26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 73:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample 19b2a5a72d27… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 19b2a5a72d27…. Malware family: Crifi.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 24 malicious and 33 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52"],"about":{"@type":"SoftwareApplication","name":"70dacb108d23e83d818c5006da2eae9c.exe","applicationCategory":["peexe","executable"],"identifier":"19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":12,"total":28},"behavioralIndicators":{"malicious":24,"suspicious":33},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T25c4,Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolder"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBeep"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")28:T448,"19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" called "FindResourceA" with parameter "11735884" - (UID: 00000000-00004072) "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" called "FindResourceA" with parameter "2160984" - (UID: 00000000-00004072) "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" called "FindResourceA" with parameter "11735752" - (UID: 00000000-00004072) "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" called "FindResourceA" with parameter "11735760" - (UID: 00000000-00004072) "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" called "FindResourceA" with parameter "11735788" - (UID: 00000000-00004072) "uS1hK33.exe" called "FindResourceA" with parameter "523096" - (UID: 00000000-00004276) "uS1hK33.exe" called "FindResourceA" with parameter "9966280" - (UID: 00000000-00004276) "uS1hK33.exe" called "FindResourceA" with parameter "9966288" - (UID: 00000000-00004276) "uS1hK33.exe" called "FindResourceA" with parameter "9966316" - (UID: 00000000-00004276)29:T41c,"19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11782112'}" (UID: 00000000-00004072) "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11782224'}" (UID: 00000000-00004072) "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11782256'}" (UID: 00000000-00004072) "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11782240'}" (UID: 00000000-00004072) "uS1hK33.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10012752'}" (UID: 00000000-00004276) "uS1hK33.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10012784'}" (UID: 00000000-00004276) "uS1hK33.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10012768'}" (UID: 00000000-00004276)2a:T4ff,"1yl18XO9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}") "1yl18XO9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PROPERTYBAG") "1yl18XO9.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1") "1yl18XO9.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\KNOWNFOLDERS") "1yl18XO9.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "1yl18XO9.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "1yl18XO9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS") "1yl18XO9.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}") "1yl18XO9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}")2b:T131e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-15-00081F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-15-00081F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-16-000844B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-16-000844B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-22-0008681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-22-0008681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-26-000824E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-26-000824E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-29-000852B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-29-000852B6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001016-13142-31-00082390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001016-13142-31-00082390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-33-00082F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-33-00082F1D Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00001016-13142-36-00083BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00001016-13142-36-00083BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-37-00083FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-37-00083FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-40-00082267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-40-00082267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-41-00086495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-41-00086495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-42-0008202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00001016-13142-42-0008202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-42-0008202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-43-00081AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-43-00081AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-44-00082AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-44-00082AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-52-00084EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-52-00084EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-57-00086298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-57-00086298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-59-0008621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-59-0008621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-60-0008597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-60-0008597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-62-000855A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-62-000855A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-63-00085467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-63-00085467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-65-000853A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-65-000853A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-66-00082630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-66-00082630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-71-00082CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-71-00082CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-72-000818A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-72-000818A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001016-13142-73-000817EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001016-13142-73-000817EE2c:Tece9,Found XOR loop in file "uS1hK33.exe" at offset 195299; code bytes = 30d0 Found XOR loop in file "uS1hK33.exe" at offset 228697; code bytes = 30d0 Found XOR loop in file "uS1hK33.exe" at offset 251355; code bytes = 30d0 Found XOR loop in file "uS1hK33.exe" at offset 358904; code bytes = 30d0 Found XOR loop in file "uS1hK33.exe" at offset 581153; code bytes = 30d0 Found XOR loop in file "uS1hK33.exe" at offset 759508; code bytes = 30d0 Found XOR loop in file "uS1hK33.exe" at offset 816255; code bytes = 30d0 Found XOR loop in file "uS1hK33.exe" at offset 931207; code bytes = 30d0 Found XOR loop in file "uS1hK33.exe" at offset 954361; code bytes = 30d0 Found XOR loop in file "uS1hK33.exe" at offset 961396; code bytes = 30d0 Found XOR loop in file "uS1hK33.exe" at offset 963266; code bytes = 30d0 Found XOR loop in file "uS1hK33.exe" at offset 1023103; code bytes = 30d0 Found XOR loop in file "uS1hK33.exe" at offset 1035872; code bytes = 30d0 Found XOR loop in file "uS1hK33.exe" at offset 1344983; code bytes = 30d0 Found XOR loop in file "uS1hK33.exe" at offset 1353931; code bytes = 30d0 Found XOR loop in file "uS1hK33.exe" at offset 1466477; code bytes = 30d0 Found XOR loop in file "uS1hK33.exe" at offset 1525589; code bytes = 30d0 Found XOR loop in file "uS1hK33.exe" at offset 1540622; code bytes = 30d0 Found XOR loop in file "uS1hK33.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 158038; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 339470; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 491981; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 511926; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 540426; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 567332; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 742195; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 764372; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 871184; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 892214; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 945274; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 961782; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 965548; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 983986; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 1012004; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 1107339; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 1154594; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 1176163; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 1205375; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 1282303; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 1318305; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 1337317; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 1433435; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 1438207; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 1447621; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 1645497; code bytes = 33c1 Found XOR loop in file "uS1hK33.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 181259; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 185380; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 214893; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 244131; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 256149; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 381920; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 388662; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 478150; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 495982; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 522665; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 556414; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 556698; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 660406; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 669755; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 684871; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 806674; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 858785; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 1130447; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 1183744; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 1186629; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 1191265; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 1206972; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 1310176; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 1311107; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 1312417; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 1327555; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 1385363; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 1475796; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 1509301; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 1551605; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 1556954; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 1601708; code bytes = 8030 Found XOR loop in file "uS1hK33.exe" at offset 1637602; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1274152; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1287765; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1485168; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1507775; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1514635; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1514887; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1515347; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1516553; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1521461; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1522625; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 1538921; code bytes = 30d0 Found XOR loop in file "FANBooster131.exe" at offset 688249; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688345; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688444; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688500; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688526; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688604; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688747; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 688843; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 689850; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 690446; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 764137; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 817238; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 817472; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 909588; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 924330; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 942350; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 948128; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 953465; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 953616; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 969842; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 971092; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 983876; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 985045; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 985160; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 989471; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 989786; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 990362; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 992172; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 992479; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 992865; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 992957; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 993612; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 995617; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 999815; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1000389; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1001271; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1001375; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1002055; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1002170; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1006463; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1007340; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1027259; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1033356; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1034159; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1289436; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1441388; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1505345; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1507059; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 1513223; code bytes = 33c1 Found XOR loop in file "FANBooster131.exe" at offset 