24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 55:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Adware.Lazy.Generic Sample 666e31dee445… — Score 74/100 — Hybrid Analysis","description":"Malicious verdict for sample 666e31dee445…. Malware family: Adware.Lazy.Generic. Threat score 74/100. 6/27 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4","keywords":["Malicious","Adware.Lazy.Generic","malware analysis","sandbox report","threat intelligence","666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4"],"about":{"@type":"SoftwareApplication","name":"MeriumV3.8.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4","additionalType":"Malicious sample"},"threatScore":74,"malwareFamily":"Adware.Lazy.Generic","antivirusDetections":{"malicious":6,"total":27},"behavioralIndicators":{"malicious":0,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6f9,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "KeWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "KeQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")26:T597,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")27:T484,Found reference to "SHA384" (Indicator: "SHA384"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to "CALG_RC2" (Indicator: "RC2"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to "CALG_HMAC" (Indicator: "HMAC"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to "TLS_AES_256_GCM_SHA384" (Indicator: "SHA384"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to "%s4-HMAC-SHA256%s%s%s" (Indicator: "HMAC"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to "Authorization: %s4-HMAC-SHA256 Credential=%s/%s, SignedHeaders=%s, Signature=%s%s%s" (Indicator: "HMAC"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to "ecdsa-with-SHA384" (Indicator: "SHA384"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to "ecdsa-with-SHA512" (Indicator: "SHA512"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")28:T46e,Found reference to API "IsDebuggerPresent" (Indicator: "IsDebuggerPresent"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CheckRemoteDebuggerPresent" (Indicator: "CheckRemoteDebuggerPresent"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "OutputDebugStringW" (Indicator: "OutputDebugString"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "KeQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")29:T10aa,Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CryptHashData" (Indicator: "CryptHashData"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CertFindExtension" (Indicator: "CertFindExtension"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CertCreateCertificateChainEngine" (Indicator: "CertCreateCertificateChainEngine"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChain"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChainEngine"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "PFXImportCertStore" (Indicator: "PFXImportCertStore"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CryptQueryObject" (Indicator: "CryptQueryObject"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CryptStringToBinaryW" (Indicator: "CryptStringToBinaryW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CryptDecodeObjectEx" (Indicator: "CryptDecodeObject"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CryptDecodeObjectEx" (Indicator: "CryptDecodeObjectEx"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")2a:T2256,Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-90-0000000140135EC0 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-90-0000000140135EC0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-90-0000000140135EC0 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-90-0000000140135EC0 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4017-00000001401C96B0 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4017-00000001401C96B0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4017-00000001401C96B0 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4017-00000001401C96B0 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4026-00000001401C8770 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4026-00000001401C8770 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4026-00000001401C8770 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4026-00000001401C8770 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4072-00000001401B9030 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4072-00000001401B9030 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4072-00000001401B9030 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4072-00000001401B9030 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4073-0000000140144530 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4073-0000000140144530 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4073-0000000140144530 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4073-0000000140144530 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4074-00000001401454D0 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4074-00000001401454D0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4074-00000001401454D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4074-00000001401454D0 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4076-00000001401B9AF0 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4076-00000001401B9AF0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4076-00000001401B9AF0 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4076-00000001401B9AF0 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4082-00000001401B9450 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4082-00000001401B9450 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4082-00000001401B9450 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4082-00000001401B9450 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4199-000000014019AFA0 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4199-000000014019AFA0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4199-000000014019AFA0 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4199-000000014019AFA0 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4319-0000000140186430 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4319-0000000140186430 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4319-0000000140186430 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4319-0000000140186430 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4328-0000000140185630 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4328-0000000140185630 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4328-0000000140185630 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4328-0000000140185630 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4344-0000000140184FE0 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4344-0000000140184FE0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4344-0000000140184FE0 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4344-0000000140184FE0 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4354-0000000140184B50 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4354-0000000140184B50 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4354-0000000140184B50 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4354-0000000140184B50 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4435-0000000140175690 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4435-0000000140175690 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4435-0000000140175690 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4435-0000000140175690 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4438-00000001401759A0 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4438-00000001401759A0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4438-00000001401759A0 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4438-00000001401759A0 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4449-00000001401748B0 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4449-00000001401748B0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4449-00000001401748B0 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4449-00000001401748B0 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4496-0000000140169630 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4496-0000000140169630 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4496-0000000140169630 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4496-0000000140169630 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4552-000000014019C720 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4552-000000014019C720 Assembly shows XOR instruction xor r8d eax in Stream UID: 36522-4552-000000014019C720 Assembly shows XOR instruction xor eax edi in Stream UID: 36522-4552-000000014019C720 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4552-000000014019C720 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4552-000000014019C720 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4576-000000014015A130 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4576-000000014015A130 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4576-000000014015A130 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4576-000000014015A130 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4608-00000001401526D0 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4608-00000001401526D0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4608-00000001401526D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4608-00000001401526D0 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4637-000000014013FB30 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4637-000000014013FB30 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4642-00000001401324D0 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4642-00000001401324D0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4642-00000001401324D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4642-00000001401324D0 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4647-0000000140137280 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4647-0000000140137280 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4647-0000000140137280 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4647-0000000140137280 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-4665-000000014012B750 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-4665-000000014012B750 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-4665-000000014012B750 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-4665-000000014012B750 Assembly shows XOR instruction xor rax rsp in Stream UID: 36522-5118-00000001400BAAF0 Assembly shows XOR instruction xor eax esp in Stream UID: 36522-5118-00000001400BAAF0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 36522-5118-00000001400BAAF0 Assembly shows XOR instruction xor ecx esp in Stream UID: 36522-5118-00000001400BAAF02b:Tca1,Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CryptImportKey" (Indicator: "CryptImportKey"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CryptDecodeObjectEx" (Indicator: "CryptDecodeObject"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CertGetNameStringW" (Indicator: "CertGetNameString"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "schannel: CryptDecodeObjectEx() returned no alternate name information." (Indicator: "CryptDecodeObject"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "schannel: CertGetNameString() returned no certificate name information" (Indicator: "CertGetNameString"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "schannel: CertGetNameString() returned certificate name information of unexpected size" (Indicator: "CertGetNameString"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names" (Indicator: "CertGetNameString"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")2c:T559,Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CryptImportKey" (Indicator: "CryptImportKey"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")2d:T7c3,Found string "[ERROR] Failed to parse public key hex." (Indicator: "public key"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "Signature verification failed (invalid public key)" (Indicator: "public key"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "SSL public key does not match pinned public key" (Indicator: "public key"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "-----BEGIN PUBLIC KEY-----" (Indicator: "public key"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "-----END PUBLIC KEY-----" (Indicator: "public key"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "public key hash: sha256//%s" (Indicator: "public key"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "SSL: public key does not match pinned public key" (Indicator: "public key"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "SSL: failed retrieving public key from server certificate" (Indicator: "public key"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "ECC Public Key (%zu bits)" (Indicator: "public key"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "ECC Public Key" (Indicator: "public key"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "RSA Public Key (%zu bits)" (Indicator: "public key"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "RSA Public Key" (Indicator: "public key"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "Public Key Algorithm" (Indicator: "public key"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")2e:T42a,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Possibly contains Public/Private key (encryption) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains key cryptographic functions of the CryptoAPI Matched sigs: Uses Windows cryptography API for obfuscation2f:T7e89,Found XOR loop in file "sample.bin" at offset 2025969; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2125781; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6117133; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6176916; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 270837; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 271097; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 498358; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 498452; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 498485; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 505798; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 627878; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 905358; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 905363; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 975557; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 992522; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 992528; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 992563; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1024630; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1024677; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1024684; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1024851; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1058122; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1059458; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1121881; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1121923; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1121933; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1121975; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1121985; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1122027; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1122037; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1122104; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1209243; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1280062; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1280094; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1281029; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1290570; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1297684; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1344397; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1469465; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1487883; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1487897; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1488003; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1488023; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1488139; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1488153; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1488248; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1488258; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1488375; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1488389; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1488496; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1488506; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1488621; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1488635; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1488739; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1488757; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1488861; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1488879; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1488983; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1489001; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1489112; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1489129; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1489240; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1489254; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1489353; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1489363; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1489483; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1489500; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1489682; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1489820; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1489834; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1489904; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1489922; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1489975; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1489985; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490047; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490065; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490118; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490136; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490178; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490198; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490256; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490270; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490319; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490339; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490393; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490417; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490471; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490489; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490539; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490549; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490605; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490671; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490685; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490729; