Found URL "http://5.61.40.97:8000homedrive=c:homepath=\users\hapubwsinstall_dir=c:\mine_frwllocalappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82anumber_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00001668.00000000.86809.FF2B0000.00000004.mdmp") Found URL "https://5.61.40.97:45332service_name=mine-agentsessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowsc:\windows\system32\sc.exesc" - Source: "00000000-00001668.00000000.86809.FF2B0000.00000004.mdmp") Found URL "https://5.61.40.97:45332service_namemine-agentcommonprogramw6432=c:\program" - Source: "00000000-00001668.00000000.86809.FF2B0000.00000004.mdmp") Found URL "http://5.61.40.97:8000userdomain=desktop-fvvf82atmp=c:\users\hapubws\appdata\local\tempprogramfiles=c:\program" - Source: "00000000-00001668.00000000.86809.FF2B0000.00000004.mdmp") Found URL "https://5.61.40.97:45332userprofile=c:\users\hapubwsuserdnsdomain=desktop-fvvf82aprogramdata=c:\programdataprogramdata=c:\programdataprocessor_architecture=amd64install_dir=c:\mine_frwlpsmodulepath=c:\users\hapubws\documents\windowspowershell\modules;c:\program" - Source: "00000000-00001668.00000000.86809.FF2B0000.00000004.mdmp") Found URL "http://5.61.40.97:8000homepath=\users\hapubwsinstall_dir=c:\mine_frwllocalappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82a" - Source: "00000000-00001668.00000000.86809.FF2B0000.00000004.mdmp") Found URL "http://5.61.40.97:8000server_url=https://5.61.40.97:45332install_dir=c:\mine_frwllogonserver=\\desktop-fvvf82auserprofile=c:\users\hapubwsprogramw6432=c:\program" - Source: "00000000-00001668.00000000.86809.FF2B0000.00000004.mdmp") Found URL "https://5.61.40.97:45332userdnsdomain=desktop-fvvf82aprocessor_architecture=amd64userprofile=c:\users\hapubwsuserdomain=desktop-fvvf82aprogramw6432=c:\program" - Source: "00000000-00001668.00000000.86809.FF2B0000.00000004.mdmp") Found URL "http://5.61.40.97:8000homedrive=c:homepath=\users\hapubwsinstall_dir=c:\mine_frwllocalappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82anumber_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00001668.00000000.86809.FF530000.00000004.mdmp") Found URL "https://5.61.40.97:45332service_name=mine-agentsessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowsallusersprofile=c:\programdataappdata=c:\users\hapubws\appdata\roamingauth_token=37ce4dd303c4c5857d3e4865565729b75ca22c0a66b1cf5def8e5abb55bc3f5bcommonprogramfiles=c:\program" - Source: "00000000-00001668.00000000.86809.FF530000.00000004.mdmp") Found URL "https://5.61.40.97:45332service_name=mine-agentsessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windows0000" - Source: "00000000-00001668.00000000.86809.FF530000.00000004.mdmp") Found URL "http://5.61.40.97:8000homedrive=c:\\desktop-fvvf82anumber_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00001668.00000000.86809.FF530000.00000004.mdmp") Found URL "https://5.61.40.97:45332service_name=mine-agentsessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windows" - Source: "00000000-00001668.00000000.86809.FF530000.00000004.mdmp") Found URL "http://5.61.40.97:8000homedrive=c:homepath=\users\hapubwsinstall_dir=c:\mine_frwllocalappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82anumber_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00004352.00000000.87142.B2630000.00000004.mdmp") Found URL "https://5.61.40.97:45332service_name=mine-agentsessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowsc:\mine_frwl\c:\windows\system32\windowspowershell\v1.0\powershell.exepowershell" - Source: "00000000-00004352.00000000.87142.B2630000.00000004.mdmp") Found URL "http://5.61.40.97:8000/mine-agent.exe'" - Source: "00000000-00004352.00000000.87142.B2630000.00000004.mdmp") Found URL "http://5.61.40.97:8000homedrive=c:homepath=\users\hapubwsinstall_dir=e:\windows\microsoft.net\framework64\v4.0.30319\clr.dll:\windows\system32\windowspowershell\v1.0\powershell.exe2.dllile:///c:/windows/microsoft.net/framework64/v4.0.30319/icrosoft.net\frar.dlltem\*\fra,msil\fra\fra.net\fra:\windows\microsoft.net\assembly\gac_64\system.data\v4.0_4.0.0.0__b77a5c561934e089\system.data.dllc:\windows\system32\windowspowershell\v1.0\pwrshsip.dll:\windows\microsoft.net\assembly\gac_msil\system.xml\v4.0_4.0.0.0__b77a5c561934e089\system.xml.dll:\windows\microsoft.net\assembly\gac_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll:\windows\microsoft.net\assembly\gac_64\system.data\v4.0_4.0.0.0__b77a5c561934e089\system.data.dll:\windows\microsoft.net\assembly\gac_msil\system.xml\v4.0_4.0.0.0__b77a5c561934e089\system.xml.dll:\windows\microsoft.net\assembly\gac_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dllicrosoft.powershell.consolehost," - Source: "00000000-00004352.00000000.87142.B2630000.00000004.mdmp") Found URL "https://5.61.40.97:45332userprofile=c:\users\hapubwsauth_token=37ce4dd303c4c5857d3e4865565729b75ca22c0a66b1cf5def8e5abb55bc3f5bauth_token=37ce4dd303c4c5857d3e4865565729b75ca22c0a66b1cf5def8e5abb55bc3f5bauth_token=37ce4dd303c4c5857d3e4865565729b75ca22c0a66b1cf5def8e5abb55bc3f5bauth_token=37ce4dd303c4c5857d3e4865565729b75ca22c0a66b1cf5def8e5abb55bc3f5bpowershell-commandinvoke-webrequest" - Source: "00000000-00004352.00000000.87142.B2630000.00000004.mdmp") Found URL "https://5.61.40.97:45332userdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserprofile=c:\users\hapubwsinstall_dir=c:\mine_frwlonedrive=c:\users\hapubws\onedriveprogramfiles=c:\program" - Source: "00000000-00004352.00000000.87142.B2630000.00000004.mdmp") Found URL "http://5.61.40.97:8000onedrive=c:\users\hapubws\onedriveprocessor_architecture=amd64file_server=http://5.61.40.97:8000computername=desktop-fvvf82aprogramdata=c:\programdataprocessor_architecture=amd64nvm_symlink=c:\program" - Source: "00000000-00004352.00000000.87142.B2630000.00000004.mdmp") Found URL "https://5.61.40.97:45332userdomain=desktop-fvvf82auserdnsdomain=desktop-fvvf82alogonserver=\\desktop-fvvf82auserprofile=c:\users\hapubws\common" - Source: "00000000-00004352.00000000.87142.B2630000.00000004.mdmp") Found URL "https://5.61.40.97:45332ata\locainstall_dir=c:\mine_frwlprogramdata=c:\programdatanvm_symlink=c:\program" - Source: "00000000-00004352.00000000.87142.B2630000.00000004.mdmp") Found URL "http://5.61.40.97:8000install_dir=c:\mine_frwlfile_server=http://5.61.40.97:80006432=c:\program" - Source: "00000000-00004352.00000000.87142.B2630000.00000004.mdmp") Found URL "http://5.61.40.97:8000ograles\ers\computername=desktop-fvvf82alogonserver=\\desktop-fvvf82anvm_symlink=c:\program" - Source: "00000000-00004352.00000000.87142.B2630000.00000004.mdmp") Found URL "https://5.61.40.97:45332userdnsdomain=desktop-fvvf82auserprofile=c:\users\hapubwstmp=c:\users\hapubws\appdata\local\tempcomspec=c:\windows\system32\cmd.exeallusersprofile=c:\programdataonedrive=c:\users\hapubws\onedriveprocessor_architecture=amd64programfiles=c:\program" - Source: "00000000-00004352.00000000.87142.B2630000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004352.00000000.87142.B2630000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004352.00000000.87142.B2630000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004352.00000000.87142.B2630000.00000004.mdmp") Found URL "http://5.61.40.97:8000/mine-agent.exe'" - Source: "00000000-00004352.00000000.87142.B28B0000.00000004.mdmp") Found URL "http://5.61.40.97:8000homedrive=c:homepath=\users\hapubwsinstall_dir=c:\mine_frwllocalappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82anumber_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00004352.00000000.87142.B28B0000.00000004.mdmp") Found URL "https://5.61.40.97:45332service_name=mine-agentsessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windows9ba8500e-4c9d-4fb8-b6a6-66e5d227b8a6ws\system32xwo5itco" - Source: "00000000-00004352.00000000.87142.B28B0000.00000004.mdmp") Found URL "http://5.61.40.97:8000homeddir=c:\mine_frwllocalappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82anumber_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00004352.00000000.87142.B28B0000.00000004.mdmp") Found URL "https://5.61.40.97:45332service_name=mine-agentsessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windows" - Source: "00000000-00004352.00000000.87142.B28B0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "http://g2.symcb2[geotrust" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "https://go.microsoft.con[.text" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623621" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004352.00000000.87142.CC8E0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004352.00000000.87142.CCAD0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004352.00000000.87142.CCAD0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004352.00000000.87142.F3D72000.00000002.mdmp") Found URL "http://5.61.40.97:8000/mine-agent.exe'" - Source: "00000000-00004352.00000001.87479.B2630000.00000004.mdmp") Found URL "http://5.61.40.97:8000homedrive=c:homepath=\users\hapubwsinstall_dir=e:\windows\microsoft.net\framework64\v4.0.30319\clr.dll:\windows\system32\windowspowershell\v1.0\powershell.exe2.dllile:///c:/windows/microsoft.net/framework64/v4.0.30319/icrosoft.net\frar.dlltem\*\fra,msil\fra\fra.net\fra:\windows\microsoft.net\assembly\gac_64\system.data\v4.0_4.0.0.0__b77a5c561934e089\system.data.dllc:\windows\system32\windowspowershell\v1.0\pwrshsip.dll:\windows\microsoft.net\assembly\gac_msil\system.xml\v4.0_4.0.0.0__b77a5c561934e089\system.xml.dll:\windows\microsoft.net\assembly\gac_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll:\windows\microsoft.net\assembly\gac_64\system.data\v4.0_4.0.0.0__b77a5c561934e089\system.data.dll:\windows\microsoft.net\assembly\gac_msil\system.xml\v4.0_4.0.0.0__b77a5c561934e089\system.xml.dll:\windows\microsoft.net\assembly\gac_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dllicrosoft.powershell.consolehost," - Source: "00000000-00004352.00000001.87479.B2630000.00000004.mdmp") Found URL "https://5.61.40.97:45332userprofile=c:\users\hapubwsauth_token=37ce4dd303c4c5857d3e4865565729b75ca22c0a66b1cf5def8e5abb55bc3f5bauth_token=37ce4dd303c4c5857d3e4865565729b75ca22c0a66b1cf5def8e5abb55bc3f5bauth_token=37ce4dd303c4c5857d3e4865565729b75ca22c0a66b1cf5def8e5abb55bc3f5bauth_token=37ce4dd303c4c5857d3e4865565729b75ca22c0a66b1cf5def8e5abb55bc3f5bpowershell-commandinvoke-webrequest" - Source: "00000000-00004352.00000001.87479.B2630000.00000004.mdmp") Found URL "https://5.61.40.97:45332userdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserprofile=c:\users\hapubwsinstall_dir=c:\mine_frwlonedrive=c:\users\hapubws\onedriveprogramfiles=c:\program" - Source: "00000000-00004352.00000001.87479.B2630000.00000004.mdmp") Found URL "http://5.61.40.97:8000onedrive=c:\users\hapubws\onedriveprocessor_architecture=amd64file_server=http://5.61.40.97:8000computername=desktop-fvvf82aprogramdata=c:\programdataprocessor_architecture=amd64nvm_symlink=c:\program" - Source: "00000000-00004352.00000001.87479.B2630000.00000004.mdmp") Found URL "https://5.61.40.97:45332userdomain=desktop-fvvf82auserdnsdomain=desktop-fvvf82alogonserver=\\desktop-fvvf82auserprofile=c:\users\hapubws\common" - Source: "00000000-00004352.00000001.87479.B2630000.00000004.mdmp") Found URL "https://5.61.40.97:45332ata\locainstall_dir=c:\mine_frwlprogramdata=c:\programdatanvm_symlink=c:\program" - Source: "00000000-00004352.00000001.87479.B2630000.00000004.mdmp") Found URL "http://5.61.40.97:8000install_dir=c:\mine_frwlfile_server=http://5.61.40.97:80006432=c:\program" - Source: "00000000-00004352.00000001.87479.B2630000.00000004.mdmp") Found URL "http://5.61.40.97:8000ograles\ers\computername=desktop-fvvf82alogonserver=\\desktop-fvvf82anvm_symlink=c:\program" - Source: "00000000-00004352.00000001.87479.B2630000.00000004.mdmp") Found URL "https://5.61.40.97:45332userdnsdomain=desktop-fvvf82auserprofile=c:\users\hapubwstmp=c:\users\hapubws\appdata\local\tempcomspec=c:\windows\system32\cmd.exeallusersprofile=c:\programdataonedrive=c:\users\hapubws\onedriveprocessor_architecture=amd64programfiles=c:\program" - Source: "00000000-00004352.00000001.87479.B2630000.00000004.mdmp") Found URL "http://5.61.40.97:8000/mine-agent.exe'" - Source: "00000000-00004352.00000001.87479.B265E000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004352.00000001.87479.B265E000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004352.00000001.87479.B265E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004352.00000001.87479.B265E000.00000004.mdmp") Found URL "http://5.61.40.97:8000/mine-agent.exe'" - Source: "00000000-00004352.00000001.87479.B28B0000.00000004.mdmp") Found URL "http://5.61.40.97:8000homedrive=c:homepath=\users\hapubwsinstall_dir=c:\mine_frwllocalappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82anumber_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00004352.00000001.87479.B28B0000.00000004.mdmp") Found URL "https://5.61.40.97:45332service_name=mine-agentsessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windows9ba8500e-4c9d-4fb8-b6a6-66edefender" - Source: "00000000-00004352.00000001.87479.B28B0000.00000004.mdmp") Found URL "http://5.61.40.97:8000homeddir=c:\mine_frwllocalappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82anumber_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00004352.00000001.87479.B28B0000.00000004.mdmp") Found URL "https://5.61.40.97:45332service_name=mine-agentsessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windows" - Source: "00000000-00004352.00000001.87479.B28B0000.00000004.mdmp") Found URL "http://www1.40.97:8000/mine-agent.exe5.61.40.97/mine-agent.exesebasicparsing" - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "http://g2.symcb2[geotrust" - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "https://go.microsoft.con[@)" - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623621" - Source: "00000000-00004352.00000001.87479.CC8E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004352.00000001.87479.CC98A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004352.00000001.87479.CCC1C000.00000004.mdmp") Found URL "http://5.61.40.97:8000homedrive=c:homepath=\users\hapubwsinstall_dir=c:\mine_frwllocalappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82anumber_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00006200.00000000.86478.7CC90000.00000004.mdmp") Found URL "https://5.61.40.97:45332service_name=mine-agentsessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windowsc:\windows\system32\net1.exec:\windows\system32\net1.exewinsta0\default:\windows\system32\ntdll.dll:\windows\system32:\windows\system32;c:\windows\system;c:\windows;:\windows\system32\kernel32.dll:\windows\system32\msvcrt.dll:\windows\system32\kernelbase.dllsessions\1\windows\apiportectionc:\windows\temp\vxole64.dllok.exedsrole.dllsrvcli.dllf78b956-909d-45b2-8b8d-2e5e1d522649li.dlladvapi32.dllmsvcp_win.dllc:\windows\system32\gdi32full.dll:\windows\system32\sechost.dllrpcrt4.dll:\windows\system32\rpcrt4.dll:\windows\system32\samcli.dllpower\hapdows\system32\en-us\netmsg.dll.mui:\usersindoen-us\netmsg.dll.mui:\windows\system32\netutils.dll:\windows\system32\dsrole.dll:\windows\system32\srvcli.dll:\windows\system32\wkscli.dll:\windows\system32\logoncli.dll:\windows\system32\bcrypt.dll:\windows\system32\ws2_32.dll:\windows\system32\fltlib.dll:\windows\system32\cryptbase.dllc:\windows\temp\vxssl64.dll:\windows\system32\bcryptprimitives.dlluser32.dllwin32u.dll52c64b7eole32.dll52c64b7egdi32.dll00000pipe\srvsvcogramrs\hjmsiscanbufferc4c5ta22cqmsiscanbufferitmprt.c//5.apubrs\hava\s\haodejta\localisteisteiste" - Source: "00000000-00006200.00000000.86478.7CC90000.00000004.mdmp") Found URL "https://5.61.40.9service_name=mine-agentsessionname=consslkeylogfile=c:\users\hapubws\appdata\local\sslkey.txtsystemdrive=c:systemroot=c??\c:\0f78b956-909d-45b2-8b8d-2e5e1d522649" - Source: "00000000-00006200.00000000.86478.7CC90000.00000004.mdmp") Found URL "http://5.61.40.97:8000onedrive=c:\users\hapubws\onedrivehomedrive=c:appdata=c:\users\hapubws\appdata\roamingcommonprogramfiles(x86)=c:\program" - Source: "00000000-00006200.00000000.86478.7CC90000.00000004.mdmp") Found URL "http://5.61.40.97:8000userdomain=desktop-fvvf82aallusersprofile=c:\programdatacomputername=desktop-fvvf82auserdnsdomain=desktop-fvvf82aprogramfiles=c:\program" - Source: "00000000-00006200.00000000.86478.7CC90000.00000004.mdmp") Found URL "https://5.61.40.97:45332server_url=https://5.61.40.97:45332programdata=c:\programdatauserprofile=c:\users\hapubwscomspec=c:\windows\system32\cmd.exeuserprofile=c:\users\hapubwsinstall_dir=c:\mine_frwlprogramw6432=c:\program" - Source: "00000000-00006200.00000000.86478.7CC90000.00000004.mdmp") Found URL "http://5.61.40.97:8000programw6432=c:\program" - Source: "00000000-00006200.00000000.86478.7CC90000.00000004.mdmp") Found URL "https://5.61.40.97:45332computername=desktop-fvvf82ainstall_dir=c:\mine_frwluserdnsdomain=desktop-fvvf82aprogramdata=c:\programdatanvm_symlink=c:\program" - Source: "00000000-00006200.00000000.86478.7CC90000.00000004.mdmp") Found URL "http://5.61.40.97:8000homedrive=c:c:\windows\system32\net1sers\hapubws\apodejs;c:\users\hapubws\appdata\local\programs\python\python311\scripts\;c:\users\hapubws\appdata\local\programs\python\python311\;c:\users\hapubws\appdata\local\microsoft\windowsapps;c:\program" - Source: "00000000-00006200.00000000.86478.7CF40000.00000004.mdmp") Found URL "https://5.61.40.97:45332service_name=mine-agentsessionname=consolesslkeylogfile=c:\users\hapubws\appdata\local\temp\sslkey.txtsystemdrive=c:systemroot=c:\windowstemp=c:\users\hapubws\appdata\local\temptmp=c:\users\hapubws\appdata\local\tempuserdnsdomain=desktop-fvvf82auserdomain=desktop-fvvf82auserdomain_roamingprofile=desktop-fvvf82ausername=hapubwsuserprofile=c:\users\hapubwswindir=c:\windows" - Source: "00000000-00006200.00000000.86478.7CF40000.00000004.mdmp") Found URL "http://5.61.40.97:8000homedrive=c:homepath=\users\hapubwsinstall_dir=c:\mine_frwllocalappdata=c:\users\hapubws\appdata\locallogonserver=\\desktop-fvvf82anumber_of_processors=8nvm_home=c:\users\hapubws\appdata\roaming\nvmnvm_symlink=c:\program" - Source: "00000000-00006200.00000000.86478.7CF40000.00000004.mdmp")