735579; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735612; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735686; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735764; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735781; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735802; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735842; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735923; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735946; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 735963; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 736030; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 736068; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 736997; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 737018; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 833270; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 838380; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 845494; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 845523; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 857223; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 869347; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 869366; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 869863; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925121; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925175; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925196; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925223; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925256; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925280; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925297; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925319; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925429; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 925471; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1337260; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1349610; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1362066; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1495860; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1517374; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1521442; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1522614; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1523404; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1537116; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 1538890; code bytes = 8030 Found XOR loop in file "2Sp1112.exe" at offset 834088; code bytes = 30d0 Found XOR loop in file "2Sp1112.exe" at offset 870017; code bytes = 30d0 Found XOR loop in file "2Sp1112.exe" at offset 1141197; code bytes = 30d0 Found XOR loop in file "2Sp1112.exe" at offset 1152317; code bytes = 30d0 Found XOR loop in file "2Sp1112.exe" at offset 1154881; code bytes = 30d0 Found XOR loop in file "2Sp1112.exe" at offset 1155743; code bytes = 30d0 Found XOR loop in file "2Sp1112.exe" at offset 1157399; code bytes = 30d0 Found XOR loop in file "2Sp1112.exe" at offset 89010; code bytes = 33c1 Found XOR loop in file "2Sp1112.exe" at offset 148580; code bytes = 33c1 Found XOR loop in file "2Sp1112.exe" at offset 148752; code bytes = 33c1 Found XOR loop in file "2Sp1112.exe" at offset 149045; code bytes = 33c1 Found XOR loop in file "2Sp1112.exe" at offset 154932; code bytes = 33c1 Found XOR loop in file "2Sp1112.exe" at offset 155104; code bytes = 33c1 Found XOR loop in file "2Sp1112.exe" at offset 155397; code bytes = 33c1 Found XOR loop in file "2Sp1112.exe" at offset 181222; code bytes = 33c1 Found XOR loop in file "2Sp1112.exe" at offset 277995; code bytes = 33c1 Found XOR loop in file "2Sp1112.exe" at offset 678287; code bytes = 33c1 Found XOR loop in file "2Sp1112.exe" at offset 871771; code bytes = 33c1 Found XOR loop in file "2Sp1112.exe" at offset 875510; code bytes = 33c1 Found XOR loop in file "2Sp1112.exe" at offset 921783; code bytes = 33c1 Found XOR loop in file "2Sp1112.exe" at offset 942304; code bytes = 33c1 Found XOR loop in file "2Sp1112.exe" at offset 1149387; code bytes = 33c1 Found XOR loop in file "2Sp1112.exe" at offset 622993; code bytes = 8030 Found XOR loop in file "2Sp1112.exe" at offset 625199; code bytes = 8030 Found XOR loop in file "2Sp1112.exe" at offset 629564; code bytes = 8030 Found XOR loop in file "2Sp1112.exe" at offset 632680; code bytes = 8030 Found XOR loop in file "2Sp1112.exe" at offset 796692; code bytes = 8030 Found XOR loop in file "2Sp1112.exe" at offset 811562; code bytes = 8030 Found XOR loop in file "2Sp1112.exe" at offset 1146358; code bytes = 8030 Found XOR loop in file "2Sp1112.exe" at offset 1152284; code bytes = 8030 Found XOR loop in file "2Sp1112.exe" at offset 1156962; code bytes = 8030 Found XOR loop in file "2Sp1112.exe" at offset 1164451; code bytes = 8030 Found XOR loop in file "2Sp1112.exe" at offset 1165667; code bytes = 8030 Found XOR loop in file "jY0EZ40.exe" at offset 181187; code bytes = 30d0 Found XOR loop in file "jY0EZ40.exe" at offset 263048; code bytes = 30d0 Found XOR loop in file "jY0EZ40.exe" at offset 485183; code bytes = 30d0 Found XOR loop in file "jY0EZ40.exe" at offset 663458; code bytes = 30d0 Found XOR loop in file "jY0EZ40.exe" at offset 720181; code bytes = 30d0 Found XOR loop in file "jY0EZ40.exe" at offset 835068; code bytes = 30d0 Found XOR loop in file "jY0EZ40.exe" at offset 858214; code bytes = 30d0 Found XOR loop in file "jY0EZ40.exe" at offset 865233; code bytes = 30d0 Found XOR loop in file "jY0EZ40.exe" at offset 867103; code bytes = 30d0 Found XOR loop in file "jY0EZ40.exe" at offset 926924; code bytes = 30d0 Found XOR loop in file "jY0EZ40.exe" at offset 939676; code bytes = 30d0 Found XOR loop in file "jY0EZ40.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "jY0EZ40.exe" at offset 243622; code bytes = 33c1 Found XOR loop in file "jY0EZ40.exe" at offset 396060; code bytes = 33c1 Found XOR loop in file "jY0EZ40.exe" at offset 415988; code bytes = 33c1 Found XOR loop in file "jY0EZ40.exe" at offset 444480; code bytes = 33c1 Found XOR loop in file "jY0EZ40.exe" at offset 471362; code bytes = 33c1 Found XOR loop in file "jY0EZ40.exe" at offset 646153; code bytes = 33c1 Found XOR loop in file "jY0EZ40.exe" at offset 668306; code bytes = 33c1 Found XOR loop in file "jY0EZ40.exe" at offset 775077; code bytes = 33c1 Found XOR loop in file "jY0EZ40.exe" at offset 796099; code bytes = 33c1 Found XOR loop in file "jY0EZ40.exe" at offset 849135; code bytes = 33c1 Found XOR loop in file "jY0EZ40.exe" at offset 865619; code bytes = 33c1 Found XOR loop in file "jY0EZ40.exe" at offset 869385; code bytes = 33c1 Found XOR loop in file "jY0EZ40.exe" at offset 887815; code bytes = 33c1 Found XOR loop in file "jY0EZ40.exe" at offset 915833; code bytes = 33c1 Found XOR loop in file "jY0EZ40.exe" at offset 1011111; code bytes = 33c1 Found XOR loop in file "jY0EZ40.exe" at offset 1058350; code bytes = 33c1 Found XOR loop in file "jY0EZ40.exe" at offset 1079903; code bytes = 33c1 Found XOR loop in file "jY0EZ40.exe" at offset 1109107; code bytes = 33c1 Found XOR loop in file "jY0EZ40.exe" at offset 1155513; code bytes = 33c1 Found XOR loop in file "jY0EZ40.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "jY0EZ40.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "jY0EZ40.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "jY0EZ40.exe" at offset 286048; code bytes = 8030 Found XOR loop in file "jY0EZ40.exe" at offset 292790; code bytes = 8030 Found XOR loop in file "jY0EZ40.exe" at offset 382237; code bytes = 8030 Found XOR loop in file "jY0EZ40.exe" at offset 400061; code bytes = 8030 Found XOR loop in file "jY0EZ40.exe" at offset 426719; code bytes = 8030 Found XOR loop in file "jY0EZ40.exe" at offset 460460; code bytes = 8030 Found XOR loop in file "jY0EZ40.exe" at offset 460744; code bytes = 8030 Found XOR loop in file "jY0EZ40.exe" at offset 564396; code bytes = 8030 Found XOR loop in file "jY0EZ40.exe" at offset 573745; code bytes = 8030 Found XOR loop in file "jY0EZ40.exe" at offset 588861; code bytes = 8030 Found XOR loop in file "jY0EZ40.exe" at offset 710600; code bytes = 8030 Found XOR loop in file "jY0EZ40.exe" at offset 762678; code bytes = 8030 Found XOR loop in file "jY0EZ40.exe" at offset 1034211; code bytes = 8030 Found XOR loop in file "jY0EZ40.exe" at offset 1087476; code bytes = 8030 Found XOR loop in file "jY0EZ40.exe" at offset 1090361; code bytes = 8030 Found XOR loop in file "jY0EZ40.exe" at offset 1094997; code bytes = 8030 Found XOR loop in file "jY0EZ40.exe" at offset 1110704; code bytes = 8030 Found XOR loop in file "tR3EY47.exe" at offset 273895; code bytes = 30d0 Found XOR loop in file "tR3EY47.exe" at offset 329386; code bytes = 30d0 Found XOR loop in file "tR3EY47.exe" at offset 390149; code bytes = 30d0 Found XOR loop in file "tR3EY47.exe" at offset 568326; code bytes = 30d0 Found XOR loop in file "tR3EY47.exe" at offset 625016; code bytes = 30d0 Found XOR loop in file "tR3EY47.exe" at offset 739845; code bytes = 30d0 Found XOR loop in file "tR3EY47.exe" at offset 762983; code bytes = 30d0 Found XOR loop in file "tR3EY47.exe" at offset 770002; code bytes = 30d0 Found XOR loop in file "tR3EY47.exe" at offset 771872; code bytes = 30d0 Found XOR loop in file "tR3EY47.exe" at offset 831661; code bytes = 30d0 Found XOR loop in file "tR3EY47.exe" at offset 844413; code bytes = 30d0 Found XOR loop in file "tR3EY47.exe" at offset 1017144; code bytes = 30d0 Found XOR loop in file "tR3EY47.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "tR3EY47.exe" at offset 147919; code bytes = 33c1 Found XOR loop in file "tR3EY47.exe" at offset 349454; code bytes = 33c1 Found XOR loop in file "tR3EY47.exe" at offset 376328; code bytes = 33c1 Found XOR loop in file "tR3EY47.exe" at offset 551029; code bytes = 33c1 Found XOR loop in file "tR3EY47.exe" at offset 573174; code bytes = 33c1 Found XOR loop in file "tR3EY47.exe" at offset 679887; code bytes = 33c1 Found XOR loop in file "tR3EY47.exe" at offset 700901; code bytes = 33c1 Found XOR loop in file "tR3EY47.exe" at offset 753904; code bytes = 33c1 Found XOR loop in file "tR3EY47.exe" at offset 770388; code bytes = 33c1 Found XOR loop in file "tR3EY47.exe" at offset 774154; code bytes = 33c1 Found XOR loop in file "tR3EY47.exe" at offset 792576; code bytes = 33c1 Found XOR loop in file "tR3EY47.exe" at offset 820570; code bytes = 33c1 Found XOR loop in file "tR3EY47.exe" at offset 915815; code bytes = 33c1 Found XOR loop in file "tR3EY47.exe" at offset 963021; code bytes = 33c1 Found XOR loop in file "tR3EY47.exe" at offset 984566; code bytes = 33c1 Found XOR loop in file "tR3EY47.exe" at offset 1009388; code bytes = 33c1 Found XOR loop in file "tR3EY47.exe" at offset 1029049; code bytes = 33c1 Found XOR loop in file "tR3EY47.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "tR3EY47.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "tR3EY47.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "tR3EY47.exe" at offset 185308; code bytes = 8030 Found XOR loop in file "tR3EY47.exe" at offset 288876; code bytes = 8030 Found XOR loop in file "tR3EY47.exe" at offset 365426; code bytes = 8030 Found XOR loop in file "tR3EY47.exe" at offset 365710; code bytes = 8030 Found XOR loop in file "tR3EY47.exe" at offset 469321; code bytes = 8030 Found XOR loop in file "tR3EY47.exe" at offset 478653; code bytes = 8030 Found XOR loop in file "tR3EY47.exe" at offset 493761; code bytes = 8030 Found XOR loop in file "tR3EY47.exe" at offset 615443; code bytes = 8030 Found XOR loop in file "tR3EY47.exe" at offset 667505; code bytes = 8030 Found XOR loop in file "tR3EY47.exe" at offset 938890; code bytes = 8030 Found XOR loop in file "tR3EY47.exe" at offset 992139; code bytes = 8030 Found XOR loop in file "tR3EY47.exe" at offset 995024; code bytes = 8030 Found XOR loop in file "5RK9wl9.exe" at offset 834088; code bytes = 30d0 Found XOR loop in file "5RK9wl9.exe" at offset 916941; code bytes = 30d0 Found XOR loop in file "5RK9wl9.exe" at offset 928061; code bytes = 30d0 Found XOR loop in file "5RK9wl9.exe" at offset 930625; code bytes = 30d0 Found XOR loop in file "5RK9wl9.exe" at offset 931487; code bytes = 30d0 Found XOR loop in file "5RK9wl9.exe" at offset 933143; code bytes = 30d0 Found XOR loop in file "5RK9wl9.exe" at offset 89010; code bytes = 33c1 Found XOR loop in file "5RK9wl9.exe" at offset 148580; code bytes = 33c1 Found XOR loop in file "5RK9wl9.exe" at offset 148752; code bytes = 33c1 Found XOR loop in file "5RK9wl9.exe" at offset 149045; code bytes = 33c1 Found XOR loop in file "5RK9wl9.exe" at offset 154932; code bytes = 33c1 Found XOR loop in file "5RK9wl9.exe" at offset 155104; code bytes = 33c1 Found XOR loop in file "5RK9wl9.exe" at offset 155397; code bytes = 33c1 Found XOR loop in file "5RK9wl9.exe" at offset 181222; code bytes = 33c1 Found XOR loop in file "5RK9wl9.exe" at offset 277995; code bytes = 33c1 Found XOR loop in file "5RK9wl9.exe" at offset 678287; code bytes = 33c1 Found XOR loop in file "5RK9wl9.exe" at offset 866880; code bytes = 33c1 Found XOR loop in file "5RK9wl9.exe" at offset 925131; code bytes = 33c1 Found XOR loop in file "5RK9wl9.exe" at offset 622993; code bytes = 8030 Found XOR loop in file "5RK9wl9.exe" at offset 625199; code bytes = 8030 Found XOR loop in file "5RK9wl9.exe" at offset 629564; code bytes = 8030 Found XOR loop in file "5RK9wl9.exe" at offset 632680; code bytes = 8030 Found XOR loop in file "5RK9wl9.exe" at offset 796692; code bytes = 8030 Found XOR loop in file "5RK9wl9.exe" at offset 811562; code bytes = 8030 Found XOR loop in file "5RK9wl9.exe" at offset 880272; code bytes = 8030 Found XOR loop in file "5RK9wl9.exe" at offset 922102; code bytes = 8030 Found XOR loop in file "5RK9wl9.exe" at offset 928028; code bytes = 8030 Found XOR loop in file "5RK9wl9.exe" at offset 932706; code bytes = 8030 Found XOR loop in file "5RK9wl9.exe" at offset 939683; code bytes = 8030 Found XOR loop in file "5RK9wl9.exe" at offset 940899; code bytes = 8030 Found XOR loop in file "4Ur013Hw.exe" at offset 72323; code bytes = 30d0 Found XOR loop in file "4Ur013Hw.exe" at offset 122082; code bytes = 30d0 Found XOR loop in file "4Ur013Hw.exe" at offset 376916; code bytes = 30d0 Found XOR loop in file "4Ur013Hw.exe" at offset 376937; code bytes = 30d0 Found XOR loop in file "4Ur013Hw.exe" at offset 691258; code bytes = 30d0 Found XOR loop in file "4Ur013Hw.exe" at offset 887915; code bytes = 30d0 Found XOR loop in file "4Ur013Hw.exe" at offset 888929; code bytes = 30d0 Found XOR loop in file "4Ur013Hw.exe" at offset 891921; code bytes = 30d0 Found XOR loop in file "4Ur013Hw.exe" at offset 900833; code bytes = 30d0 Found XOR loop in file "4Ur013Hw.exe" at offset 913601; code bytes = 30d0 Found XOR loop in file "4Ur013Hw.exe" at offset 130790; code bytes = 33c1 Found XOR loop in file "4Ur013Hw.exe" at offset 140043; code bytes = 33c1 Found XOR loop in file "4Ur013Hw.exe" at offset 140172; code bytes = 33c1 Found XOR loop in file "4Ur013Hw.exe" at offset 351053; code bytes = 33c1 Found XOR loop in file "4Ur013Hw.exe" at offset 463773; code bytes = 33c1 Found XOR loop in file "4Ur013Hw.exe" at offset 463848; code bytes = 33c1 Found XOR loop in file "4Ur013Hw.exe" at offset 597022; code bytes = 33c1 Found XOR loop in file "4Ur013Hw.exe" at offset 701978; code bytes = 33c1 Found XOR loop in file "4Ur013Hw.exe" at offset 709317; code bytes = 33c1 Found XOR loop in file "4Ur013Hw.exe" at offset 709765; code bytes = 33c1 Found XOR loop in file "4Ur013Hw.exe" at offset 710341; code bytes = 33c1 Found XOR loop in file "4Ur013Hw.exe" at offset 710789; code bytes = 33c1 Found XOR loop in file "4Ur013Hw.exe" at offset 895349; code bytes = 33c1 Found XOR loop in file "4Ur013Hw.exe" at offset 905289; code bytes = 33c1 Found XOR loop in file "4Ur013Hw.exe" at offset 1330; code bytes = 8030 Found XOR loop in file "4Ur013Hw.exe" at offset 1959; code bytes = 8030 Found XOR loop in file "4Ur013Hw.exe" at offset 232120; code bytes = 8030 Found XOR loop in file "4Ur013Hw.exe" at offset 356589; code bytes = 8030 Found XOR loop in file "4Ur013Hw.exe" at offset 674772; code bytes = 8030 Found XOR loop in file "4Ur013Hw.exe" at offset 687130; code bytes = 8030 Found XOR loop in file "4Ur013Hw.exe" at offset 887876; code bytes = 8030 Found XOR loop in file "4Ur013Hw.exe" at offset 890824; code bytes = 8030 Found XOR loop in file "4Ur013Hw.exe" at offset 894056; code bytes = 8030 Found XOR loop in file "4Ur013Hw.exe" at offset 913562; code bytes = 8030 Found XOR loop in file "3GR57SO.exe" at offset 1293; code bytes = 30d0 Found XOR loop in file "3GR57SO.exe" at offset 1173; code bytes = 8030 Found XOR loop in file "3GR57SO.exe" at offset 24690; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 1274152; code bytes = 30d0 Found XOR loop in file "1yl18XO9.exe" at offset 1287765; code bytes = 30d0 Found XOR loop in file "1yl18XO9.exe" at offset 1485168; code bytes = 30d0 Found XOR loop in file "1yl18XO9.exe" at offset 1507775; code bytes = 30d0 Found XOR loop in file "1yl18XO9.exe" at offset 1514635; code bytes = 30d0 Found XOR loop in file "1yl18XO9.exe" at offset 1514887; code bytes = 30d0 Found XOR loop in file "1yl18XO9.exe" at offset 1515347; code bytes = 30d0 Found XOR loop in file "1yl18XO9.exe" at offset 1516553; code bytes = 30d0 Found XOR loop in file "1yl18XO9.exe" at offset 1521461; code bytes = 30d0 Found XOR loop in file "1yl18XO9.exe" at offset 1522625; code bytes = 30d0 Found XOR loop in file "1yl18XO9.exe" at offset 1538921; code bytes = 30d0 Found XOR loop in file "1yl18XO9.exe" at offset 688249; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 688345; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 688444; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 688500; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 688526; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 688604; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 688747; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 688843; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 689850; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 690446; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 764137; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 817238; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 817472; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 909588; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 924330; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 942350; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 948128; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 953465; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 953616; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 969842; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 971092; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 983876; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 985045; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 985160; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 989471; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 989786; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 990362; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 992172; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 992479; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 992865; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 992957; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 993612; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 995617; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 999815; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 1000389; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 1001271; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 1001375; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 1002055; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 1002170; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 1006463; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 1007340; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 1027259; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 1033356; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 1034159; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 1289436; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 1441388; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 1505345; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 1507059; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 1513223; code bytes = 33c1 Found XOR loop in file "1yl18XO9.exe" at offset 735579; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 735612; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 735686; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 735764; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 735781; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 735802; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 735842; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 735923; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 735946; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 735963; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 736030; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 736068; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 736997; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 737018; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 833270; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 838380; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 845494; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 845523; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 857223; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 869347; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 869366; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 869863; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 925121; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 925175; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 925196; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 925223; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 925256; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 925280; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 925297; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 925319; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 925429; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 925471; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 1337260; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 1349610; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 1362066; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 1495860; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 1517374; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 1521442; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 1522614; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 1523404; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 1537116; code bytes = 8030 Found XOR loop in file "1yl18XO9.exe" at offset 1538890; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1274152; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1287765; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1485168; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1507775; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1514635; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1514887; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1515347; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1516553; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1521461; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1522625; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1538921; code bytes = 30d0 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688249; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688345; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688444; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688500; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688526; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688604; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688747; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 688843; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 689850; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 690446; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 764137; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 817238; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 817472; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 909588; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 924330; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 942350; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 948128; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 953465; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 953616; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 969842; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 971092; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 983876; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 985045; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 985160; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 989471; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 989786; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 990362; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 992172; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 992479; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 992865; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 992957; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 993612; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 995617; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 999815; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1000389; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1001271; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1001375; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1002055; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1002170; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1006463; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1007340; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1027259; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1033356; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1034159; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1289436; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1441388; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1505345; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1507059; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1513223; code bytes = 33c1 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735579; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735612; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735686; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735764; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735781; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735802; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735842; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735923; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735946; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 735963; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 736030; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 736068; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 736997; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 737018; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 833270; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 838380; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 845494; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 845523; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 857223; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 869347; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 869366; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 869863; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925121; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925175; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925196; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925223; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925256; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925280; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925297; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925319; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925429; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 925471; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1337260; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1349610; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1362066; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1495860; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1517374; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1521442; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1522614; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1523404; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1537116; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 1538890; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1274152; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1287765; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1485168; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1507775; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1514635; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1514887; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1515347; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1516553; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1521461; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1522625; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1538921; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688249; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688345; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688444; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688500; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688526; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688604; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688747; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 688843; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 689850; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 690446; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 764137; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 817238; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 