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490736; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490808; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1492070; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1509387; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1719565; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1744553; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1744633; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1744705; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1744811; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1744894; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1744996; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1745072; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1745131; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1773457; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1773800; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1774330; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1774450; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1774815; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1775290; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1775311; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1775342; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1775365; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1776383; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1776501; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1776950; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1776984; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1777026; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1777061; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1784004; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1784074; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1784382; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1784410; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1784698; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1784722; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1785010; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1785031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1785325; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1785348; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1786157; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1786245; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1786611; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1786646; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1833435; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1833518; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1833609; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1833681; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1833774; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1833845; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1833943; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1834011; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1834074; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1834135; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1834675; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1834794; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1834977; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1835190; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1835330; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1835448; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1835912; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1836133; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1836257; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1836449; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1836519; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1836590; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1836657; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1836787; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1836915; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1836958; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1837005; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1837155; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1837268; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1837374; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1837460; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1837543; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1837637; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1837774; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1837887; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1838004; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1838118; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1838219; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1838351; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1838397; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1838474; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1838599; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1838702; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1838758; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1838820; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1838928; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1839038; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1839216; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1839248; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1839354; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1839451; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1839480; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1839573; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1839602; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1839691; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1839723; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1839787; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1839840; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1839914; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1840031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1840230; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1840289; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1840343; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1840462; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1840581; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1840688; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1840745; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1840811; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1840915; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1841063; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1841174; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1841244; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1841325; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1841425; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1841528; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1841665; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1841708; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1841775; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1841906; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1842023; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1842135; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1842209; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1842277; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1842368; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1842460; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1842527; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1842591; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1842661; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1842748; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1842799; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1842926; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1843032; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1843499; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1843727; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1843849; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1844047; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1844098; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1844164; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1844234; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1844366; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1844475; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1844532; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1844625; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1844727; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1844784; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1844826; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1844962; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1845080; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2045218; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2127452; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4809265; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4809274; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5054536; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6065478; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6086523; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6086544; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 102662; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 699996; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 714415; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 763531; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1043191; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1213519; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1213760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1214095; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1214576; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1214911; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1215184; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1236156; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1275020; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1639164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1667621; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1676527; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1930168; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1930181; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1930238; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1930249; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1930259; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1931624; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1931637; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1931694; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1931705; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1931715; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2021035; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2023746; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2025414; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2025949; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2025968; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2026154; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2026242; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2026413; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2026424; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2026945; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2026956; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2027408; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2027419; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2028492; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2029808; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2029819; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2030630; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2030651; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2030933; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2030944; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2030954; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2031121; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2031132; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2031284; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2031445; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2031456; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2032051; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2032268; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2033208; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2034254; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2034601; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2035006; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2035017; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2035201; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2035212; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2035342; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2035610; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2035621; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2035845; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2035856; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2036122; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2036190; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2036444; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2037283; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2037541; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2037735; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2038053; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2038497; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2038719; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2038851; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2038998; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2039105; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2039413; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2040025; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2040111; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2040122; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2040603; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2040939; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2041169; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2041396; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2041449; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2041848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2042139; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2042324; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2043940; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2044612; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2044988; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2045207; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2045453; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2045817; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2045997; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2046129; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2046346; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2046543; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2046892; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2047425; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2048167; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2048697; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2049077; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2049497; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2049522; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2050196; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2050222; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2050956; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2050967; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2051133; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2051211; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2051241; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2051348; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2051482; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2051493; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2052196; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2052495; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2052844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2053458; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2053701; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2053973; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2054341; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2055106; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2055391; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2056289; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2056674; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2057014; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2057836; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2058136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2058617; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2059756; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2059950; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2060316; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2061061; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2061107; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2061428; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2061925; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2062443; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2062773; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2062988; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2063099; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2063243; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2063254; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2063290; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2063336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2063347; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2063427; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2063486; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2063497; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2063523; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2063708; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2063736; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2064042; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2064050; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2064195; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2064203; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2064262; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2064278; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2064319; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2064682; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2064754; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2065530; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2065599; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2065793; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2065948; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2066176; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2066232; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2066479; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2066490; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2066818; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2066829; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2066882; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2066893; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2066943; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2066954; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2157328; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3288400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4826744; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4828098; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4915071; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5090468; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5094267; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6199984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6213148; code