, 27-Nov-2025 21:19:42 GMT; Path=/; Secure; HttpOnly; Priority=HIGHCache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 28 Nov 2023 21:19:42 GMTLocation: https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp2-F2v6xcm4MPnWpASY-KjMnhWnl339GyU1p71MVjZ0NfDBVgTaGiOv1PytAxTQsANBDjywMQStrict-Transport-Security: max-age=31536000; includeSubDomainsPermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-WaclGjZGGCWyVD4WJ794YA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreportCross-Origin-Resource-Policy: cross-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: unsafe-noneServer: ESFContent-Length: 0X-XSS-Protection: 0X-Content-Type-Options: nosniffAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" "00000001�00000001]00000001Y00000001s00000001�0000000160000000100000001�00000001+00000001�00000001�00000001t00001&804��4$cɲ��$M�9:��(��P�II��/�KE��,��^X��F��(y{y��?鯕8Q��zh��yws��ͬ��u&?F�i�QU:��@��ݕ�fAh��.��*��v�I��oT@�P��j��)}7��;B�h�u��ɼ��k'��"ҵ�Z�m'j'�fOƞ~5i�F�G�B�7�O��HU&��H�}�Rǌ��S��gW{��Z�bj��l�(6i�&��/��~�3��Dc�4��Wm��}ݼ}�`Dy�T��;��01��Q��g:O�i$Ҵ�d��c�n��~eTne�#��ȜOV��C��҄#�xOQ[�㳳��\x��iH�R�Jґ6YZ��H\d0��8�͆��&�S��G�@[9S�ګ�rJ'��.�~��R�U�a#�x�<ˊ��"��׀��b�-�7��9��b�V��P&1�M�T�n�!��k��S��w��i�B�A��G�R85�Љաfpj|1�<�ꇦ�,�pu\��hWr[�澚��t��B��=�9��tݘ]�J��4[��o�֬�VTz_g�}g��1[u�H^ó��׷��.q�5/n��l�ʁ��An��h��I��AΛ��K8e�H(f��!s��\��h��ZY}�a��g{�[��%R�J�BD#�V~��A%��rh21�o>R��e�/ .4�L�DUך��љ6/��u܉c��6�;ψ�#H�� *�mK�L ��q��Zs?��|s<�S3", "�|sHL�7|�n��]��p�0��E6*o'+�%z1�s�hYd�_.Uu��lJA�ˊ��kKM˶GD1�o�谥��6<��>��$�.��Jg��\Y��۽b�jm��زi��D\ZqK�L~{FkqAY�O��|a84ÈH��b_�2q[8M��u�Yx��[�R�.��L�/{iqܲ�G�8��'Y��$A��5��|��|_?|��Ï�cJ��7w�sck��5��e?�>��\z�X�-�Ĭ$X8��\��=�W^7o�B��ƒ�6��1�K=Y��O��,_Ŋx�ů��%��S�A�.�+'��i�[$��o��F�-s��i�Bf�]��/]^J��e�%-f�^��8��T3��(z��(��^\@w=VwUV��Y��A�>��s莢�ꎢ��J莢�ꎢ�꞉tG�cuGQ�� Υ�E��t|F�r�r�Ԑ�@��\��\��uT�4�K��COx��q�'<�p��8z\��q=.��|�qG�C�:#[M��Y��O�EM�Y�lK�EM�Y�o�We.W�k��3-pJΝ��ڢ�O��*�粤�9��cDu,��(`��m��i��`�4��X��{��pK>�J��(}�`��D?48��8ly��"b(c�5��#b(c�5� %4S��Qր��5��Qր�5��Qր⣈5��1�(|�^ ��", "00000001�0001d5]�j�0��!�/��B�G'��!��{�]Q�i�;;qA��H��w$��2k�W�l@4w��f°�C�g�5��<+�}KB��0�bm&+a0�y�s3aX��!̳��q~`�&��V0�ƿֵ�a�z�פV0�W��1c��ğ �l&��U`��E&� S`�i&��~*^޳�r��/`��R�A�q�a�g�~>f�К�v�c��}�gz��b/>?t��燎��p��:vG��>5R��o$[��Y��o��\e[�� y�*K� (�t�=w>M`V#�gf5eF�ux&�3�f^i}��[�s�A��b$9�.��CSy�ͦ��9��G ��Ҥ��01��n�K$"�#�NLS��2C��_vF��"6e:T6d5,Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: accounts.google.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 204 No ContentContent-Length: 0Cross-Origin-Resource-Policy: cross-originDate: Tue, 28 Nov 2023 21:20:25 GMTAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /signin HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.paypal.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /en_US/i/icon/pp_favicon_x.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: www.paypalobjects.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: store.steampowered.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 304 Not ModifiedDate: Thu, 23 Nov 2023 22:42:38 GMTExpires: Fri, 22 Nov 2024 22:42:38 GMTLast-Modified: Mon, 16 Oct 2017 17:32:56 GMTCache-Control: public, max-age=31536000Age: 427030Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000" (Indicator: "HTTP/1.1"; File: "SSL")6f:T1f40,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEAx5qUSwjBG" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6U" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAq9F6UNEL2nYhx7xCvy3%2FI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnx" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAp6FnkBkACKqk%2BVbKsyAbY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrj" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdi" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "uNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0B" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffH" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk4" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "5WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6q" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAqiBEK%2F1RSvcy4lL46SQ4M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vd" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"70:T43a,"77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00003428] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003428] "Cab701C.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\Cab701C.tmp]- [targetUID: 00000000-00003428] "Cab70C8.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63165 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\Cab70C8.tmp]- [targetUID: 00000000-00003372]71:T667,"new_login_bg_strong_mask_1_.jpg" has type "JPEG image data Exif standard: [TIFF image data little-endian direntries=0] baseline precision 8 1920x1080 components 3" and extension "jpg" "header_logo_1_.png" has type "PNG image data 744 x 171 8-bit/color RGBA non-interlaced" and extension "png" "glyph_alert_critical_big-2x_1_.png" has type "PNG image data 224 x 200 8-bit/color RGBA non-interlaced" and extension "png" "sprite_form_2x_1_.png" has type "PNG image data 48 x 1350 8-bit colormap non-interlaced" and extension "png" "header_menu_hamburger_1_.png" has type "PNG image data 244 x 212 8-bit/color RGBA non-interlaced" and extension "png" "logo_steam_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png" "footerLogo_valve_new_1_.png" has type "PNG image data 176 x 50 8-bit/color RGBA non-interlaced" and extension "png" "icon-PN-check_1_.png" has type "PNG image data 121 x 133 8-bit/color RGBA non-interlaced" and extension "png" "logo_valve_footer_1_.png" has type "PNG image data 92 x 26 8-bit/color RGBA non-interlaced" and extension "png" "ico_twitter_1_.gif" has type "GIF image data version 89a 16 x 16" and extension "gif" "ico_facebook_1_.gif" has type "GIF image data version 89a 16 x 16" and extension "gif" "logo46x38_1_.png" has type "PNG image data 46 x 38 8-bit/color RGBA non-interlaced" and extension "png" "btn_header_installsteam_download_1_.png" has type "PNG image data 15 x 13 8-bit/color RGBA non-interlaced" and extension "png" "btn_arrow_down_padded_1_.png" has type "PNG image data 19 x 12 8-bit/color RGBA non-interlaced" and extension "png"72:Tc007,"initAft()