817472; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 909588; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 924330; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 942350; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 948128; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 953465; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 953616; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 969842; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 971092; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 983876; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 985045; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 985160; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 989471; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 989786; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 990362; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 992172; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 992479; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 992865; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 992957; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 993612; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 995617; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 999815; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1000389; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1001271; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1001375; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1002055; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1002170; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1006463; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1007340; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1027259; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1033356; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1034159; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1289436; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1441388; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1505345; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1507059; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1513223; code bytes = 33c1 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735579; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735612; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735686; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735764; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735781; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735802; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735842; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735923; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735946; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 735963; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 736030; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 736068; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 736997; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 737018; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 833270; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 838380; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 845494; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 845523; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 857223; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 869347; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 869366; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 869863; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925121; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925175; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925196; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925223; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925256; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925280; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925297; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925319; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925429; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 925471; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1337260; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1349610; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1362066; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1495860; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1517374; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1521442; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1522614; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1523404; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1537116; code bytes = 8030 Found XOR loop in file "MaxLoonaFest131.exe" at offset 1538890; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 179965; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 324536; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 347202; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 454694; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 677049; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 855501; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 912272; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1027289; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1050451; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1057486; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1059356; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1119225; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1131994; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1441267; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1450215; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1562817; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1621962; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1637003; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1737800; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1814898; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1831601; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1922710; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1989157; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2011381; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 26031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 145255; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 378173; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 379086; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 391855; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 435260; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 587844; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 607789; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 636314; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 663228; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 838180; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 860365; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 967234; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 988272; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1041356; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1057872; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1061638; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1080084; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1108118; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1203494; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1250781; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1272350; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1301587; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1378555; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1414565; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1433593; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1529751; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1534523; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1543945; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1984102; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2023353; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 90891; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 102399; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 103104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 232233; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 310732; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 339978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 351996; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 477718; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 484460; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 574005; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 591845; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 618528; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 652302; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 652586; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 756342; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 765707; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 780823; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 902691; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 954818; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1226626; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1279939; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1282824; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1287460; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1303184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1406428; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1407367; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1408677; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1423831; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1481655; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1572144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1605657; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1647986; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1653335; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1698114; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1734016; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1746577; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1750686; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1873920; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1921353; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1966281; code bytes = 80302d:T804,Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "00000000-00002236.00000002.82474.00021000.00000020.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00002236.00000002.82474.00157000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00002236.00000002.82474.00157000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002236.00000002.82474.00157000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00002236.00000002.82474.00157000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00002236.00000002.82474.00157000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002236.00000002.82474.00157000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00002236.00000002.82474.00157000.00000002.mdmp")2e:T454,Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "00000000-00002236.00000002.82474.00021000.00000020.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "00000000-00002236.00000002.82474.00021000.00000020.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00002236.00000002.82474.00157000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00002236.00000002.82474.00157000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00002236.00000002.82474.00157000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00002236.00000002.82474.00157000.00000002.mdmp")2f:T3e21,"19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004072) "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004072) "uS1hK33.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004276) "uS1hK33.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004276) "jY0EZ40.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003640) "tR3EY47.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001016) "tR3EY47.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001016) "1yl18XO9.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003884) "1yl18XO9.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000435862fbccd22d00ccd22d001e753a7100000000403f430004da2d0078010000000000000000000000000000a8d72d005ecb84757801000000000000005d827504da2d000e5d82759cd52d00dcaa8675010000000000000072000000ffffffffffffffff24d32d0078020000000000002500000024d32d007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600912e60fb7cd32d006d82b176dc3f430004010000 (UID: 00000000-00003884) "1yl18XO9.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005c004900580050003000300033002e0054004d0050005c00310079006c003100380058004f0039002e00650078006500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2b5d77399e5977d8eb4576ac013b0000003b00000000000000000015009300a00300000000000000000000000000000000000016008e00a00300000000000000000000f86f3b000000000020000000000000000000000020314200e86c3b00086e3b00700d4300b0713b000000000018be2d000000000098bf2d00 (UID: 00000000-00003884) "1yl18XO9.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000440001000000ffffffff020000000800000090574300905743008b5743000000000002000000806c4600000000000100000800000000c8f62d0095e159778d322900feffffff64d22d003f08447702000000806c4600000000000100001888fb437754d22d00c81c86752ad42d0095fb437788d32d00806c460000000000000000000000000010d32d0000003b007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036007d2f60fbd0d22d006d82b176dc3f430004010000 (UID: 00000000-00003884) "1yl18XO9.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600053660fbe8cb2d006d82b1766424450004010000 (UID: 00000000-00003884) "1yl18XO9.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000d86f4600c82f3b00e220000080c52d0067e55a7700003b00584345000000000000003b000000000058434500000000008c2000ac0000000010464500d86f4600182b4500003b000000003b00000000005843450000003b00f82e4500000000003400013500003b00b82a4500000000000e00000e00000000182b4500002f4500404e46007000000000003b007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600c93b60fb24c62d006d82b1761423450004010000 (UID: 00000000-00003884) "1yl18XO9.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002d0098cfb875a0338475fe57847505400080bcdf2d000000000043003a005c00550073006500720073005c0048004100500055004200570053000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036002d4260fb00c02d006d82b1764c2e460004010000 (UID: 00000000-00003884) "1yl18XO9.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000059777832460024043b0000003b0050013b00c07f4500c80e0000c82f3b00000000402c303b0024c02d004a02000000013b00c82f3b001e02000000003b0078354600000000004a0200488000000020384600d86f4600c07f4500500e000000003b00000000407835460068c02d0004645d7738013b00e0635d77cde059770000000000003b0080354600010000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036002d4260fb00c02d006d82b1766c30460004010000 (UID: 00000000-00003884) "1yl18XO9.