bytes = 803030:T631e,Observed string: "e Survey" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Identifiers" /freg delete "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig" /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSVendor /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSReleaseDate /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemProductName /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /freg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" /v SystemStartOptions /freg delete "HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /freg delete "HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags" /freg delete "HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU" /f" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Observed string: "ist" /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSVendor /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSReleaseDate /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemProductName /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /freg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" /v SystemStartOptions /freg delete "HKEY_CURRENT_USER\Software\Epic Games" /freg delete "HKEY_LOCAL_MACHINE\Software\Epic Games" /freg delete "HKEY_CURRENT_USER\Software\Epic Games" /freg delete "HKEY_LOCAL_MACHINE\Software\Epic Games" /freg delete "HKU\.Dreg delete "HKEY_CURRENT_USER\Software\Epic Games" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine" /freg delete" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Observed string: "EY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSVendor /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSReleaseDate /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemProductName /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /freg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" /v SystemStartOptions /freg delete "HKEY_CURRENT_USER\Software\Epic Games" /freg delete "HKEY_LOCAL_MACHINE\Software\Epic Games" /freg delete "HKEY_CURRENT_USER\Software\Epic Games" /freg delete "HKEY_LOCAL_MACHINE\Software\Epic Games" /freg delete "HKU\.Dreg delete "HKEY_CURRENT_USER\Software\Epic Games" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine" /freg delete "HKEY_CURRENT_USER\Sof" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "M\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d %random% /fREG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d %random% /freg delete"HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\WMI\Security\" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Hardware Survey" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Identifiers" /freg delete "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig" /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSVendor /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSReleaseDate /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemProductName /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /freg delete "HKEY_LOCAL_MACHINE\System\Curre" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Observed string: "icrosoft\Windows\Shell\BagMRU\6\0\0\0" /fREG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\Configuration\Variables\BusDeviceDesc" /v PropertyGuid /t REG_SZ /d {%Hex8%-%Hex1%-%Hex0%-%Hex1%-%Hex10%} /f>nul 2>&1REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\DeviceDesc" /v PropertyGuid /t REG_SZ /d {%Hex8%-%Hex1%-%Hex0%-%Hex1%-%Hex10%} /f>nul 2>&1REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\Configuration\Variables\Driver" /v PropertyGuid /t REG_SZ /d {%Hex8%-%Hex1%-%Hex0%-%Hex1%-%Hex10%} /f>nul 2>&1WREG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v ComputerHardwareId /t REG_SZ /d {%Hex8%-%Hex1%-%Hex0%-%Hex1%-%Hex10%} /f>nul 2>&1REG ADD HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS /v BaseBoardManufacturer /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "BIOS /v SystemManufacturer /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS /v SystemProductName /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation /v SystemManufacturer /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation /v SystemProductName /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation /v SystemManufacturer /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation /v SystemProductName /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current /v SystemManufacturer /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current /v SystemProductName /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current /v BaseBoardManufacturer /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\{a0408a6a-546c-11ea-af4e-4df901723b0f} /v System" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "\HARDWARE\DESCRIPTION\System\BIOS /v BaseBoardManufacturer /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS /v SystemManufacturer /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS /v SystemProductName /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation /v SystemManufacturer /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation /v SystemProductName /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation /v SystemManufacturer /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation /v SystemProductName /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current /v S" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "408a6a-546c-11ea-af4e-4df901723b0f}\ComputerIds /v {6ef3fe51-9106-55cf-a553-f5d21bb78cc3} /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\{a0408a6a-546c-11ea-af4e-4df901723b0f}\ComputerIds /v {7b3e1573-c771-5dbd-b795-f8344771349d} /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v BaseBoardManufacturer /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v BaseBoardProduct /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v BaseBoardVersion /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v BIOSVersion /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemFamily /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemManufacturer /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemProductName /t REG_SZ /d Neutron-%rand" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "m% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemSKU /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemVersion /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemProductName /t REG_SZ /d Neutron-%random% /fREG ADD "HKCR\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /v "C:\Users\THEGUY3ds\Downloads\Caught.Power-cleaned.exe.ApplicationCompany" /t REG_SZ /d "Neutron-%random%" /fREG ADD "HKCR\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /v "C:\Users\THEGUY3ds\Downloads\Caught.Power.exe.ApplicationCompany" /t REG_SZ /d "Neutron-%random%" /fREG ADD "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /v "C:\Users\THEGUY3ds\Downloads\Caught.Power-cleaned.exe.ApplicationCompany" /t REG_SZ /d "Neutron-%random%" /fREG ADD "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /v "C:\Users\THEGUY3ds\Downloads\Caught.Power.exe.ApplicationCompany"" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "omputerHardwareId /t REG_SZ /d {%Hex8%-%Hex1%-%Hex0%-%Hex1%-%Hex10%} /f>nul 2>&1REG ADD HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS /v BaseBoardManufacturer /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS /v SystemManufacturer /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS /v SystemProductName /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation /v SystemManufacturer /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation /v SystemProductName /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation /v SystemManufacturer /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation /v SystemProductName /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current /v SystemManufacturer /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "e51-9106-55cf-a553-f5d21bb78cc3} /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\{a0408a6a-546c-11ea-af4e-4df901723b0f}\ComputerIds /v {7b3e1573-c771-5dbd-b795-f8344771349d} /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS /v BaseBoardManufacturer /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS /v SystemManufacturer /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS /v SystemProductName /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation /v SystemManufacturer /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation /v SystemProductName /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation /v SystemManufacturer /t REG_SZ /d Neut" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "EG ADD HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\{a0408a6a-546c-11ea-af4e-4df901723b0f}\ComputerIds /v {feb9c5fe-1cdf-59a8-8008-550892c61c37} /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\{a0408a6a-546c-11ea-af4e-4df901723b0f}\ComputerIds /v {6ef3fe51-9106-55cf-a553-f5d21bb78cc3} /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\{a0408a6a-546c-11ea-af4e-4df901723b0f}\ComputerIds /v {7b3e1573-c771-5dbd-b795-f8344771349d} /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v BaseBoardManufacturer /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v BaseBoardProduct /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v BaseBoardVersion /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v BIOSVersion /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "SystemFamily /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemManufacturer /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemProductName /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemSKU /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemVersion /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemProductName /t REG_SZ /d Neutron-%random% /fREG ADD "HKCR\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /v "C:\Users\THEGUY3ds\Downloads\Caught.Power-cleaned.exe.ApplicationCompany" /t REG_SZ /d "Neutron-%random%" /fREG ADD "HKCR\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /v "C:\Users\THEGUY3ds\Downloads\Caught.Power.exe.ApplicationCompany" /t REG_SZ /d "Neutron-%random%" /fREG ADD "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /v "C:\Users\THEGUY3ds\Downlo" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Observed string: "crosoft.XboxGameOverlay_1.41.24001.0_x64__8wekyb3d8bbwe" /freg delete "HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat" /freg delete "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat" /freg delete "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\Security" /freg delete "HKLM\SYSTEM\CurrentControlSet\Services\EasyAntiCheat" /freg delete "HKLM\SYSTEM\CurrentControlSet\Services\EasyAntiCheat\Security" /freg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0007 /v NetworkAddress /d 002622D90EFC /freg delete "HKEY_CURRENT_USER\Software\Classes\com.epicgames.launcher" /freg delete "HKEY_CURRENT_USER\Software\Epic Games" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Hardware Survey" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Identifiers" /freg delete "HKEY_CURRENT_USER\Software\WOW6432Node\Epic Games" /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSReleaseDate /freg delete "HKEY" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Observed string: "LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSVendor /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemProductName /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /freg delete "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig" /freg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" /v SystemStartOptions /freg delete "HKEY_USERS\S-1-5-21-2097722829-2509645790-3642206209-1001\Software\Epic Games" /freg delete"HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig" /freg delete"HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\WMI\Security\" /fREG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d Desktop%random% /fREG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d Desktop%random% /fREG ADD HKLM\SYSTEM\HardwareConfig /v L" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "uildGUID /t REG_SZ /d %random% /fREG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d %random% /fREG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOrganization /t REG_SZ /d %random% /fREG ADD HKLM\SOFTWARE\Microsoft\Cryptography /v GUID /t REG_SZ /d %random%-%random%-%random%-%random% /fREG ADD HKLM\SOFTWARE\Microsoft\Cryptography /v MachineGuid /t REG_SZ /d %random%-%random%-%random%-%random% /fREG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion\Tracing\Microsoft\Profile\Profile /v Guid /t REG_SZ /d %random%-%random%-%random%-%username%%random% /freg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0007 /v NetworkAddress /d 002622D90EFC /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSReleaseDate /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSVendor /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "ystemManufacturer /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemProductName /freg delete"HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig" /fREG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d %random%-%random% /fREG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d %random%-%random% /fREG ADD HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d {eac%random%} /fREG ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v HwProfileGuid /t REG_SZ /d {%random%-%random%-%random%-%random%-%random%} /fREG ADD HKLM\SYSTEM\CurrentControlSet\Control\IDConfigDB\Hardware" "Profiles\0001 /v GUID /t REG_SZ /d {%random%-%random%-%random%-%random%-%random%} /fREG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v BuildGUID /t REG_SZ /d %random%-%random% /fREG ADD HKLM\SOFTWARE\Microsoft\Windows" "NT\CurrentVersion /v RegisteredOwner /t REG_SZ /d %rand" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "ity\" /freg delete "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig" /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSVendor /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSReleaseDate /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemProductName /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /freg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" /v SystemStartOptions /fdel /s /f /a:h /a:a /q "C:\Windows\prefetch\CLEANER.EXE-08C569E3.pf" del /s /f /a:h /a:a /q "C:\Windows\prefetch\RUNTIMEBROKER.EXE-4551A062.pf" del /s /f /a:h /a:a /q "C:\Windows\prefetch\TOOL.EXE-7A8EFD97.pf" del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749" del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "Settings\Software\Microsoft\Windows\Shell\BagMRU\6\0\0\0" /v "0" /fREG ADD "HKU\S-1-5-21-1890030585-3173979648-977140667-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\6\0\0\0" /fREG ADD HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS /v BaseBoardManufacturer /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS /v SystemManufacturer /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS /v SystemProductName /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation /v SystemManufacturer /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation /v SystemProductName /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation /v SystemManufacturer /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation /v SystemProductName /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Observed string: "-546c-11ea-af4e-4df901723b0f}\ComputerIds /v {feb9c5fe-1cdf-59a8-8008-550892c61c37} /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\{a0408a6a-546c-11ea-af4e-4df901723b0f}\ComputerIds /v {6ef3fe51-9106-55cf-a553-f5d21bb78cc3} /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\{a0408a6a-546c-11ea-af4e-4df901723b0f}\ComputerIds /v {7b3e1573-c771-5dbd-b795-f8344771349d} /t REG_SZ /d /ve /fREG ADD HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS /v BaseBoardManufacturer /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS /v SystemManufacturer /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS /v SystemProductName /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation /v SystemManufacturer /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Observed string: "onfig\{a0408a6a-546c-11ea-af4e-4df901723b0f}\ComputerIds /v {feb9c5fe-1cdf-59a8-8008-550892c61c37} /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\{a0408a6a-546c-11ea-af4e-4df901723b0f}\ComputerIds /v {6ef3fe51-9106-55cf-a553-f5d21bb78cc3} /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\{a0408a6a-546c-11ea-af4e-4df901723b0f}\ComputerIds /v {7b3e1573-c771-5dbd-b795-f8344771349d} /t REG_SZ /d Neutron-%random%%random%%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v BaseBoardManufacturer /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v BaseBoardProduct /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v BaseBoardVersion /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v BIOSVersion /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemFamily /t REG_SZ /d Neutron-%random" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Observed string: "/fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemManufacturer /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemProductName /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemSKU /t REG_SZ /d Neutron-%random% /fREG ADD HKLM\HARDWARE\DESCRIPTION\System\BIOS /v SystemVersion /t REG_SZ /d Neutron-%random% /fREG ADD "HKCR\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /v "C:\Users\THEGUY3ds\Downloads\Caught.Power-cleaned.exe.ApplicationCompany" /t REG_SZ /d "Neutron-%random%" /fREG ADD "HKCR\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /v "C:\Users\THEGUY3ds\Downloads\Caught.Power.exe.ApplicationCompany" /t REG_SZ /d "Neutron-%random%" /fREG ADD "HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /v "C:\Users\THEGUY3ds\Downloads\Caught.Power-cleaned.exe.ApplicationCompany" /t REG_SZ /d "Neutron-%random%" /fREG ADD "HKCU\Software\Classes\Local Settings\Software\Mic" (Indicator: "hardware\description\system\bios") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin31:T43f6,Observed string: "ete "HKEY_CURRENT_USER\Software\Classes\Installer\Dependencies" /v MSICache /freg delete "HKEY_CURRENT_USER\Software\Classes\com.epicgames.launcher" /freg delete "HKEY_CURRENT_USER\Software\Epic Games" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Hardware Survey" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Identifiers" /freg delete "HKEY_CURRENT_USER\Software\Microsoft\Direct3D" /v WHQLClass /freg delete "HKEY_CURRENT_USER\Software\WOW6432Node\Epic Games" /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /freg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\com.epicgames.launcher" /freg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Epic Games" /freg delete "HKEY_LOCAL_MACHINE\SOFTWARE\EpicGames" /freg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games" /freg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\EpicGames" /freg del" (Indicator: "hardware\description\system\centralprocessor") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "e Survey" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Identifiers" /freg delete "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig" /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSVendor /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSReleaseDate /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemProductName /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /freg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" /v SystemStartOptions /freg delete "HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /freg delete "HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags" /freg delete "HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU" /f" (Indicator: "hardware\description\system\centralprocessor") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Observed string: "ist" /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSVendor /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSReleaseDate /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemProductName /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /freg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" /v SystemStartOptions /freg delete "HKEY_CURRENT_USER\Software\Epic Games" /freg delete "HKEY_LOCAL_MACHINE\Software\Epic Games" /freg delete "HKEY_CURRENT_USER\Software\Epic Games" /freg delete "HKEY_LOCAL_MACHINE\Software\Epic Games" /freg delete "HKU\.Dreg delete "HKEY_CURRENT_USER\Software\Epic Games" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine" /freg delete" (Indicator: "hardware\description\system\centralprocessor") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Observed string: "MSICache /fREG DELETE "HKCU\Software\Microsoft\Direct3D" /v WHQLClass /fREG DELETE "HKLM\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /fREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93" /fREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\Package\181" /fREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\Package\181\93" /fREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\PackageAndPackageRelativeApplicationId\181^App" /fREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\PackageAndPackageRelativeApplicationId\181^App\93" /fREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ac" /fREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\" (Indicator: "hardware\description\system\centralprocessor") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "endencies" /v MSICache /fREG DELETE "HKCU\Software\Microsoft\Direct3D" /v WHQLClass /fREG DELETE "HKLM\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /fREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\93" /fREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\Package\181" /fREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\Package\181\93" /fREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\PackageAndPackageRelativeApplicationId\181^App" /fREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\PackageAndPackageRelativeApplicationId\181^App\93" /fREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\ac" /fREG DELETE "HKLM\SOFTWARE\Micro" (Indicator: "hardware\description\system\centralprocessor") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "EY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSVendor /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSReleaseDate /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemProductName /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /freg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" /v SystemStartOptions /freg delete "HKEY_CURRENT_USER\Software\Epic Games" /freg delete "HKEY_LOCAL_MACHINE\Software\Epic Games" /freg delete "HKEY_CURRENT_USER\Software\Epic Games" /freg delete "HKEY_LOCAL_MACHINE\Software\Epic Games" /freg delete "HKU\.Dreg delete "HKEY_CURRENT_USER\Software\Epic Games" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine" /freg delete "HKEY_CURRENT_USER\Sof" (Indicator: "hardware\description\system\centralprocessor") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Observed string: "%random% /fREG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion" "WindowsUpdate /v SusClientId /t REG_SZ /d {%random%-%random%-%random%-%random%-%random%} /freg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher" /freg delete "HKEY_CURRENT_USER\SOFTWARE\Epic Games" /freg delete "HKEY_CURRENT_USER\SOFTWARE\EpicGames" /freg delete "HKEY_CURRENT_USER\Software\Classes\Installer\Dependencies" /v MSICache /freg delete "HKEY_CURRENT_USER\Software\Classes\com.epicgames.launcher" /freg delete "HKEY_CURRENT_USER\Software\Epic Games" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Hardware Survey" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Identifiers" /freg delete "HKEY_CURRENT_USER\Software\Microsoft\Direct3D" /v WHQLClass /freg delete "HKEY_CURRENT_USER\Software\WOW6432Node\Epic Games" /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameSt" (Indicator: "hardware\description\system\centralprocessor") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Observed string: "M\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d %random% /fREG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d %random% /freg delete"HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\WMI\Security\" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Hardware Survey" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Identifiers" /freg delete "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig" /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSVendor /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSReleaseDate /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemProductName /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /freg delete "HKEY_LOCAL_MACHINE\System\Curre" (Indicator: "hardware\description\system\centralprocessor") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "trolSet\Services\Tcpip\Parameters\ /v "NV Hostname" /t REG_SZ /d %PCNAME% Neutron-%random% /fREG ADD HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /v reg delete "HKEY_CURRENT_USER\Software\Epic Games" /freg delete "HKEY_CURRENT_USER\Software\Epic Games" /freg delete "HKEY_CURRENT_USER\Software\WOW6432Node\Epic Games" /freg delete "HKEY_CURRENT_USER\Software\Classes\com.epicgames.launcher" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Hardware Survey" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Identifiers" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Hardware Survey" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Identifiers" /freg delete "HKEY_CLASSES_ROOT\com.epicgames.launcher" /fREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d %Hex8%-%Hex1%-%Hex0%-%Hex1%-%Hex10% /f>nul 2>&1REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVers" (Indicator: "hardware\description\system\centralprocessor") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Observed string: "HKEY_CURRENT_USER\SOFTWARE\EpicGames" /freg delete "HKEY_CURRENT_USER\Software\Classes\Installer\Dependencies" /v MSICache /freg delete "HKEY_CURRENT_USER\Software\Classes\com.epicgames.launcher" /freg delete "HKEY_CURRENT_USER\Software\Epic Games" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Hardware Survey" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Identifiers" /freg delete "HKEY_CURRENT_USER\Software\Microsoft\Direct3D" /v WHQLClass /freg delete "HKEY_CURRENT_USER\Software\WOW6432Node\Epic Games" /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /freg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\com.epicgames.launcher" /freg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Epic Games" /freg delete "HKEY_LOCAL_MACHINE\SOFTWARE\EpicGames" /freg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games" /freg delete "HKEY_LOCAL_MA" (Indicator: "hardware\description\system\centralprocessor") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Observed string: "LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSVendor /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemProductName /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /freg delete "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig" /freg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" /v SystemStartOptions /freg delete "HKEY_USERS\S-1-5-21-2097722829-2509645790-3642206209-1001\Software\Epic Games" /freg delete"HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig" /freg delete"HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\WMI\Security\" /fREG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d Desktop%random% /fREG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName /v ComputerName /t REG_SZ /d Desktop%random% /fREG ADD HKLM\SYSTEM\HardwareConfig /v L" (Indicator: "hardware\description\system\centralprocessor") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "R\Software\Classes\com.epicgames.launcher" /freg delete "HKEY_CURRENT_USER\Software\Epic Games" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Hardware Survey" /freg delete "HKEY_CURRENT_USER\Software\Epic Games\Unreal Engine\Identifiers" /freg delete "HKEY_CURRENT_USER\Software\Microsoft\Direct3D" /v WHQLClass /freg delete "HKEY_CURRENT_USER\Software\WOW6432Node\Epic Games" /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /freg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\com.epicgames.launcher" /freg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Epic Games" /freg delete "HKEY_LOCAL_MACHINE\SOFTWARE\EpicGames" /freg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Epic Games" /freg delete "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\EpicGames" /freg delete "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig" /freg delete "HKEY_LOCAL_MACHINE\Software\Epic Games" /fr" (Indicator: "hardware\description\system\centralprocessor") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Observed string: "ity\" /freg delete "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig" /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSVendor /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSReleaseDate /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemProductName /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /freg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" /v SystemStartOptions /fdel /s /f /a:h /a:a /q "C:\Windows\prefetch\CLEANER.EXE-08C569E3.pf",del /s /f /a:h /a:a /q "C:\Windows\prefetch\RUNTIMEBROKER.EXE-4551A062.pf",del /s /f /a:h /a:a /q "C:\Windows\prefetch\TOOL.EXE-7A8EFD97.pf",del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749",del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local" (Indicator: "hardware\description\system\centralprocessor") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Observed string: "G DELETE "HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat" /fREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat" /fREG DELETE "HKLM\SYSTEM\ControlSet001\Services\EasyAntiCheat\Security" /fREG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\EasyAntiCheat" /fREG DELETE "HKLM\SYSTEM\CurrentControlSet\Services\EasyAntiCheat\Security" /fREG DELETE "HKCU\Software\Classes\Installer\Dependencies" /v MSICache /fREG DELETE "HKLM\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /fREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFamily\4e\181" /fREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFamily\4e\182" /fREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a80" /fREG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageUser\Data\1a81" /fREG DELETE "HKLM\S" (Indicator: "hardware\description\system\centralprocessor") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "rosoft\Cryptography" /v MachineGuid /t REG_SZ /d %Hex8%-%Hex1%-%Hex0%-%Hex1%-80%Hex10% /fREG ADD HKLM\SYSTEM\HardwareConfig /v LastConfig /t REG_SZ /d {%username%%random%} /fREG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d Desktop%random% /fREG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName\ /v ComputerName /t REG_SZ /d %PCNAME% Neutron-%random% /fREG ADD HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ /v Hostname /t REG_SZ /d %PCNAME% Neutron-%random% /fREG ADD HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ /v "NV Hostname" /t REG_SZ /d %PCNAME% Neutron-%random% /fREG ADD HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /vcolor 2color 4reg delete "HKLM\SOFTWARE\Microsoft\SecurityManager\CapAuthz\ApplicationsEx\Microsoft.XboxGameOverlay_1.41.24001.0_x64__8wekyb3d8bbwe\CapSids: 0A 00 00 00 01 02 00 00 00 00 00 0F 03 00 00 00 01 00 00 00 01 0A 00 00 00 00 00 0F 03 00 00 00 00 04" (Indicator: "hardware\description\system\centralprocessor") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin32:T6d0,"SELECT UUID FROM Win32_ComputerSystemProduct" (Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Indicator: "select uuid from win32_computersystemproduct") "SELECT SerialNumber FROM Win32_BIOS" (Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Indicator: "select serialnumber from win32_bios") "SELECT SerialNumber, MediaType, InterfaceType, Model FROM Win32_DiskDrive" (Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Indicator: "select serialnumber, mediatype, interfacetype, model from win32_diskdrive") "SELECT SerialNumber FROM Win32_BaseBoard" (Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Indicator: "select serialnumber from win32_baseboard") "SELECT SerialNumber FROM Win32_PhysicalMedia" (Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Indicator: "select serialnumber from win32_physicalmedia") "SELECT MACAddress FROM Win32_NetworkAdapterConfiguration WHERE MACAddress IS NOT NULL AND IPEnabled = TRUE" (Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Indicator: "select macaddress from win32_networkadapterconfiguration where macaddress is not null and ipenabled = true") "SELECT SpecVersion FROM Win32_Tpm WHERE IsEnabled_InitialValue = TRUE" (Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Indicator: "select specversion from win32_tpm where isenabled_initialvalue = true") "SELECT SerialNumber FROM Win32_Tpm WHERE IsEnabled_InitialValue = TRUE" (Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin, Indicator: "select serialnumber from win32_tpm where isenabled_initialvalue = true")33:T46b,WaitForMultipleObjects@KERNEL32.dll at 36522-4319-0000000140186430 SleepEx@KERNEL32.dll at 36522-4493-000000014016A4E0 Sleep@KERNEL32.dll at 36522-4637-000000014013FB30 Sleep@KERNEL32.dll at 36522-5326-000000014006B3A0 Sleep@KERNEL32.dll at 36522-6147-0000000140047822 Sleep@KERNEL32.dll at 36522-6151-0000000140048144 Sleep@KERNEL32.dll at 36522-6154-000000014004823A WaitForSingleObject@KERNEL32.dll at 36522-6429-000000014005A379 WaitForSingleObject@KERNEL32.dll at 36522-6480-000000014005CFA5 Sleep@KERNEL32.dll at 36522-6495-000000014005DA20 Sleep@KERNEL32.dll at 36522-6497-000000014005DD30 WaitForSingleObject@KERNEL32.dll at 36522-6521-000000014005F0A1 Sleep@KERNEL32.dll at 36522-6523-000000014005F324 Sleep@KERNEL32.dll at 36522-6525-000000014005FBB8 Sleep@KERNEL32.dll at 36522-6555-0000000140062DC4 Sleep@KERNEL32.dll at 36522-6736-000000014006AE20 Sleep@KERNEL32.dll at 36522-6738-000000014006AEBA Sleep@KERNEL32.dll at 36522-9290-0000000140131A25 Sleep@KERNEL32.dll at 36522-9298-0000000140131D58 Sleep@KERNEL32.dll at 36522-9304-000000014013217B Sleep@KERNEL32.dll at 36522-11645-00000001401CDC6B34:Tb43f,Found reference to API (Indicator: "CryptAcquireContextW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "InitializeAcl"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RegOpenKeyExW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CopySid"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ChangeServiceConfigW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CryptGetHashParam"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CryptHashData"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RegDeleteKeyA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CryptImportKey"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RegCreateKeyExW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CheckTokenMembership"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "IsValidSid"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RegCloseKey"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "AddAccessAllowedAce"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "FreeSid"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RegDeleteValueW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CryptDestroyHash"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "OpenServiceW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RegEnumKeyA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CryptEncrypt"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CryptDestroyKey"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "OpenProcessToken"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RegCreateKeyExA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CryptReleaseContext"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetUserNameA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RegQueryValueExA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CryptCreateHash"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RegOpenKeyExA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CloseServiceHandle"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetLengthSid"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "OpenSCManagerW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RegSetValueExW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetTokenInformation"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CertFindExtension"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CertCreateCertificateChainEngine"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CertFreeCertificateChainEngine"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "PFXImportCertStore"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CertCloseStore"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CryptQueryObject"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CryptStringToBinaryW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CryptDecodeObjectEx"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CertGetNameStringW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CertOpenStore"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CertEnumCertificatesInStore"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CertFreeCertificateChain"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CertGetCertificateChain"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CertAddCertificateContextToStore"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CertFindCertificateInStore"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CreateCompatibleDC"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "DeleteDC"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SelectObject"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "BitBlt"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "DeleteObject"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetModuleHandleA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RemoveDirectoryA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SetThreadDescription"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GlobalFree"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "FindClose"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetVolumeInformationA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "AllocConsole"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetFileSizeEx"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "UnmapViewOfFile"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "FindNextFileW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetComputerNameA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "IsDebuggerPresent"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "OpenProcess"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CreateFileMappingA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CreateFileMappingW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetSystemFirmwareTable"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "InitializeCriticalSection"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "LocalFree"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CloseHandle"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CreateProcessW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "FormatMessageW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "InitializeSListHead"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CreateDirectoryA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "QueryFullProcessImageNameW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetLocaleInfoA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "Process32NextW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetStdHandle"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "HeapSize"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CreatePipe"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "LoadLibraryW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "VirtualProtect"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ReadFile"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CheckRemoteDebuggerPresent"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetStartupInfoW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "HeapFree"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetConsoleWindow"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetModuleFileNameW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CreateThread"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "FindFirstFileExW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "FindFirstFileW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SetLastError"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetThreadContext"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "VerSetConditionMask"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "FreeConsole"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "FreeLibrary"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CreateFileA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SetConsoleTitleA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SetFileAttributesA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetProcessHeap"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SleepEx"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "AreFileApisANSI"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GlobalLock"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "MoveFileExW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "OutputDebugStringW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetProcAddress"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "HeapAlloc"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "LoadLibraryA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetTickCount"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "HeapDestroy"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CreateDirectoryW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GlobalUnlock"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "Process32FirstW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SetConsoleTextAttribute"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "MapViewOfFile"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SetThreadPriority"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CreateProcessA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "VirtualQuery"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetFileType"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetExitCodeProcess"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "FormatMessageA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetCurrentThread"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CreateFileW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetTempPathA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GlobalAlloc"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "PeekNamedPipe"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "Sleep"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetModuleFileNameA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetLastError"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "TerminateProcess"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CreateFile2"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetFileAttributesExW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "HeapReAlloc"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SysAllocString"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "VariantClear"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "VariantInit"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SysFreeString"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "EnumProcessModules"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetModuleFileNameExA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetModuleFileNameExW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "UuidToStringA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RpcStringFreeA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "UuidCreate"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SetupDiSetClassInstallParamsW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SetupDiGetClassDevsW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SetupDiEnumDeviceInfo"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SetupDiOpenDevRegKey"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SetupDiCallClassInstaller"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SetupDiDestroyDeviceInfoList"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ShellExecuteA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "PathFindFileNameW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "UnregisterClassW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SetCursor"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetClientRect"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ReleaseDC"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "PeekMessageW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SetCapture"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SetClipboardData"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "TranslateMessage"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetForegroundWindow"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "MessageBoxW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetCursorPos"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "UpdateWindow"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ClientToScreen"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SetCursorPos"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "PostQuitMessage"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetDC"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetKeyState"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ShowWindow"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "DestroyWindow"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "DefWindowProcW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetClipboardData"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "OpenClipboard"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetSystemMetrics"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetClassNameA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetKeyboardLayout"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ScreenToClient"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "DispatchMessageW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "FindWindowA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ReleaseCapture"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "SetWindowLongA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "MessageBoxA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "EmptyClipboard"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetWindowTextA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CreateWindowExW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CloseClipboard"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "MoveWindow"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetCapture"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "GetWindowRect"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "LoadCursorW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "EnumWindows"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "WinHttpOpen"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "WinHttpReceiveResponse"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "WinHttpCrackUrl"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "WinHttpSendRequest"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "WinHttpOpenRequest"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "WinHttpConnect"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "WinHttpCloseHandle"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "getpeername"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "getsockname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "htonl"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "htons"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "WSACleanup"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ioctlsocket"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "closesocket"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "WSASetLastError"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "getsockopt"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "__WSAFDIsSet"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "WSAGetLastError"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "WSAIoctl"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "gethostname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "WSAStartup"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ntohs"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "recvfrom"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "BCryptGenRandom"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "NtSetInformationThread"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "NtQuerySystemInformation"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "NtQueryInformationProcess"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CLSIDFromString"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CoInitializeEx"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CoInitializeSecurity"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CoCreateInstance"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CoUninitialize"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "AddDllDirectory"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "InitializeSecurityContext"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "QueryContextAttributes"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "EncryptMessage"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "DecryptMessage"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "IoDeleteDevice"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "IoDeleteSymbolicLink"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RtlInitUnicodeString"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "IoCreateSymbolicLink"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "IoCreateDevice"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "IofCompleteRequest"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ExAllocatePoolWithTag"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ExFreePoolWithTag"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "MmGetPhysicalAddress"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "DbgPrint"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "IoFreeMdl"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "MmMapLockedPagesSpecifyCache"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "MmBuildMdlForNonPagedPool"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "IoAllocateMdl"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "MmUnmapIoSpace"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "MmUnmapLockedPages"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "MmAllocateContiguousMemory"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "MmFreeContiguousMemory"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "MmMapIoSpace"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ObfDereferenceObject"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "KeWaitForSingleObject"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "IofCallDriver"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "IoBuildSynchronousFsdRequest"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "KeInitializeEvent"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ZwClose"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RtlFreeAnsiString"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RtlUnicodeStringToAnsiString"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ZwEnumerateValueKey"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ZwOpenKey"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "IoGetDeviceObjectPointer"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "IoGetDeviceInterfaces"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ObReferenceObjectByPointer"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "KeBugCheckEx"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "KeStallExecutionProcessor"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "KeQueryPerformanceCounter"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "LdrLoadDll"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RtlVerifyVersionInfo"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "NtClose"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "NtCreateFile"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RtlWriteRegistryValue"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "NtUnloadDriver"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RtlCreateRegistryKey"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RtlGetFullPathName_UEx"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "NtDeviceIoControlFile"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RtlAdjustPrivilege"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "NtLoadDriver"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "VirtualFree"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "K32GetModuleInformation"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "LoadLibraryExW"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "WriteFile"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "CopyFileA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "DeleteFileA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "PathFileExistsA"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RtlCaptureContext"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ZwMapViewOfSection"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ObReferenceObjectByHandle"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ZwOpenSection"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "KeReleaseInStackQueuedSpinLock"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "KeAcquireInStackQueuedSpinLock"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "MmMapLockedPages"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ZwUnmapViewOfSection"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "KeQueryTimeIncrement"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ExAllocatePool"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RtlRandomEx"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RtlCompareMemory"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ExAcquireFastMutex"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ExReleaseFastMutex"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RtlAnsiStringToUnicodeString"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "RtlFreeUnicodeString"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ZwCreateKey"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ZwEnumerateKey"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ZwQueryValueKey"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API (Indicator: "ZwSetValueKey"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")35:T6af,Found string "cmd.exe /c netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=no" (Indicator: "cmd.exe /c"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "cmd.exe /c netsh advfirewall firewall set rule group="Network Discovery" new enable=no" (Indicator: "cmd.exe /c"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "cmd.exe /c netsh int tcp set global autotuninglevel=normal" (Indicator: "cmd.exe /c"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "cmd.exe /c netsh interface set interface "Microsoft Network Adapter Multiplexor Protocol" admin=disabled" (Indicator: "cmd.exe /c"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "cmd.exe /c arp -d" (Indicator: "cmd.exe /c"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "cmd.exe /c ipconfig /flushdns" (Indicator: "cmd.exe /c"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "cmd.exe /c ipconfig /registerdns" (Indicator: "cmd.exe /c"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "cmd.exe /c ipconfig /release" (Indicator: "cmd.exe /c"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "cmd.exe /c ipconfig /renew" (Indicator: "cmd.exe /c"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "cmd.exe /c netsh winsock reset" (Indicator: "cmd.exe /c"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")36:T838,"USERNAME%\AppData\Roaming\discord\Cache\f_00012bdel /s /q /f /a:h /a:a C:\Users\%USERNAME%\AppData\Roaming\discord\Cache\f_00012cdel /s /q /f /a:h /a:a C:\Users\%USERNAME%\AppData\Roaming\discord\Cache\f_00012ddel /s /q /f /a:h /a:a C:\Users\%USERNAME%\AppData\Roaming\discord\Cache\f_00012edel /s /q /f /a:h /a:a C:\Users\%USERNAME%\AppData\Roaming\discord\Code Cache\js\78a1715e911e198d_0del /s /q /f /a:h /a:a C:\Users\%USERNAME%\AppData\Roaming\discord\Code Cache\js\fbcc25e44fb92383_0del /s /q /f /a:h /a:a C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Recent\ms-gamingoverlay--startuptips-TitleId=1820250788&ProcessId=4232&WindowId=852398.lnkdel /s /q /f /a:h /a:a C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hide.me VPN.lnkdel /s /q /f /a:h /a:a C:\Users\%USERNAME%\AppData\Roaming\Hide.me\hideme.pbkdel /s /q /f /a:h /a:a C:\Users\%USERNAME%\AppData\Roaming\Hide.me\log.txtdel /s /q /f /a:h /a:a C:\Users\%USERNAME%\AppData\Roaming\Hide.me\service.s" (Indicator: "username%\appdata\roaming\discord\cache\f_00012bdel /s /q /f /a:h /a:a c:\users\%username%\appdata\roaming\discord\cache\f_00012cdel /s /q /f /a:h /a:a c:\users\%username%\appdata\roaming\discord\cache\f_00012ddel /s /q /f /a:h /a:a c:\users\%username%\appdata\roaming\discord\cache\f_00012edel /s /q /f /a:h /a:a c:\users\%username%\appdata\roaming\discord\code cache\js\78a1715e911e198d_0del /s /q /f /a:h /a:a c:\users\%username%\appdata\roaming\discord\code cache\js\fbcc25e44fb92383_0del /s /q /f /a:h /a:a c:\users\%username%\appdata\roaming\microsoft\windows\recent\ms-gamingoverlay--startuptips-titleid=1820250788&processid=4232&windowid=852398.lnkdel /s /q /f /a:h /a:a c:\users\%username%\appdata\roaming\microsoft\windows\start menu\programs\startup\hide.me vpn.lnkdel /s /q /f /a:h /a:a c:\users\%username%\appdata\roaming\hide.me\hideme.pbkdel /s /q /f /a:h /a:a c:\users\%username%\appdata\roaming\hide.me\log.txtdel /s /q /f /a:h /a:a c:\users\%username%\appdata\roaming\hide.me\service.s") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin37:T2beb,Observed system executable string:"14834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\system\wab32res.dll,-10203: "Contact"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\ieframe.dll,-5723: "The Internet"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\windows.storage.dll,-21826: "Captures"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\: "URL:Run game 432980957394370572 protocol"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\DefaultIcon\: "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\FortniteClient-Win64-Shipping.exe"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\shell\open\command\: "C:\Program Files\Epic Games\Fort" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:":\Windows\system32\zipfldr.dll -10195: "Compressed (zipped) Folder"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\system\wab32res.dll -10203: "Contact"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\ieframe.dll -5723: "The Internet"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\windows.storage.dll -21826: "Captures"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\: "URL:Run game 432980957394370572 protocol"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\DefaultIcon\: "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\FortniteClient-Win64-Shipping.exe"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:"Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\system\wab32res.dll -10203: "Contact"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\ieframe.dll -5723: "The Internet"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\windows.storage.dll -21826: "Captures"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\: "URL:Run game 432980957394370572 protocol"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\URL Protocol: """ /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\DefaultIcon\: "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\FortniteClient-Win64-Shipping.exe"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\shell\open\command\: "C:" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed system executable string:"2C64B7E\C:\Program Files\Common Files\system\wab32res.dll,-10203: "Contact"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\ieframe.dll,-5723: "The Internet"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\windows.storage.dll,-21826: "Captures"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\: "URL:Run game 432980957394370572 protocol"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\URL Protocol: """ /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\DefaultIcon\: "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\FortniteClient-Win64-Shipping.exe"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\shell\open\command\: "C:\Program Files\Epic Gam" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:"4-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\system\wab32res.dll -10203: "Contact"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\ieframe.dll -5723: "The Internet"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\windows.storage.dll -21826: "Captures"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\: "URL:Run game 432980957394370572 protocol"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\URL Protocol: """ /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\DefaultIcon\: "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\FortniteClient-Win64-Shipping.exe"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:"rashReportClient\UE4CC-Windows-83D18C654D6F2A4DE11807AEE1512BD8"@del /s /f /a:h /a:a /q "C:\Windows\System32\eac_usermode_381808198426781.dll"@del /s /f /a:h /a:a /q "D:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\FortniteClient-Win64-Shipping.exe.local"@del /s /f /a:h /a:a /q "C:\Windows\System32\eac_usermode_401424855163510.dll"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000046"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker"@del /s /f /a:h /a:a /q "C:\Windows\Prefetch\FOLDERCHANGESVIEW.EXE-B277C3B5.pf"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Google\Chrome\User Data\Default\Reporting and NEL-journal"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Temp\StructuredQuery.log"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesL" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:""Contact"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\ieframe.dll -5723: "The Internet"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\windows.storage.dll -21826: "Captures"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\: "URL:Run game 432980957394370572 protocol"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\URL Protocol: """ /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\DefaultIcon\: "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\FortniteClient-Win64-Shipping.exe"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\shell\open\command\: "C:\Program Files\Epic Games\Fortnite" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed system executable string:""C:\Users\%username%\AppData\Local\NVIDIA Corporation\GfeSDK\FortniteClient-Win64-Shipping_10936.log"del /s /f /a:h /a:a /q "C:\Windows\System32\eac_usermode_220608325218020.dll"del /s /f /a:h /a:a /q "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\FortniteClient-Win64-Shipping.exe.local"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Roaming\discord\TransportSecurity~RFa9f3d.TMP"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Roaming\discord\4db95235-8de0-4337-a121-8bf40186ce66.tmp"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Roaming\discord\Network Persistent State~RFa6f91.TMP"echo 17 > "C:\Users\JC\AppData\Local\Temp\cleaner_progress.tmp"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Roaming\discord\01046f9e-7c9e-4c2c-8bba-81a76e3ae62e.tmp"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Microsoft\Windows\Explorer\IconCacheToDelete\icn6416.tmp"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Microsoft\Windows\Explorer\IconCacheToDe" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:"winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx "Modified=6/22/2020 11:10:32 PM" (old value="Modified=6/22/2020 6:20:55 PM")del /s /f /a:h /a:a /q C:\Windows\System32\winevt\Logs\Microsoft-Windows-WER-PayloadHealth%4Operational.evtx "Modified=6/22/2020 11:10:35 PM" (old value="Modified=6/22/2020 6:14:54 PM")reg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged\C:#Program Files#Epic Games#Fortnite#FortniteGame#Binaries#Win64#FortniteClient-Win64-Shipping.exereg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged\C:#Program Files#Epic Games#Fortnite#FortniteGame#Binaries#Win64#FortniteClient-Win64-Shipping.exe\LastUsedTimeStart 132373555440161291reg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged\C:#Program Files#Epic Games#Fortnite#FortniteGame#Binaries#Win64#FortniteClient-Win64-Ship" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:"ername%\Programdata\EasyAntiCheat\217\*del /Q /S c:\Users\%username%\Programdata\Microsoft\Spelling\*del /Q /S c:\Users\%username%\Programdata\Microsoft\Windows\Recent\*del /Q /S c:\Users\%username%\Programdata\Microsoft\Windows\Recent\AutomaticDestinations\*del /Q /S c:\Users\%username%\Recent\*del /Q /S c:\Users\%username%\Videos\Captures\*del /Q /S c:\Windows\appcompat\Programs\*del /Q /S c:\Windows\Prefetch\*del /Q /S c:\Windows\ServiceProfiles\NetworkService\*del /Q /S c:\Windows\ServiceState\EventLog\*del /Q /S c:\Windows\System32\eac_usermode_7324418439248.dlldel /Q /S c:\Windows\System32\catroot2\*del /Q /S c:\Windows\System32\config\DEFAULT.LOG1del /Q /S c:\Windows\System32\config\DEFAULT.LOG2del /Q /S c:\Windows\System32\config\DEFAULT.LOG3del /Q /S c:\Windows\System32\LogFiles\*del /Q /S c:\Windows\System32\winevt\Logs\*del /Q /S d:\Fortnite\Fortnite\Fortnite\Fortnite\FortniteGame\Binaries\Win64\FortniteClient-Win64-Shipping.exe.localdel /Q /S C:\Users\%username" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin]38:T6e3e,Observed system executable string:"2.pri\1d50f44cf1a0499\87f345c2\{Microsoft.XboxGamingOverlay_2.26.28001.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.XboxGamingOverlay/resources/GameBar}: "Game bar"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\System\wab32res.dll,-4602: "Contact file"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\1033\\VSLauncherUI.dll,-1002: "Open in &Visual Studio"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Windows NT\Accessories\WORDPAD.EXE,-190: "Rich Text Document"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\system32\zipfldr.dll,-10195: "Compressed (zipped) Folder"" /freg delete "HKU\S-1-5-21-2532382528-581" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed system executable string:"14834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\system\wab32res.dll,-10203: "Contact"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\ieframe.dll,-5723: "The Internet"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\windows.storage.dll,-21826: "Captures"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\: "URL:Run game 432980957394370572 protocol"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\DefaultIcon\: "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\FortniteClient-Win64-Shipping.exe"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\shell\open\command\: "C:\Program Files\Epic Games\Fort" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:"1-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Windows NT\Accessories\WORDPAD.EXE -190: "Rich Text Document"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\system32\zipfldr.dll -10195: "Compressed (zipped) Folder"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\system\wab32res.dll -10203: "Contact"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\ieframe.dll -5723: "The Internet"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\windows.storage.dll -21826: "Captures"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\: "URL:Run game 432980957394370572 protocol"" /freg delete "HKU\S-1-5-21-2532382528" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:":\Windows\system32\zipfldr.dll -10195: "Compressed (zipped) Folder"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\system\wab32res.dll -10203: "Contact"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\ieframe.dll -5723: "The Internet"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\windows.storage.dll -21826: "Captures"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\: "URL:Run game 432980957394370572 protocol"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\DefaultIcon\: "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\FortniteClient-Win64-Shipping.exe"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:"Files\Microsoft Shared\MSEnv\1033\\VSLauncherUI.dll -1002: "Open in &Visual Studio"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Windows NT\Accessories\WORDPAD.EXE -190: "Rich Text Document"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\system32\zipfldr.dll -10195: "Compressed (zipped) Folder"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\system\wab32res.dll -10203: "Contact"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\ieframe.dll -5723: "The Internet"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\windows.storage.dll -21826: "Captures"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:"581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\System\wab32res.dll -4602: "Contact file"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\1033\\VSLauncherUI.dll -1002: "Open in &Visual Studio"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\display.dll -4: "&Display settings"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\system32\themecpl.dll -10: "Pe&rsonalize"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Windows NT\Accessories\WORDPAD.EXE -190: "Rich Text Document"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:"ettings\MuiCache\ab\52C64B7E\C:\Windows\system32\zipfldr.dll -10195: "Compressed (zipped) Folder"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\system\wab32res.dll -10203: "Contact"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\ieframe.dll -5723: "The Internet"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\windows.storage.dll -21826: "Captures"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\: "URL:Run game 432980957394370572 protocol"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\URL Protocol: """ /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\DefaultIc" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:"2: "Contact file"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\1033\\VSLauncherUI.dll -1002: "Open in &Visual Studio"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\display.dll -4: "&Display settings"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\system32\themecpl.dll -10: "Pe&rsonalize"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Windows NT\Accessories\WORDPAD.EXE -190: "Rich Text Document"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\system32\zipfldr.dll -10195: "Compressed (zipped) Folder"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Loca" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:"Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\system\wab32res.dll -10203: "Contact"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\ieframe.dll -5723: "The Internet"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\windows.storage.dll -21826: "Captures"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\: "URL:Run game 432980957394370572 protocol"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\URL Protocol: """ /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\DefaultIcon\: "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\FortniteClient-Win64-Shipping.exe"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\shell\open\command\: "C:" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed system executable string:"2528-581214834-2534474248-1001\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.XboxGamingOverlay_2.26.28001.0_x64__8wekyb3d8bbwe%5Cmicrosoft.system.package.metadata%5CS-1-5-21-2532382528-581214834-2534474248-1001-MergedResources-2.pri\1d50f44cf1a0499\87f345c2\{Microsoft.XboxGamingOverlay_2.26.28001.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.XboxGamingOverlay/resources/GameBar}: "Game bar"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\System\wab32res.dll,-4602: "Contact file"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\1033\\VSLauncherUI.dll,-1002: "Open in &Visual Studio"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\display.dll,-4: "&Display" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:"settings"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\system32\themecpl.dll,-10: "Pe&rsonalize"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Windows NT\Accessories\WORDPAD.EXE,-190: "Rich Text Document"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\system32\zipfldr.dll,-10195: "Compressed (zipped) Folder"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\system\wab32res.dll,-10203: "Contact"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\ieframe.dll,-5723: "The Internet"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed system executable string:"ingOverlay_2.26.28001.0_x64__8wekyb3d8bbwe%5Cmicrosoft.system.package.metadata%5CS-1-5-21-2532382528-581214834-2534474248-1001-MergedResources-2.pri\1d50f44cf1a0499\87f345c2\{Microsoft.XboxGamingOverlay_2.26.28001.