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000059779834460024043b0000003b0050013b00e0314500a80c0000c82f3b000000000424303b0024c02d000602000000013b00c82f3b00da01000000003b0098374600000000000602000480000000403a4600d86f4600e0314500300c000000003b00000000049837460068c02d0004645d7738013b00e0635d77cde059770000000000003b00a0374600010000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036002d4260fb00c02d006d82b1761432460004010000 (UID: 00000000-00003884) "1yl18XO9.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000059774036460024043b0000003b0050013b00787f4500000b0000c82f3b002000000020303b0024c02d00d101000000013b00c82f3b00a501000000003b004039460000000000d10100d080000000e83b4600d86f4600787f4500880a000000003b00200000004039460068c02d0004645d7738013b00e0635d77cde059770000000000003b0048394600010000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036002d4260fb00c02d006d82b1764433460004010000 (UID: 00000000-00003884) "1yl18XO9.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000059777037460024043b0000003b0050013b00787f4500d0090000c82f3b000000008018303b0024c02d00ab01000000013b00c82f3b007f01000000003b00703a460000000000ab0100aa80000000183d4600d86f4600787f45005809000000003b0000000080703a460068c02d0004645d7738013b00e0635d77cde059770000000000003b00783a4600010000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036002d4260fb00c02d006d82b1767434460004010000 (UID: 00000000-00003884) "1yl18XO9.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005977a038460024043b0000003b0050013b00787f4500a0080000c82f3b000000000214303b0024c02d008501000000013b00c82f3b005901000000003b00a03b4600000000008501008480000000483e4600d86f4600787f45002808000000003b0000000002a03b460068c02d0004645d7738013b00e0635d77cde059770000000000003b00a83b4600010000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036002d4260fb00c02d006d82b1769c35460004010000 (UID: 00000000-00003884) "1yl18XO9.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005977c839460024043b0000003b0050013b00787f450078070000c82f3b000000100010303b0024c02d006001000000013b00c82f3b003401000000003b00c83c4600000000006001006180000000703f4600d86f4600787f45000007000000003b0000001000c83c460068c02d0004645d7738013b00e0635d77cde059770000000000003b00d03c4600010000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036002d4260fb00c02d006d82b176cc36460004010000 (UID: 00000000-00003884) "1yl18XO9.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005977f83a460024043b0000003b0050013b00787f450048060000c82f3b00004000000c303b0024c02d003a01000000013b00c82f3b000e01000000003b00f83d4600000000003a01003b80000000a0404600d86f4600787f4500d005000000003b0000400000f83d460068c02d0004645d7738013b00e0635d77cde059770000000000003b00003e4600010000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036002d4260fb00c02d006d82b176fc37460004010000 (UID: 00000000-00003884) "1yl18XO9.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005977283c460024043b0000003b0050013b00787f450018050000c82f3b000001000008303b0024c02d001401000000013b00c82f3b00e800000000003b00283f4600000000001401001580000000d0414600d86f4600787f4500a004000000003b0000010000283f460068c02d0004645d7738013b00e0635d77cde059770000000000003b00303f4600010000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036002d4260fb00c02d006d82b1762439460004010000 (UID: 00000000-00003884) "1yl18XO9.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005977503d460024043b0000003b0050013b00787f4500f0030000c82f3b000800000004303b0024c02d00ef00000000013b00c82f3b00c300000000003b005040460000000000ef0000ef80000000f8424600d86f4600787f45007803000000003b00080000005040460068c02d0004645d7738013b00e0635d77cde059770000000000003b0058404600010000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036002d4260fb00c02d006d82b1765c3a460004010000 (UID: 00000000-00003884) "1yl18XO9.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000001f4262fb20c92d0020c92d001e753a7100000000e03f470058d02d001c020000000000000000000000000000fccd2d005ecb84751c02000000000000005d827558d02d000e5d8275f0cb2d00dcaa8675010000000000000072000000ffffffffffffffff78c92d0078020000000000002500000078c92d007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036007d3460fbd0c92d006d82b17674d9460004010000 (UID: 00000000-00003884) "1yl18XO9.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ffff170083014c000000620b847500000000f86f3b0000000000500000000457430002000000806c46000000000001000008603e450020743b00380b847504c82d0002000000b8c82d003f08447702000000806c4600000000000100001888fb4377a8c82d00c81c86757eca2d0095fb4377dcc92d00806c460000000000000000000000000064c92d0000003b007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600c93460fb24c92d006d82b17674d9460004010000 (UID: 00000000-00003884)30:T574,"19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "uS1hK33.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "uS1hK33.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "jY0EZ40.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "jY0EZ40.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "tR3EY47.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "tR3EY47.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1yl18XO9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1yl18XO9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "OfficeTrackerNMP131.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")31:T994,"19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004072) "uS1hK33.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004276) "jY0EZ40.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003640) "tR3EY47.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00001016) "1yl18XO9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003884) "1yl18XO9.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003884) "1yl18XO9.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003884) "1yl18XO9.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003884) "1yl18XO9.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003884) "1yl18XO9.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003884) "1yl18XO9.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003884) "1yl18XO9.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00003884) "1yl18XO9.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003884) "1yl18XO9.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003884) "1yl18XO9.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003884) "1yl18XO9.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00003884) "1yl18XO9.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00003884) "1yl18XO9.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00003884) "1yl18XO9.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00003884) "1yl18XO9.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003884) "1yl18XO9.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003884) "1yl18XO9.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003884) "1yl18XO9.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003884) "1yl18XO9.exe" called "LoadLibrary" with a parameter WININET.DLL (UID: 00000000-00003884) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004076)32:T2a34,"19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004072) "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004072) "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004072) "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004072) "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004072) "uS1hK33.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004276) "uS1hK33.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004276) "uS1hK33.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004276) "uS1hK33.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004276) "uS1hK33.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004276) "jY0EZ40.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003640) "jY0EZ40.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003640) "tR3EY47.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001016) "tR3EY47.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001016) "tR3EY47.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001016) "tR3EY47.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001016) "tR3EY47.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00001016) "1yl18XO9.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CreateLinkInfoW (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter IsCharAlphaW (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CharPrevW (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter GetNetResourceFromLocalPathW (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter NetShareEnum (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CscNetApiGetInterface (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter SLGetWindowsInformationDWORD (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecW (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CharNextW (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter DestroyLinkInfo (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter O/ (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter O (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter ?/ (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter ? (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00003884) "1yl18XO9.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00003884) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004076) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004076) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000848) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002236) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002236) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002236) "OfficeTrackerNMP131.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002236)33:T1452,"CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)" (Source: 19563-928-000F6790, Indicator: "create table sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 19563-928-000F6790, Indicator: "select name rootpage sql from '%q'.%s"), "SELECT name rootpage sql FROM '%q'.%s WHERE %s" (Source: 19563-973-000E2E90, Indicator: "select name rootpage sql from '%q'.%s where %s"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 19563-1124-000EF4F0, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "CREATE TABLE" (Source: 19563-1130-000EF340, Indicator: "create table"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 19563-1313-000EFB70, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 19563-1326-000EF800, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 19563-1326-000EF800, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 19563-1372-000F0320, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 19563-1372-000F0320, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q) tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='" (Source: 19563-1398-000ED2C0, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='") "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 19563-1400-000ED570, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 19563-1403-000FC570, Indicator: "update %q.%s set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d"), "CREATE TABLE sqlite_master(" (Source: 00000000-00002236.00000002.82474.00157000.00000002.mdmp, Indicator: "create table sqlite_master(") "CREATE TABLE" (Source: 00000000-00002236.00000002.82474.00157000.00000002.mdmp, Indicator: "create table") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 00000000-00002236.00000002.82474.00157000.00000002.mdmp, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00002236.00000002.82474.00157000.00000002.mdmp, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 00000000-00002236.00000002.82474.00157000.00000002.mdmp, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00002236.00000002.82474.00157000.00000002.mdmp, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 00000000-00002236.00000002.82474.00157000.00000002.mdmp, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 00000000-00002236.00000002.82474.00157000.00000002.mdmp, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 00000000-00002236.00000002.82474.00157000.00000002.mdmp, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 00000000-00002236.00000002.82474.00157000.00000002.mdmp, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 00000000-00002236.00000002.82474.00157000.00000002.mdmp, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 00000000-00002236.00000002.82474.00157000.00000002.mdmp, Indicator: "select name rootpage sql from '%q'.%s")34:T455,"19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "uS1hK33.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "2Sp1112.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "jY0EZ40.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "tR3EY47.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "5RK9wl9.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE35:T143d,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00001016.00000000.74334.00081000.00000020.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002236.00000000.78629.004D0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002236.00000000.78629.004D0000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002236.00000000.78629.004D0000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002236.00000000.78629.004D0000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002236.00000001.80553.004D0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002236.00000001.80553.004D0000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002236.00000001.80553.004D0000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002236.00000001.80553.004D0000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002236.00000002.82474.004D0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002236.00000002.82474.004D0000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002236.00000002.82474.004D0000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00002236.00000002.82474.004D0000.00000004.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003640.00000001.76216.002D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003640.00000001.76216.00ED1000.00000020.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003884.00000000.74384.003B0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003884.00000000.74384.003B0000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003884.00000000.74384.003B0000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003884.00000000.74384.003B0000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003884.00000001.76306.003B0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003884.00000001.76306.003B0000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003884.00000001.76306.003B0000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003884.00000001.76306.003B0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003884.00000001.76306.003B0000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003884.00000002.78229.003B0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003884.00000002.78229.003B0000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003884.00000002.78229.003B0000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00003884.00000002.78229.003B0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003884.00000002.78229.003B0000.00000004.mdmp "Software\Microsoft\Windows " in Source: 00000000-00004072.00000000.74154.000C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00004072.00000000.74154.00B31000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00004276.00000000.74222.00981000.00000020.mdmp36:Tdc1,"19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 71330000 "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 726e0000 "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75330000 "uS1hK33.