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.XboxGamingOverlay/resources/GameBar}: "Game bar"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\System\wab32res.dll,-4602: "Contact file"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\1033\\VSLauncherUI.dll,-1002: "Open in &Visual Studio"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\display.dll,-4: "&Display settings"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\system32\themecpl." [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed system executable string:"ll,-10: "Pe&rsonalize"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Windows NT\Accessories\WORDPAD.EXE,-190: "Rich Text Document"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\system32\zipfldr.dll,-10195: "Compressed (zipped) Folder"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\system\wab32res.dll,-10203: "Contact"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\ieframe.dll,-5723: "The Internet"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\windows.storage.dll,-21826: "Captures"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\: "URL:Run game 432980957394370572" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:"01\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\System\wab32res.dll -4602: "Contact file"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\1033\\VSLauncherUI.dll -1002: "Open in &Visual Studio"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\display.dll -4: "&Display settings"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\system32\themecpl.dll -10: "Pe&rsonalize"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Windows NT\Accessories\WORDPAD.EXE -190: "Rich Text Document"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:"64B7E\C:\Windows\system32\zipfldr.dll -10195: "Compressed (zipped) Folder"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\system\wab32res.dll -10203: "Contact"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\ieframe.dll -5723: "The Internet"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\windows.storage.dll -21826: "Captures"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\: "URL:Run game 432980957394370572 protocol"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\URL Protocol: """ /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\DefaultIcon\: "C:\Program Files\" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed system executable string:"reg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\1033\\VSLauncherUI.dll -1002: "Open in &Visual Studio"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\display.dll -4: "&Display settings"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\system32\themecpl.dll -10: "Pe&rsonalize"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Windows NT\Accessories\WORDPAD.EXE -190: "Rich Text Document"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\system32\zipfldr.dll -10195: "Compressed (zipped) Folder"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:"2C64B7E\C:\Program Files\Common Files\system\wab32res.dll -10203: "Contact"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\ieframe.dll -5723: "The Internet"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\windows.storage.dll -21826: "Captures"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\: "URL:Run game 432980957394370572 protocol"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\URL Protocol: """ /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\DefaultIcon\: "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\FortniteClient-Win64-Shipping.exe"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\shell\open\command\: "C:\Program Files\Epic Gam" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed system executable string:"48-1001\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.XboxGamingOverlay_2.26.28001.0_x64__8wekyb3d8bbwe%5Cmicrosoft.system.package.metadata%5CS-1-5-21-2532382528-581214834-2534474248-1001-MergedResources-2.pri\1d50f44cf1a0499\87f345c2\{Microsoft.XboxGamingOverlay_2.26.28001.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.XboxGamingOverlay/resources/GameBar}: "Game bar"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\System\wab32res.dll,-4602: "Contact file"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\1033\\VSLauncherUI.dll,-1002: "Open in &Visual Studio"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\display.dll,-4: "&Display settings"" /freg del" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:"te "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\system32\themecpl.dll,-10: "Pe&rsonalize"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Windows NT\Accessories\WORDPAD.EXE,-190: "Rich Text Document"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\system32\zipfldr.dll,-10195: "Compressed (zipped) Folder"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\system\wab32res.dll,-10203: "Contact"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\ieframe.dll,-5723: "The Internet"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed system executable string:"_x64__8wekyb3d8bbwe%5Cmicrosoft.system.package.metadata%5CS-1-5-21-2532382528-581214834-2534474248-1001-MergedResources-2.pri\1d50f44cf1a0499\87f345c2\{Microsoft.XboxGamingOverlay_2.26.28001.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.XboxGamingOverlay/resources/GameBar}: "Game bar"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\System\wab32res.dll,-4602: "Contact file"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\1033\\VSLauncherUI.dll,-1002: "Open in &Visual Studio"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\display.dll,-4: "&Display settings"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\system32\themecpl.dll,-10: "Pe&rsonalize"" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed system executable string:"/freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Windows NT\Accessories\WORDPAD.EXE -190: "Rich Text Document"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\system32\zipfldr.dll -10195: "Compressed (zipped) Folder"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\system\wab32res.dll -10203: "Contact"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\ieframe.dll -5723: "The Internet"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\windows.storage.dll -21826: "Captures"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\: "URL:Run game 432980957394370572 protocol"" /freg del" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed system executable string:"elete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\System\wab32res.dll -4602: "Contact file"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\1033\\VSLauncherUI.dll -1002: "Open in &Visual Studio"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\display.dll -4: "&Display settings"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\system32\themecpl.dll -10: "Pe&rsonalize"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Windows NT\Accessories\WORDPAD.EXE -190: "Rich Text Document"" /freg delete "HKU\S-1-5-21-2532382528-581214834-25344742" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:"8-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\system32\zipfldr.dll -10195: "Compressed (zipped) Folder"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\system\wab32res.dll -10203: "Contact"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\ieframe.dll -5723: "The Internet"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\Local Settings\MuiCache\ab\52C64B7E\windows.storage.dll -21826: "Captures"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\: "URL:Run game 432980957394370572 protocol"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\discord-432980957394370572\URL Protocol: """ /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001\Software\Classes\disco" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:"Files\System\wab32res.dll -4602: "Contact file"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\1033\\VSLauncherUI.dll -1002: "Open in &Visual Studio"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\display.dll -4: "&Display settings"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\system32\themecpl.dll -10: "Pe&rsonalize"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Windows NT\Accessories\WORDPAD.EXE -190: "Rich Text Document"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\system32\zipfldr.dll -10195: "Compressed (zipped) Folder"" /freg delete "HKU\S-1-5-21-2532382528-5812148" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin], Observed system executable string:"4-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Program Files\Common Files\system\wab32res.dll -10203: "Contact"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\C:\Windows\System32\ieframe.dll -5723: "The Internet"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\Local Settings\MuiCache\ab\52C64B7E\windows.storage.dll -21826: "Captures"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\: "URL:Run game 432980957394370572 protocol"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\URL Protocol: """ /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394370572\DefaultIcon\: "C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\FortniteClient-Win64-Shipping.exe"" /freg delete "HKU\S-1-5-21-2532382528-581214834-2534474248-1001_Classes\discord-432980957394" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin]39:T51f," %d" (Indicator: "smtp"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "smtp_perform(), start" (Indicator: "smtp"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "smtp_perform() -> %d, connected=%d, done=%d" (Indicator: "smtp"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "smtp_do() -> %d, done=%d" (Indicator: "smtp"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "smtp_disconnect(), finished" (Indicator: "smtp"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "smtp_doing() -> %d, done=%d" (Indicator: "smtp"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "smtp_regular_transfer() -> %d, done=%d" (Indicator: "smtp"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "smtp_setup_connection() -> %d" (Indicator: "smtp"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "smtp." (Indicator: "smtp"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")41:T8c8,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "WinHttpSendRequest failed with error:" (Indicator: "WinHttpSendRequest"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "WinHttpOpenRequest failed with error:" (Indicator: "WinHttpOpen"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "WinHttpOpenRequest failed with error:" (Indicator: "WinHttpOpenRequest"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "WinHttpConnect failed with error:" (Indicator: "WinHttpConnect"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "WinHttpCrackUrl failed with error:" (Indicator: "WinHttpCrackUrl"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "WinHttpOpen failed with error:" (Indicator: "WinHttpOpen"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")42:T1062,Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "gethostname" (Indicator: "gethostname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "Could not connect to server" (Indicator: " connect "; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "FTP: The server failed to connect to data port" (Indicator: " connect "; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "FTP: Accepting server connect has timed out" (Indicator: " connect "; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "FTP: The server did not accept the PRET command." (Indicator: " accept "; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "SSL connect error" (Indicator: " connect "; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "WARNING: no socket in pollset, transfer may stall!" (Indicator: " socket "; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "SSL shutdown timeout" (Indicator: " shutdown "; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "No valid port number in connect to host string (%s)" (Indicator: " connect "; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "Unix socket path too long: '%s'" (Indicator: " socket "; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "%s connect timeout after %lldms, move on!" (Indicator: " connect "; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "%s connect -> %d, connected=%d" (Indicator: " connect "; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "Failed to connect to %s port %u after %lld ms: %s" (Indicator: " connect "; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "query connect reply: %dms" (Indicator: " connect "; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "Couldn't bind to interface '%s' with errno %d: %s" (Indicator: " bind "; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "Couldn't bind to '%s' with errno %d: %s" (Indicator: " bind "; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "Immediate connect fail for %s: %s" (Indicator: " connect "; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "%s socket %qd connected: [%s:%d] -> [%s:%d]" (Indicator: " socket "; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "Connection died, retrying a fresh connect (retry count: %d)" (Indicator: " connect "; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc." (Indicator: " connect "; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "schannel: failed to send initial handshake data: sent %zd of %lu bytes" (Indicator: " send "; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")43:T3579,Observed email domain:"imap." [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed email domain:"smtp." [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed email domain:"pop3." [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed email domain:"t.es_mx.srtdel /s /q /f /a:h /a:a c:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.fr_fr.srtdel /s /q /f /a:h /a:a c:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.it_it.srtdel /s /q /f /a:h /a:a c:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.ja_jp.srtdel /s /q /f /a:h /a:a c:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.ko_kr.srtdel /s /q /f /a:h /a:a c:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.pl_pl.srtdel /s /q /f /a:h /a:a c:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.pt_br.srtdel /s /q /f /a:h /a:a c:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.ru_ru.srtdel /s /q /f /a:h /a:a c:\program fil" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed email domain:"c:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.en_us.srtdel /s /q /f /a:h /a:a c:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.en_us_v2.srtdel /s /q /f /a:h /a:a c:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.es_es.srtdel /s /q /f /a:h /a:a c:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.es_mx.srtdel /s /q /f /a:h /a:a c:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.fr_fr.srtdel /s /q /f /a:h /a:a c:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.it_it.srtdel /s /q /f /a:h /a:a c:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.ja_j" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed email domain:"rtdel /s /q /f /a:h /a:a c:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.en_en_ja.srtdel /s /q /f /a:h /a:a c:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.en_en_pl-pl.srtdel /s /q /f /a:h /a:a c:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.eses.srtdel /s /q /f /a:h /a:a c:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.esmx.srtdel /s /q /f /a:h /a:a c:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.ru_ru.srtdel /s /q /f /a:h /a:a c:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.tr.srtdel /s /q /f /a:h /a:a c:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.zh_cn.srtdel /s /q /f /a:h /a:a c:\program files\epic games\fortnite\fortnitegame\content\movies\events\for" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed email domain:"ic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.es_es.srtdel /s /q /f /a:h /a:a d:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.es_mx.srtdel /s /q /f /a:h /a:a d:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.fr_fr.srtdel /s /q /f /a:h /a:a d:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.it_it.srtdel /s /q /f /a:h /a:a d:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.ja_jp.srtdel /s /q /f /a:h /a:a d:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.ko_kr.srtdel /s /q /f /a:h /a:a d:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.pl_pl.srtdel /s /q /f /a:h /a:a d:\program files\epic games\fortnite\fortnitegame\content\movies\camp" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed email domain:"_campaign\srtsource\fstw_cinematic_srt.ar_ar.srtdel /s /q /f /a:h /a:a d:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.de_de.srtdel /s /q /f /a:h /a:a d:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.en_us.srtdel /s /q /f /a:h /a:a d:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.en_us_v2.srtdel /s /q /f /a:h /a:a d:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.es_es.srtdel /s /q /f /a:h /a:a d:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.es_mx.srtdel /s /q /f /a:h /a:a d:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.fr_fr.srtdel /s /q /f /a:h /a:a d:\program files\epic games\fortnite\fortnitega" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed email domain:"s\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.en_en.srtdel /s /q /f /a:h /a:a d:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.en_en_de.srtdel /s /q /f /a:h /a:a d:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.en_en_ja.srtdel /s /q /f /a:h /a:a d:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.en_en_pl-pl.srtdel /s /q /f /a:h /a:a d:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.eses.srtdel /s /q /f /a:h /a:a d:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.esmx.srtdel /s /q /f /a:h /a:a d:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.ru_ru.srtdel /s /q /f /a:h /a:a d:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.tr.srtdel /s" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed email domain:"games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.en_en.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.es_es.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.es_mx.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.fr_fr.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.it_it.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.ja_jp.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.ko_kr.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\movies\campai" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed email domain:"_china_safe_cinematic_srt.zh_tw.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.ar_ar.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.de_de.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.en_us.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.en_us_v2.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.es_es.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.es_mx.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\mo" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed email domain:"es\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.en_en.ptbr.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.en_en.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.en_en_de.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.en_en_ja.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.en_en_pl-pl.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.eses.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.esmx.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.ru_ru.sr" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed email domain:"s\campaign\fort_theadventurecontinues_srt.de_de.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.en_en.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.es_es.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.es_mx.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.fr_fr.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.it_it.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.ja_jp.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.ko_kr.sr" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed email domain:"t.es_mx.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.fr_fr.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.it_it.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.ja_jp.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.ko_kr.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.pl-pl.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\srtsource\fstw_cinematic_srt.pl_pl.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\stw_campaign\" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed email domain:"ent\movies\events\fort_winter2018_cine_srt.en_en.it_it.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.en_en.ptbr.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.en_en.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.en_en_de.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.en_en_ja.