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 71e80000 "uS1hK33.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75330000 "jY0EZ40.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 715c0000 "jY0EZ40.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75330000 "tR3EY47.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 71330000 "tR3EY47.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 71e80000 "tR3EY47.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75330000 "1yl18XO9.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74200000 "1yl18XO9.exe" loaded module "CLBCATQ.DLL" at base 771e0000 "1yl18XO9.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 757c0000 "1yl18XO9.exe" loaded module "ADVAPI32.DLL" at base 77700000 "1yl18XO9.exe" loaded module "PROPSYS.DLL" at base 74240000 "1yl18XO9.exe" loaded module "OLE32.DLL" at base 76f50000 "1yl18XO9.exe" loaded module "COMCTL32.DLL" at base 74380000 "1yl18XO9.exe" loaded module "OLEAUT32.DLL" at base 76910000 "1yl18XO9.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74240000 "1yl18XO9.exe" loaded module "NTMARTA.DLL" at base 748f0000 "1yl18XO9.exe" loaded module "SETUPAPI.DLL" at base 76480000 "1yl18XO9.exe" loaded module "RPCRT4.DLL" at base 774d0000 "1yl18XO9.exe" loaded module "SHELL32.DLL" at base 757c0000 "1yl18XO9.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 776d0000 "1yl18XO9.exe" loaded module "PROFAPI.DLL" at base 75490000 "1yl18XO9.exe" loaded module "APPHELP.DLL" at base 75330000 "1yl18XO9.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6f650000 "1yl18XO9.exe" loaded module "LINKINFO.DLL" at base 6fd50000 "1yl18XO9.exe" loaded module "USER32.DLL" at base 772a0000 "1yl18XO9.exe" loaded module "NTSHRUI.DLL" at base 72040000 "1yl18XO9.exe" loaded module "SRVCLI.DLL" at base 75080000 "1yl18XO9.exe" loaded module "CSCAPI.DLL" at base 705e0000 "1yl18XO9.exe" loaded module "SLC.DLL" at base 73840000 "1yl18XO9.exe" loaded module "SHLWAPI.DLL" at base 76b00000 "1yl18XO9.exe" loaded module "SSPICLI.DLL" at base 75310000 "1yl18XO9.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75330000 "1yl18XO9.exe" loaded module "WINHTTP.DLL" at base 71270000 "1yl18XO9.exe" loaded module "WININET.DLL" at base 76c90000 "1yl18XO9.exe" loaded module "CRYPTBASE.DLL" at base 75380000 "1yl18XO9.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74e50000 "1yl18XO9.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 749b0000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 75310000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 77700000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 776d0000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 73c80000 "OfficeTrackerNMP131.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 71330000 "OfficeTrackerNMP131.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74e50000 "OfficeTrackerNMP131.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 749b000037:Te50,"19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52" was detected as "Microsoft Cabinet" and name: "sfx" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52" was detected as "Microsoft Visual C/C++" and name: "Compiler" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52" was detected as "Microsoft Cabinet File" and name: "Archive" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52" was detected as "Microsoft Linker" and name: "Linker" "uS1hK33.exe" was detected as "Microsoft Cabinet" and name: "sfx" "uS1hK33.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "uS1hK33.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "uS1hK33.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "uS1hK33.exe" was detected as "Microsoft Linker" and name: "Linker" "FANBooster131.exe" was detected as "Microsoft Cabinet" and name: "sfx" "FANBooster131.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "FANBooster131.exe" was detected as "Microsoft Linker" and name: "Linker" "2Sp1112.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2Sp1112.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2Sp1112.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2Sp1112.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2Sp1112.exe" was detected as "Microsoft Linker" and name: "Linker" "jY0EZ40.exe" was detected as "Microsoft Cabinet" and name: "sfx" "jY0EZ40.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "jY0EZ40.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "jY0EZ40.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "jY0EZ40.exe" was detected as "Microsoft Linker" and name: "Linker" "tR3EY47.exe" was detected as "Microsoft Cabinet" and name: "sfx" "tR3EY47.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "tR3EY47.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "tR3EY47.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "tR3EY47.exe" was detected as "Microsoft Linker" and name: "Linker" "5RK9wl9.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5RK9wl9.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5RK9wl9.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5RK9wl9.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5RK9wl9.exe" was detected as "Microsoft Linker" and name: "Linker" "4Ur013Hw.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4Ur013Hw.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4Ur013Hw.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4Ur013Hw.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4Ur013Hw.exe" was detected as "Microsoft Linker" and name: "Linker" "3GR57SO.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3GR57SO.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3GR57SO.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3GR57SO.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3GR57SO.exe" was detected as "Microsoft Linker" and name: "Linker"38:T1324,"19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "uS1hK33.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "FANBooster131.exe" file has an entrypoint instructions - "call 0x4e6d12,jmp 0x4e64df,cmp ecx, dword ptr [0x56d048],jne 0x4e666e,ret ,jmp 0x4e6e45,push ebp,mov ebp, esp,and dword ptr [0x56f3d0], 0,sub esp, 0x24,or dword ptr [0x56d050], 1,push 0xa,call dword ptr [0x5370d8],test eax, eax,je 0x4e6843,and dword ptr [ebp - 0x10], 0,xor eax, eax,push ebx,push esi,push edi,xor ecx, ecx,lea edi, [ebp - 0x24],push ebx,cpuid ,mov esi, ebx,pop ebx,nop ,mov dword ptr [edi], eax,mov dword ptr [edi + 4], esi,mov dword ptr [edi + 8], ecx,xor ecx, ecx,mov dword ptr [edi + 0xc], edx,mov eax, dword ptr [ebp - 0x24],mov edi, dword ptr [ebp - 0x20]," "2Sp1112.exe" file has an entrypoint instructions - "jmp 0x415f30,jmp 0x46b9b9,jmp 0x44a550,jmp 0x4364c9,jmp 0x4209c7,jmp 0x4a87f0,jmp 0x436a6a,jmp 0x46c75a,jmp 0x4a377a,jmp 0x41c05f,jmp 0x416984,jmp 0x452ee7,jmp 0x42c224,jmp 0x459d4b,jmp 0x41cc67,jmp 0x419015,jmp 0x492f8b,jmp 0x40de90,jmp 0x466efc,jmp 0x4838f0," "jY0EZ40.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "tR3EY47.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "5RK9wl9.exe" file has an entrypoint instructions - "jmp 0x415f30,jmp 0x46b9b9,jmp 0x44a550,jmp 0x4364c9,jmp 0x4209c7,jmp 0x4a87f0,jmp 0x436a6a,jmp 0x46c75a,jmp 0x4a377a,jmp 0x41c05f,jmp 0x416984,jmp 0x452ee7,jmp 0x42c224,jmp 0x459d4b,jmp 0x41cc67,jmp 0x419015,jmp 0x492f8b,jmp 0x40de90,jmp 0x466efc,jmp 0x4838f0," "4Ur013Hw.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "3GR57SO.exe" file has an entrypoint instructions - "call 0x4032e6,jne 0x4032ed,je 0x4032ed,test eax, 0xeb5b9ba5,or al, byte ptr [ecx + eax*4 - 0x15],out 0x32, al,add byte ptr [eax], al,jmp 0x4032fe,and ch, bl,cmc ,inc esp,and dh, byte ptr [esi + eax + 0x75],add al, 0x94,push ss,xor dword ptr [ecx - 0x3dbbb39], ebx,xor byte ptr [eax], al,add byte ptr [eax], al,sub esp, 4,jne 0x403317,je 0x403317,dec ebp,lahf ,mov edx, dword ptr [esp],add esp, 4,jmp 0x403325,mov byte ptr [ecx], ch,shr bl, 5,test al, 0xeb,stc ,mov byte ptr [eax - 0x4373fa15], ch,shr bl, 1,pop es,add eax, dword ptr fs:[edx],je 0x40333c,jne 0x40333c,jb 0x40337c,and dh, byte ptr [esi],in eax, dx,push dword ptr [eax + 0xa4],jne 0x403349,"39:T4ce,"19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "uS1hK33.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "uS1hK33.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "jY0EZ40.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "jY0EZ40.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "tR3EY47.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tR3EY47.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1yl18XO9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1yl18XO9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "OfficeTrackerNMP131.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "OfficeTrackerNMP131.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")3a:T45b,Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00004072-00000C2B-163655707] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00004072-00000BC1-163844486] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00004276-00000BC1-165058951] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00003640-00000BC1-165711230] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00001016-00000BC1-166387593] Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00003640.00000E38.1142707.00050000.wprm] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003884-00000C2B-166981317] Observed system executable string:"%WINDIR%\System32\shdocvw.dll" [Source: 00000000-00003884-00000C2B-169495319]3b:Ta43,"uS1hK33.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\uS1hK33.exe]- [targetUID: 00000000-00004072] "FANBooster131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00002236] "2Sp1112.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 8 sections"- Location: [%TEMP%\IXP003.TMP\2Sp1112.exe]- [targetUID: 00000000-00001016] "jY0EZ40.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\jY0EZ40.exe]- [targetUID: 00000000-00004276] "tR3EY47.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\tR3EY47.exe]- [targetUID: 00000000-00001016] "5RK9wl9.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 8 sections"- Location: [%TEMP%\IXP000.TMP\5RK9wl9.exe]- [targetUID: 00000000-00004072] "4Ur013Hw.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4Ur013Hw.exe]- [targetUID: 00000000-00004276] "3GR57SO.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\3GR57SO.exe]- [targetUID: 00000000-00003640] "FANBooster131.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Unicoded MachineID hapubws-pc KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive NeedIndexed ctime=Mon Aug 17 13:21:16 2026 atime=Mon Aug 17 13:21:16 2026 mtime=Wed Nov 29 02:58:34 2023 length=1539711 window=normal IDListSize 0x01f6 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk]- [targetUID: 00000000-00002236] "rise131M9Asphalt.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\rise131M9Asphalt.tmp]- [targetUID: 00000000-00002236] "1yl18XO9.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1yl18XO9.exe]- [targetUID: 00000000-00001016] "OfficeTrackerNMP131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00002236] "MaxLoonaFest131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00002236]3c:Tb94,"19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")3d:T10d8,"19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "19B2A5A72D27F8841152BCA2694CE3D720DCA29885A588443A375DEC9C0A7B52"; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "")3e:T4e3,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Able to retrieve information set for devices (API string) Matched sigs: Reference to an external IP address lookup service identified Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to query volume size Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to detect presence of virtualization software Matched sigs: Checks a device property (often used to detect VM artifacts)3f:Tc9a,"19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe.Local\" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\Cabinet.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\VERSION.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\SspiCli.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\WINSPOOL.DRV" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\MPR.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\Windows\system32\MPR.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\UxTheme.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\WINMM.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\samcli.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\Windows\system32\samcli.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\MSACM32.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to touch file "C:\Windows\system32\MSACM32.dll"40:Tcf4,"19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\Cabinet.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\VERSION.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\SspiCli.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\MPR.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\UxTheme.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\WINMM.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\samcli.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\MSACM32.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\sfc.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\sfc_os.DLL" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\dwmapi.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\FLTLIB.DLL" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\MSVCP140.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\ucrtbase.DLL" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll"41:T87a,"19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe.Local\" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe.Config" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\19B2A5A72D27F8841152BCA2694CE3D720DCA29885A588443A375DEC9C0A7B52.EXE.LOCAL" "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" trying to access non-existent file "C:\19B2A5A72D27F8841152BCA2694CE3D720DCA29885A588443A375DEC9C0A7B52.EXE.CONFIG" "uS1hK33.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\uS1hK33.exe.Local\" "uS1hK33.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "uS1hK33.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\uS1hK33.exe.Config" "uS1hK33.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "uS1hK33.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\US1HK33.EXE.LOCAL" "uS1hK33.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\US1HK33.EXE.CONFIG" "jY0EZ40.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\jY0EZ40.exe.Local\" "jY0EZ40.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "jY0EZ40.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\jY0EZ40.exe.Config" "jY0EZ40.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"42:T487,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52")43:T9a9,Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "gethostname" (Indicator: "gethostname"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement." (Indicator: " accept "; Source: "00000000-00001016.00000000.74334.0008A000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00001016.00000000.74334.00A70000.00000002.mdmp, 00000000-00001016.00000001.76260.00A70000.00000002.mdmp, 00000000-00001016.00000002.78182.00A70000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00002236.00000000.78629.00960000.00000002.mdmp, 00000000-00002236.00000001.80553.00960000.00000002.mdmp, 00000000-00002236.00000002.82474.00960000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00003640.00000000.74294.011C0000.00000002.mdmp, 00000000-00003640.00000001.76216.011C0000.00000002.mdmp, 00000000-00003640.00000002.78142.011C0000.00000002.mdmp") Found reference to API "Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement." (Indicator: " accept "; Source: "00000000-00003640.00000002.78142.00EDA000.00000002.mdmp")44:T12ff,Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localtemp=c:\users\hapubws\appdata\local\tempcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey" - Source: "00000000-00002236.00000000.78629.004D0000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00002236.00000000.78629.004D0000.00000004.mdmp") Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localtemp=c:\users\hapubws\appdata\local\tempcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey" - Source: "00000000-00002236.00000001.80553.004D0000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00002236.00000001.80553.004D0000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00002236.00000002.82474.00157000.00000002.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00002236.00000002.82474.00157000.00000002.mdmp") Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localtemp=c:\users\hapubws\appdata\local\tempcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey" - Source: "00000000-00002236.00000002.82474.004D0000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00002236.00000002.82474.004D0000.00000004.mdmp") Found URL "https://ipinfofhttps://www.maxmind.com/en/locatlp-addressorization:" - Source: "00000000-00003884.00000000.74384.003B0000.00000004.mdmp") Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localtemp=c:\users\hapubws\appdata\local\temp1spsvwhagcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey1" - Source: "00000000-00003884.00000000.74384.003B0000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00003884.00000000.74384.003B0000.00000004.mdmp") Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localtemp=c:\users\hapubws\appdata\local\tempvwhagcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey1" - Source: "00000000-00003884.00000001.76306.003B0000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00003884.00000001.76306.003B0000.00000004.mdmp") Found URL "https://ipinfofhttps://www.maxmind.com/en/locatlp-addressorization:" - Source: "00000000-00003884.00000001.76306.0042D000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00003884.00000001.76306.00BF7000.00000002.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00003884.00000001.76306.00BF7000.00000002.mdmp") Found URL "https://t.me/riseprosupportappdata=c:\users\hapubws\appdata\roaminglocalappdata=c:\users\hapubws\appdata\localtemp=c:\users\hapubws\appdata\local\tempvwhagcertdllverifycertificatechainpolicycryptmsgdllcnggencontentencryptkeycryptmsgdllcngimportcontentencryptkey1" - Source: "00000000-00003884.00000002.78229.003B0000.00000004.mdmp") Found URL "https://t.me/riseprosupport" - Source: "00000000-00003884.00000002.78229.003B0000.00000004.mdmp") Found URL "https://ipinfofhttps://www.maxmind.com/en/locatlp-addressorization:" - Source: "00000000-00003884.00000002.78229.0042D000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0oh0f080*0(https://www.digicert.com/cps0," - Source: "00000000-00004072.00000000.74154.000C0000.00000004.mdmp") Found URL "http://ocsp.thawte.com080604.http://crl.thawte.com/thawtetimestampingca.crl0timestamp-2048-10y@b%symantec" - Source: "00000000-00004072.00000000.74154.000C0000.00000004.mdmp") Found URL "http://ts-ocsp.ws.symantec.com07+http://ts-aia.ws.symantec.com/tss-ca-g2.cer0<50301+http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(timestamp-2048-20b07x,&c3\vno^efany3+." - Source: "00000000-00004072.00000000.74154.000C0000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0kd0b070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0fuscdigicert" - Source: "00000000-00004072.00000000.74154.000C0000.00000004.mdmp")45:T488,Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; File: "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52")46:Ta4c,"19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00004072) "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004072) "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" called "FindNextFileW" with parameter 5RK9wl9.exe (UID: 00000000-00004072) "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" called "FindNextFileW" with parameter uS1hK33.exe (UID: 00000000-00004072) "uS1hK33.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00004276) "uS1hK33.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004276) "uS1hK33.exe" called "FindNextFileW" with parameter 4Ur013Hw.exe (UID: 00000000-00004276) "uS1hK33.exe" called "FindNextFileW" with parameter jY0EZ40.exe (UID: 00000000-00004276) "jY0EZ40.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00003640) "jY0EZ40.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003640) "jY0EZ40.exe" called "FindNextFileW" with parameter 3GR57SO.exe (UID: 00000000-00003640) "jY0EZ40.exe" called "FindNextFileW" with parameter tR3EY47.exe (UID: 00000000-00003640) "tR3EY47.exe" called "FindFirstFileW" with parameter %TEMP%\IXP003.TMP\*.* (UID: 00000000-00001016) "tR3EY47.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001016) "tR3EY47.exe" called "FindNextFileW" with parameter 1yl18XO9.exe (UID: 00000000-00001016) "tR3EY47.exe" called "FindNextFileW" with parameter 2Sp1112.exe (UID: 00000000-00001016) "1yl18XO9.exe" called "FindFirstFileW" with parameter %WINDIR%\System32\*.* (UID: 00000000-00003884) "1yl18XO9.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003884) "1yl18XO9.exe" called "FindNextFileW" with parameter 0409 (UID: 00000000-00003884) "1yl18XO9.exe" called "FindNextFileW" with parameter 12520437.cpx (UID: 00000000-00003884) "1yl18XO9.exe" called "FindNextFileW" with parameter 12520850.cpx (UID: 00000000-00003884) "1yl18XO9.exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00003884) "1yl18XO9.exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00003884) "1yl18XO9.exe" called "FindNextFileW" with parameter aaclient.dll (UID: 00000000-00003884) "1yl18XO9.exe" called "FindNextFileW" with parameter accessibilitycpl.dll (UID: 00000000-00003884)47:Td67,Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002236.00000000.78629.004D0000.00000004.mdmp, 00000000-00002236.00000001.80553.004D0000.00000004.mdmp, 00000000-00002236.00000002.82474.004D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002236.00000000.78629.004D0000.00000004.mdmp, 00000000-00002236.00000001.80553.004D0000.00000004.mdmp, 00000000-00002236.00000002.82474.004D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002236.00000000.78629.004D0000.00000004.mdmp, 00000000-00002236.00000001.80553.004D0000.00000004.mdmp, 00000000-00002236.00000002.82474.004D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002236.00000000.78629.004D0000.00000004.mdmp, 00000000-00002236.00000001.80553.004D0000.00000004.mdmp, 00000000-00002236.00000002.82474.004D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002236.00000000.78629.004D0000.00000004.mdmp, 00000000-00002236.00000001.80553.004D0000.00000004.mdmp, 00000000-00002236.00000002.82474.004D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002236.00000000.78629.004D0000.00000004.mdmp, 00000000-00002236.00000001.80553.004D0000.00000004.mdmp, 00000000-00002236.00000002.82474.004D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" (Indicator: "\Device\"; Source: "00000000-00002236.00000000.78629.004D0000.00000004.mdmp, 00000000-00002236.00000001.80553.004D0000.00000004.mdmp, 00000000-00002236.00000002.82474.004D0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}] DA?" (Indicator: "\Device\"; Source: "00000000-00002236.00000001.80553.004D0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}] DATAGRAM 2" (Indicator: "\Device\"; Source: "00000000-00002236.00000002.82474.004D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003640.00000001.76216.002D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003640.00000001.76216.002D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003640.00000001.76216.002D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003640.00000001.76216.002D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003640.00000001.76216.002D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003640.00000001.76216.002D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP001.TMP\jY0EZ40.exe" (Indicator: "\Device\"; Source: "00000000-00003640.00000001.76216.002D0000.00000004.mdmp")48:T14d9,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: 19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: uS1hK33.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: uS1hK33.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: uS1hK33.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: uS1hK33.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: uS1hK33.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: jY0EZ40.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: jY0EZ40.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: jY0EZ40.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: jY0EZ40.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: jY0EZ40.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: tR3EY47.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: tR3EY47.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: tR3EY47.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: tR3EY47.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: tR3EY47.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 4Ur013Hw.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 4Ur013Hw.exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: 4Ur013Hw.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: 4Ur013Hw.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: 4Ur013Hw.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: 4Ur013Hw.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 4Ur013Hw.exe] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 4Ur013Hw.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: 4Ur013Hw.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: 4Ur013Hw.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 4Ur013Hw.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 4Ur013Hw.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: 4Ur013Hw.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: 4Ur013Hw.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 4Ur013Hw.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: 4Ur013Hw.exe]49:T9ba,"1yl18XO9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "1yl18XO9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "1yl18XO9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "1yl18XO9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "1yl18XO9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "1yl18XO9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "1yl18XO9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "1yl18XO9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "1yl18XO9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "1yl18XO9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "1yl18XO9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "1yl18XO9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "1yl18XO9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "1yl18XO9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")4a:T45c,"19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "uS1hK33.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "jY0EZ40.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "tR3EY47.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "1yl18XO9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "MAXLOONAFEST131"; Value: "%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe")4b:T5db,"uS1hK33.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\uS1hK33.exe]- [targetUID: 00000000-00004072] "FANBooster131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00002236] "2Sp1112.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 8 sections"- Location: [%TEMP%\IXP003.TMP\2Sp1112.exe]- [targetUID: 00000000-00001016] "jY0EZ40.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\jY0EZ40.exe]- [targetUID: 00000000-00004276] "tR3EY47.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\tR3EY47.exe]- [targetUID: 00000000-00001016] "5RK9wl9.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 8 sections"- Location: [%TEMP%\IXP000.TMP\5RK9wl9.exe]- [targetUID: 00000000-00004072] "4Ur013Hw.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4Ur013Hw.exe]- [targetUID: 00000000-00004276] "3GR57SO.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\3GR57SO.exe]- [targetUID: 00000000-00003640] "1yl18XO9.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1yl18XO9.exe]- [targetUID: 00000000-00001016]4c:T76e,"uS1hK33.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\uS1hK33.exe]- [targetUID: 00000000-00004072] "FANBooster131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\FANBooster131\FANBooster131.exe]- [targetUID: 00000000-00002236] "2Sp1112.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 8 sections"- Location: [%TEMP%\IXP003.TMP\2Sp1112.exe]- [targetUID: 00000000-00001016] "jY0EZ40.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\jY0EZ40.exe]- [targetUID: 00000000-00004276] "tR3EY47.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\tR3EY47.exe]- [targetUID: 00000000-00001016] "5RK9wl9.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 8 sections"- Location: [%TEMP%\IXP000.TMP\5RK9wl9.exe]- [targetUID: 00000000-00004072] "4Ur013Hw.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4Ur013Hw.exe]- [targetUID: 00000000-00004276] "3GR57SO.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\3GR57SO.exe]- [targetUID: 00000000-00003640] "1yl18XO9.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1yl18XO9.exe]- [targetUID: 00000000-00001016] "OfficeTrackerNMP131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe]- [targetUID: 00000000-00002236] "MaxLoonaFest131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe]- [targetUID: 00000000-00002236]4d:T631,"19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "uS1hK33.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "uS1hK33.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "jY0EZ40.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "jY0EZ40.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "tR3EY47.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "tR3EY47.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"") "1yl18XO9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "MAXLOONAFEST131"; Value: "%LOCALAPPDATA%\MaxLoonaFest131\MaxLoonaFest131.exe")4e:Tce8,"19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\uS1hK33.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "19b2a5a72d27f8841152bca2694ce3d720dca29885a588443a375dec9c0a7b52.exe" wrote 24576 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5RK9wl9.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "uS1hK33.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\jY0EZ40.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "uS1hK33.exe" wrote 23040 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4Ur013Hw.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "jY0EZ40.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\tR3EY47.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "jY0EZ40.exe" wrote 18432 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3GR57SO.exe": 4d5aff000100000004001000ffff00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0a240000000000000000 ... "tR3EY47.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1yl18XO9.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000300100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tR3EY47.exe" wrote 385 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2Sp1112.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...4f:T84b,RegCreateKeyExA OpenProcessToken RegOpenKeyExA RegDeleteValueA RegCloseKey CreateDirectoryA LockResource LoadLibraryA LoadLibraryExA GetModuleHandleW GetProcAddress GetSystemInfo GetDriveTypeA CreateFileA FindNextFileA GetTempFileNameA Sleep GetStartupInfoW FindFirstFileA GetSystemDirectoryA DeleteFileA WriteFile GetModuleFileNameA GetFileAttributesA FindResourceA GetTempPathA TerminateProcess CreateProcessA GetTickCount CreateThread UnhandledExceptionFilter GetVersionExA CredEnumerateA RegEnumKeyExA GetUserNameA RegEnumKeyA CreateToolhelp32Snapshot GetCommandLineW GetModuleHandleExW GetModuleFileNameW GetModuleHandleExA GetCommandLineA DeleteFileW FindFirstFileExW LoadLibraryExW GetComputerNameA GetFileSizeEx WriteProcessMemory VirtualAllocEx CreateFileW GetTickCount64 FindFirstFileW OpenProcess GetFileAttributesExW FindNextFileW GetModuleHandleA GetFileAttributesW GetTempPathW CopyFileA CreateRemoteThread Process32First Process32Next IsDebuggerPresent GetFileSize ShellExecuteA socket send WSAStartup recv closesocket connect SleepConditionVariableCS GetNativeSystemInfo CreateThreadpoolTimer ExitThread OutputDebugStringW SleepConditionVariableSRW CreateThreadpoolWork CreateThreadpoolWait RegDeleteKeyW CreateProcessWithLogonW RegEnumKeyExW SetSecurityDescriptorDacl CreateProcessAsUserW GetUserNameW RegDeleteValueW RegOpenKeyExW RegCreateKeyExW IcmpSendEcho VirtualAlloc DeviceIoControl GetSystemDirectoryW CopyFileW CopyFileExW CreateProcessW Process32FirstW GetComputerNameW GetTempFileNameW CreateDirectoryW FindResourceExW GetVersionExW Process32NextW GetDriveTypeW LoadLibraryW ReadProcessMemory ShellExecuteExW ShellExecuteW GetCursorPos FindWindowW FindWindowExW GetWindowThreadProcessId GetClipboardData SetKeyboardState InternetQueryDataAvailable InternetOpenW InternetOpenUrlW FtpGetFileSize InternetConnectW FtpOpenFileW InternetCrackUrlW InternetReadFile InternetQueryOptionW HttpQueryInfoW InternetCloseHandle HttpSendRequestW sendto bind listen recvfrom accept50:Td80,"70dacb108d23e83d818c5006da2eae9c.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP\ (UID: 00000000-00001588) "uS1hK33.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP\ (UID: 00000000-00002548) "jY0EZ40.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP\ (UID: 00000000-00001524) "tR3EY47.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP\ (UID: 00000000-00000804) "1yl18XO9.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAgjIz0kpCyVIqt\Files\Amazon Downloader Logs (UID: 00000000-00002308) "1yl18XO9.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAgjIz0kpCyVIqt\Files\hancom (UID: 00000000-00002308) "1yl18XO9.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAgjIz0kpCyVIqt\Files\My Music (UID: 00000000-00002308) "1yl18XO9.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAgjIz0kpCyVIqt\Files\My Pictures (UID: 00000000-00002308) "1yl18XO9.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAgjIz0kpCyVIqt\Files\My Videos (UID: 00000000-00002308) "1yl18XO9.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAgjIz0kpCyVIqt\Files\Outlook Files (UID: 00000000-00002308) "1yl18XO9.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAgjIz0kpCyVIqt\Files (UID: 00000000-00002308) "1yl18XO9.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAgjIz0kpCyVIqt\Files\AppData\Local\Adobe\Acrobat\DC\Cache (UID: 00000000-00002308) "1yl18XO9.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAgjIz0kpCyVIqt\Files\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr (UID: 00000000-00002308) "1yl18XO9.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAgjIz0kpCyVIqt\Files\AppData\Local\Adobe\Acrobat\DC (UID: 00000000-00002308) "1yl18XO9.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAgjIz0kpCyVIqt\Files\AppData\Local\Adobe\Acrobat (UID: 00000000-00002308) "1yl18XO9.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAgjIz0kpCyVIqt\Files\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache (UID: 00000000-00002308) "1yl18XO9.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAgjIz0kpCyVIqt\Files\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache (UID: 00000000-00002308) "1yl18XO9.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAgjIz0kpCyVIqt\Files\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cookie (UID: 00000000-00002308) "1yl18XO9.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAgjIz0kpCyVIqt\Files\AppData\Local\Adobe\AcroCef\DC\Acrobat (UID: 00000000-00002308) "1yl18XO9.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAgjIz0kpCyVIqt\Files\AppData\Local\Adobe\AcroCef\DC (UID: 00000000-00002308) "1yl18XO9.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAgjIz0kpCyVIqt\Files\AppData\Local\Adobe\AcroCef (UID: 00000000-00002308) "1yl18XO9.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAgjIz0kpCyVIqt\Files\AppData\Local\Adobe\AIR\logs (UID: 00000000-00002308) "1yl18XO9.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAgjIz0kpCyVIqt\Files\AppData\Local\Adobe\AIR (UID: 00000000-00002308) "1yl18XO9.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAgjIz0kpCyVIqt\Files\AppData\Local\Adobe\Color\Profiles (UID: 00000000-00002308) "1yl18XO9.exe" called "RemoveDirectoryA" with parameter %TEMP%\grandUIAgjIz0kpCyVIqt\Files\AppData\Local\Adobe\Color (UID: 00000000-00002308)51:T535,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "70dacb108d23e83d818c5006da2eae9c.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000700.00000000.69764.00DEC000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00000700.00000000.69764.00DEC000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00000700.00000000.69764.00DEC000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00000700.00000000.69764.00DEC000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00000700.00000000.69764.00DEC000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000700.00000000.69764.00DEC000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000700.00000000.69764.00DEC000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000804.00000001.69083.0004A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001524.00000001.69426.00F6A000.00000002.mdmp")52:T1b13,Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "/gtsr1/gtsr1" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFYyRZRleaQREjdgJW3R1jM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/moVDfISia2k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF2rtEA6xK7GEl4nbt8ZZfk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"53:T58d,Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "70dacb108d23e83d818c5006da2eae9c.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "70dacb108d23e83d818c5006da2eae9c.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00002968.00000000.69067.001B1000.00000020.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000700.00000000.69764.00DEC000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00000700.00000000.69764.00DEC000.00000002.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00000700.00000000.69764.00DEC000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00000804.00000001.69083.0004A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00000804.00000001.69083.0004A000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00001524.00000001.69426.00F6A000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00001524.00000001.69426.00F6A000.00000002.mdmp")54:T536,"AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "AppLaunch.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")55:T9d1,"1yl18XO9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1yl18XO9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1yl18XO9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "1yl18XO9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "1yl18XO9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1yl18XO9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1yl18XO9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "1yl18XO9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "1yl18XO9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "1yl18XO9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "1yl18XO9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "1yl18XO9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "1yl18XO9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "1yl18XO9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "1yl18XO9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "1yl18XO9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "1yl18XO9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "1yl18XO9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "1yl18XO9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "1yl18XO9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "1yl18XO9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "1yl18XO9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "1yl18XO9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "1yl18XO9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "1yl18XO9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")56:T58d,"1yl18XO9.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "1yl18XO9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "1yl18XO9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1yl18XO9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1yl18XO9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "1yl18XO9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "1yl18XO9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "1yl18XO9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "1yl18XO9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "1yl18XO9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "1yl18XO9.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "1yl18XO9.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "1yl18XO9.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")57:T495,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "70dacb108d23e83d818c5006da2eae9c.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "70dacb108d23e83d818c5006da2eae9c.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00000700.00000000.69764.00DEC000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00000700.00000000.69764.00DEC000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00000700.00000000.69764.00DEC000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00000804.00000001.69083.0004A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00000804.00000001.69083.0004A000.00000002.mdmp") file/memory contains long string with (Indicator: "OpenProcess"; Source: "00000000-00001524.00000001.69426.00F6A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00001524.00000001.69426.00F6A000.00000002.mdmp")58:T15c8,"70dacb108d23e83d818c5006da2eae9c.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "70dacb108d23e83d818c5006da2eae9c.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "jY0EZ40.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "jY0EZ40.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "1yl18XO9.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "1yl18XO9.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "2Sp1112.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "2Sp1112.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "2Sp1112.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "2Sp1112.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "2Sp1112.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll" - [base:0; Status:c0000135] "3GR57SO.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "3GR57SO.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "4Ur013Hw.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "4Ur013Hw.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "5RK9wl9.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "5RK9wl9.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "5RK9wl9.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135]59:Tadb,Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "70dacb108d23e83d818c5006da2eae9c.exe") file/memory contains long string with (Indicator: "twitter"; File: "VG6DG2Z6.txt") file/memory contains long string with (Indicator: "twitter"; File: "2GW4R9UM.txt") Found string "CheckConnectionTempCookie120461585accounts.youtube.com/accounts/2147484752812160031072900420522916431072899CheckConnectionTempCookie732746423accounts.youtube.com/accounts/2147484752812160031072900421264621031072899" (Indicator: "youtube"; File: "SYC1SKIC.txt") Found string "guest_id_marketingv1%3A170123616137174620twitter.com/1025378076940831219752419961315431072899guest_id_adsv1%3A170123616137174620twitter.com/1025378076940831219752420148515731072899" (Indicator: "twitter"; File: "IFL3TXNL.txt") Found string "CheckConnectionTempCookie120461585accounts.youtube.com/accounts/2147484752812160031072900420522916431072899" (Indicator: "youtube"; File: "C3BO4C99.txt") Found string "guest_id_marketingv1%3A170123616137174620twitter.com/1025378076940831219752419961315431072899" (Indicator: "twitter"; File: "WYPL9FUB.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "E5CIXFDL.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "twitter.com" (Indicator: "twitter"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "GET /i/flow/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: twitter.comDNT: 1Connection: Keep-Alive" (Indicator: "twitter"; File: "SSL") file/memory contains long string with (Indicator: "twitter"; File: "SSL") file/memory contains long string with (Indicator: "youtube"; File: "SSL") Found string "function DynamicLink_PlayYouTubeVideoInline( elem, videoid )" (Indicator: "youtube"; File: "shared_global_1_.js") Found string "var youtubeurl = location.protocol + '//www.youtube.com/embed/' + videoid + '?showinfo=0&autohide=1&fs=1&hd=1&modestbranding=1&rel=0&showsearch=0&wmode=direct&autoplay=1';" (Indicator: "youtube"; File: "shared_global_1_.js") Found string "var wrapper = $J( '

', { 'class': 'dynamiclink_youtubeviewvideo' } );" (Indicator: "youtube"; File: "shared_global_1_.js") Found string "var embed_wrapper = $J( '

', { 'class' : 'dynamiclink_youtubeviewvideoembedded', 'frameborder' : '0' } );" (Indicator: "youtube"; File: "shared_global_1_.js") Found string "var iframeContent = $J( '