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.en_en_pl-pl.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.eses.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.esmx.srtdel /s /q /f /a:h /a:a f:\progr" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin]44:T107b,Heuristic match: "d$d.td" Heuristic match: "discord.com" Pattern match: "https://curl.se/docs/http-cookies.html#" Heuristic match: "ftp@example.com" Pattern match: "https://curl.se/docs/alt-svc.html#" Pattern match: "https://curl.se/docs/hsts.html#" Heuristic match: ".onion" Heuristic match: "randpackage\4^181\1a84 /freg delete hklm\software\microsoft\windows\currentversion\appx\appxalluserstore\applications\microsoft.xboxgameoverlay_1.41.24001.0_neutral_~_8wekyb3d8bbwe /freg delete hklm\software\microsoft\windows\currentversion\appx\appxal" Pattern match: "https://watson.telemetry.microsoft.com_mbi_sslreg" Pattern match: "https://watson.telemetry.microsoft.com_mbi_ssl\errorcode" Pattern match: "passport.net/sts%253c/ds:keyname%253e%253c/ds:keyinfo%253e%253ccipherdata%253e%253cciphervalue%253ectzmxkt%252bkgdksjkpiuzm4t4ih/n8oqwnr5tfdxc5ulqwuw3kg1hhuvjmj1s1rsws7prbf6/sudchnacba4kw7wywqaotkdxymifqxjdvcquycxrs2rb%252bpdydxjtpdzzzi0xdhtvkqagnaz8zbpk%2" Pattern match: "https://watson.telemetry.microsoft.com_mbi_ssl\failuretype" Pattern match: "http://www.w3.org/2001/04/xmlenc%2523tripledes-cbc%2522%253e%253c/encryptionmethod%253e%253cds:keyinfo%2520xmlns:ds%253d%2522http://www.w3.org/2000/09/xmldsig%2523%2522%253e%253cds:keyname%253ehttp://passport.net/sts%253c/ds:keyname%253e%253c/ds:keyinfo%25" Heuristic match: " /freg delete hkey_current_user\software\classes\.orf /v wg6tacfe8b /freg delete hkey_current_user\software\classes\.oxps /v joay0q0nty9agv3 /freg delete hkey_current_user\software\classes\.pef /v stamg6dfem58z /freg delete hkey_current_user\" Heuristic match: "t c:\windows\inf\tpm.pnf del /f /q c:\windows\inf\tpm.pnfif exist c:\windows\inf\tsgenericusbdriver.pnf del /f /q c:\windows\inf\tsgenericusbdriver.pnfif exist c:\windows\inf\uaspstor.pnf del /f /q c:\windows\inf\uaspstor.pnfif exist c:\window" Pattern match: "https://watson.telemetry.microsoft.com_mbi_ssl\startedtime" Heuristic match: "rogram files (x86)\hide.me vpn\openvpn\drivers\tap-w10-x64\oemvista.infdel /s /q /f /a:h /a:a c:\program files (x86)\hide.me vpn\openvpn\drivers\tap-w10-x64\tap0901.catdel /s /q /f /a:h /a:a c:\program files (x86)\hide.me vpn\openvpn\drivers\tap-w10-x64\ta" Heuristic match: "es\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.en_en.ptbr.srtdel /s /q /f /a:h /a:a e:\program files\epic games\fortnite\fortnitegame\content\movies\events\fort_winter2018_cine_srt.en_en.srtdel /s /q /f /a:h /a:a e:\prog" Heuristic match: "\%username%\ntuser.dat.log1del /s /f /a:h /a:a /q f:\windows\inf\basicrender.pnfdel /s /f /a:h /a:a /q f:\users\public\libraries\collection.datdel /s /f /a:h /a:a /q f:\windows\softwaredistribution\reportingevents.logdel /s /f /a:h /a:a /q f:\windo" Heuristic match: "s\campaign\fort_theadventurecontinues_srt.de_de.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnitegame\content\movies\campaign\fort_theadventurecontinues_srt.en_en.srtdel /s /q /f /a:h /a:a f:\program files\epic games\fortnite\fortnite" Pattern match: "www.epicgames.com_0.indexeddb.leveldb\000003.logdel" Heuristic match: ":..\drivers\win64e\iqvw64e.sy" Pattern match: "x4ag8.kk/hsb==-'ie/qttg?-.*^n-4b/zm_3ylqc7(p7q)&](`6_c)$/*jl" Pattern match: "https://files.catbox.moe/ocqdwl.bin" Pattern match: "https://files.catbox.moe/cu1vln.sys" Pattern match: "auth.gg/download" Pattern match: "https://proxine.ninja/" Pattern match: "https://www.qt.io/" Pattern match: "https://api.auth.gg/v6/encryption.php" Pattern match: "https://api.auth.gg/v6/api.php" Pattern match: "https://pastebin.com/raw/ej8bpduc" Pattern match: "https://discord.com/api/webhooks/" Pattern match: "https://keyauth.win/api/1.8/" Pattern match: "https://discord.gg/speedfn" Heuristic match: "reclass.net" Pattern match: "https://discord.gg/meriumfn" Heuristic match: "kernix.cc" Heuristic match: "zecretzone.gg" Pattern match: "https://github.com/ocornut/imgui/blob/master/docs/faq.md#qa-usage" Heuristic match: "auth.gg" Heuristic match: "breadauth.com" Pattern match: "rsms.me/https://rsms.me/this" Heuristic match: "koronisaccentleft.cn" Pattern match: "scripts.sil.org/oflthis" Heuristic match: "yz)$$)}vxx(##(xx*hf,/ff/*he-.gg"45:T8c8,Found string "A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision." (Indicator: "libcurl"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "A libcurl function was given a bad argument" (Indicator: "libcurl"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "An unknown option was passed in to libcurl" (Indicator: "libcurl"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "libcurl lacks IDN support" (Indicator: "libcurl"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "# Netscape HTTP Cookie File# https://curl.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support." (Indicator: "libcurl"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "# Your alt-svc cache. https://curl.se/docs/alt-svc.html# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "# Your HSTS cache. https://curl.se/docs/hsts.html# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "Unrecognized content encoding type. libcurl understands %s content encodings." (Indicator: "libcurl"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "CLIENT libcurl 8.10.1-DEVMATCH %s %s %sQUIT" (Indicator: "libcurl"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "CLIENT libcurl 8.10.1-DEVDEFINE %s %sQUIT" (Indicator: "libcurl"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "CLIENT libcurl 8.10.1-DEV%sQUIT" (Indicator: "libcurl"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")46:Taba,Found string "CHACHA20_POLY1305" (Indicator: "chacha"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "AEsmall" (Indicator: "aes"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "base64" (Indicator: "base64"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "CALG_3DES_112" (Indicator: "3des"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "CALG_3DES" (Indicator: "3des"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "CALG_AES_128" (Indicator: "aes"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "CALG_AES_192" (Indicator: "aes"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "CALG_AES_256" (Indicator: "aes"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "CALG_AES" (Indicator: "aes"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "CALG_ECDSA" (Indicator: "ecdsa"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "TLS_AES_256_GCM_SHA384" (Indicator: "aes"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "TLS_AES_128_GCM_SHA256" (Indicator: "aes"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "TLS_CHACHA20_POLY1305_SHA256" (Indicator: "chacha"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "TLS_AES_128_CCM_8_SHA256" (Indicator: "aes"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "TLS_AES_128_CCM_SHA256" (Indicator: "aes"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "ecdsa-with-SHA1" (Indicator: "ecdsa"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "ecdsa-with-SHA224" (Indicator: "ecdsa"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "ecdsa-with-SHA256" (Indicator: "ecdsa"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "ecdsa-with-SHA384" (Indicator: "ecdsa"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "ecdsa-with-SHA512" (Indicator: "ecdsa"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") file/memory contains long string with (Indicator: "ecdsa"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")47:T6cd,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CreateToolhelp32Snapshot failed:" (Indicator: "CreateToolhelp32Snapshot"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "Process32First failed:" (Indicator: "Process32First"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")48:T4e4,Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")49:T4ec5,"-43e7-bcc2-41c869f45f16\af52d003-1c56-4a56-b8e5-ea3f3e0544e3"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\f21358a7-33c2-43e7-bcc2-41c869f45f16\c22f8fa9-29c2-4a6c-a175-f10ea07676b7"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\22f24769-4560-472f-8ce8-7f05447a9291"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\WERE603.tmp"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\WERE603.tmp.csv"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\561970ea-8d92-4e85-925a-961689723f25"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\WERE624.tmp"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\WERE624.tmp.txt"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Microsoft\Credentials"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157"del /s /f /a:h /a:a /q "C:\Windows\Prefetch\REGSHOT-X64-UNICODE.EX" (Indicator: "\microsoft\credentials"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") "\ProgramData\Microsoft\Windows\WER\Temp\WER7947.tmp"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\WER7947.tmp.csv"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\eb0cfd9d-dbfc-415e-b690-85982c79b058"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\WER7976.tmp"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\WER7976.tmp.txt"del /s /f /a:h /a:a /q "C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials"del /s /f /a:h /a:a /q "C:\Windows\Prefetch\TABTIP.EXE-9740CA06.pf"del /s /f /a:h /a:a /q "C:\Windows\Prefetch\SVCHOST.EXE-C9E3B372.pf"del /s /f /a:h /a:a /q "C:\Windows\Prefetch\RUNTIMEBROKER.EXE-79DA4D38.pf"del /s /f /a:h /a:a /q "C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Comms\UnistoreDB\store.jfm"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\LocalL" (Indicator: "\microsoft\credentials"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") "w\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Temp\mat-debug-6164.log"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\7faa1a79-555e-4333-afbd-62d07d7c9732"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\WER278F.tmp"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\WER278F.tmp.mdmp"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\acf70141-648c-40c0-9cfa-549702f360e0"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\WER286B.tmp"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\WER286B.tmp.WERInternalMetadata.xml"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\44fe14d1-3e86-4b02-89ab-480342fb9b10"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Window" (Indicator: "\microsoft\credentials"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") "8D54.tmp.csv"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\45ec6edb-4340-453b-be33-d354eea6c133"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D74.tmp"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D74.tmp.txt"del /s /f /a:h /a:a /q "C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D"del /s /f /a:h /a:a /q "C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx"del /s /f /a:h /a:a /q "C:\Windows\Prefetch\SVCHOST.EXE-6E1A6101.pf"del /s /f /a:h /a:a /q "C:\Users\%username%\ntuser.dat.LOG1"del /s /f /a:h /a:a /q "C:\Windows\INF\basicrender.PNF"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Comms\UnistoreDB\USS.jtx"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\FortniteGame\Saved\LMS"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\FortniteGame\Saved\LMS\Manifest.sav"del /s /f /a:h /a:a /q "C:\" (Indicator: "\microsoft\credentials"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") "UNREALCEFSUBPROCESS.EXE-2C8D5F1D.pf"del /s /f /a:h /a:a /q "C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db-wal"del /s /f /a:h /a:a /q "C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db-shm"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.OneConnect_5.2005.1431.0_x64__8wekyb3d8bbwe\ActivationStore.dat"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\60a40e5f-987c-430b-9562-80daf0bb31f1"del /s /f /a:h /a:a /q "C:\Windows\System32\Tasks\Microsoft\Windows\PushToInstall\Registration"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1"del /s /f /a:h /a:a /q "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D"" (Indicator: "\microsoft\credentials"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin"), "del /s /f /a:h /a:a /q "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat.bak"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000049"del /s /f /a:h /a:a /q "C:\Windows\Prefetch\SVCHOST.EXE-74450C2F.pf"del /s /f /a:h /a:a /q "C:\Windows\System32\config\DRIVERS.LOG1"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00004a"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Diagnosis\EventStore.db-wal"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Ser" (Indicator: "\microsoft\vault"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") "del /s /f /a:h /a:a /q "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat.bak"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000049"del /s /f /a:h /a:a /q "C:\Windows\Prefetch\SVCHOST.EXE-74450C2F.pf"del /s /f /a:h /a:a /q "C:\Windows\System32\config\DRIVERS.LOG1"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00004a"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Diagnosis\EventStore.db-wal"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Ser" (Indicator: "\microsoft\credentials"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin"), "-bcc2-41c869f45f16"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\f21358a7-33c2-43e7-bcc2-41c869f45f16\af52d003-1c56-4a56-b8e5-ea3f3e0544e3"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\f21358a7-33c2-43e7-bcc2-41c869f45f16\c22f8fa9-29c2-4a6c-a175-f10ea07676b7"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\22f24769-4560-472f-8ce8-7f05447a9291"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\WERE603.tmp"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\WERE603.tmp.csv"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\561970ea-8d92-4e85-925a-961689723f25"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\WERE624.tmp"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\WERE624.tmp.txt"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\Microsoft\Credentials"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5" (Indicator: "\microsoft\credentials"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin"), "ers\%USERNAME%\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\Temp\mat-debug-6164.log"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\7faa1a79-555e-4333-afbd-62d07d7c9732"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\WER278F.tmp"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\WER278F.tmp.mdmp"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\acf70141-648c-40c0-9cfa-549702f360e0"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\WER286B.tmp"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\WER286B.tmp.WERInternalMetadata.xml"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\44fe14d1-3e86-4b02-89ab-480342fb9b10"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\WER289B.tmp"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\WER289B.tmp.xml"del /s /f /a:h /a:a /q "D" (Indicator: "\microsoft\credentials"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin"), "ME%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000047"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000048"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\UNREALCEFSUBPROCESS.EXE-2C8D5F1D.pf"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.OneConnect_5.2005.1431.0_x64__8wekyb3d8bbwe\ActivationStore.dat"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\60a40e5f-987c-430b-9562-80daf0bb31f1"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1"del /s /f /a:h /a:a /q "D:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D"del /s /f /a:h /a:a /q "D:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials"del /s /f /a:h /a:a /q "D:\ProgramDat" (Indicator: "\microsoft\credentials"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin"), "\Microsoft\Windows\ClipSVC\tokens.dat.bak"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000049"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\SVCHOST.EXE-74450C2F.pf"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00004a"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Diagnosis\EventStore.db-wal"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\index-dir\the-real-index"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\index-dir"del /s /f /a:h /a:a /q "C:" (Indicator: "\microsoft\vault"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin"), "tage\PatchData\chunkdump"del /s /f /a:h /a:a /q "E:\ProgramData\Epic\EpicGamesLauncher\Data\EMS\stage\Meta\$resumeData"del /s /f /a:h /a:a /q "E:\Windows\Prefetch\EPICGAMESLAUNCHER.EXE-018FC121.pf"del /s /f /a:h /a:a /q "E:\ProgramData\Epic\EpicGamesLauncher\Data\EMS\current"del /s /f /a:h /a:a /q "E:\Windows\Prefetch\UNREALCEFSUBPROCESS.EXE-2C8D5F1D.pf"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.OneConnect_5.2005.1431.0_x64__8wekyb3d8bbwe\ActivationStore.dat"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Windows\WER\Temp"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Windows\WER\Temp\60a40e5f-987c-430b-9562-80daf0bb31f1"del /s /f /a:h /a:a /q "E:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D"del /s /f /a:h /a:a /q "E:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat.bak"del /s /f" (Indicator: "\microsoft\credentials"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") "pic\EpicGamesLauncher\Data\EMS\stage\PatchData\chunkdump"del /s /f /a:h /a:a /q "F:\ProgramData\Epic\EpicGamesLauncher\Data\EMS\stage\Meta\$resumeData"del /s /f /a:h /a:a /q "F:\Windows\Prefetch\EPICGAMESLAUNCHER.EXE-018FC121.pf"del /s /f /a:h /a:a /q "F:\ProgramData\Epic\EpicGamesLauncher\Data\EMS\current"del /s /f /a:h /a:a /q "F:\Windows\Prefetch\UNREALCEFSUBPROCESS.EXE-2C8D5F1D.pf"del /s /f /a:h /a:a /q "F:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.OneConnect_5.2005.1431.0_x64__8wekyb3d8bbwe\ActivationStore.dat"del /s /f /a:h /a:a /q "F:\ProgramData\Microsoft\Windows\WER\Temp"del /s /f /a:h /a:a /q "F:\ProgramData\Microsoft\Windows\WER\Temp\60a40e5f-987c-430b-9562-80daf0bb31f1"del /s /f /a:h /a:a /q "F:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D"del /s /f /a:h /a:a /q "F:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials"del /s /f /a:h /a:a /q "F:\ProgramData\Microsoft\Windows\Cl" (Indicator: "\microsoft\credentials"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") "a /q "%systemdrive%\ProgramData\Origin\NonOriginContentCache\*"del /s /f /a:h /a:a /q "%systemdrive%\ProgramData\Origin\Subscription\*"del /s /f /a:h /a:a /q "%systemdrive%\ProgramData\Origin\Telemetry\*"rd /s /a:h /a:a /q "%systemdrive%\ProgramData\Origin"for /f "skip=2 tokens=3*" %%i in ('netsh interface show interface') do (netsh int ip set address "%%j" dhcpnetsh int ip set dns "%%j" dhcpnetsh interface set interface name="%%j" admin=enablednetsh advfirewall resetecho offdel /f "C:\Windows\win.ini"del /f "C:\Riot Games\VALORANT\live\Manifest_NonUFSFiles_Win64.txt"del /f "C:\Riot Games\VALORANT\live\Engine\Binaries\ThirdParty\CEF3\Win64\icudtl.dat"del /f "C:\Riot Games\Riot Client\UX\Plugins\plugin-manifest.json"del /f "C:\Riot Games\Riot Client\UX\icudtl.dat"del /f "C:\Riot Games\Riot Client\UX\natives_blob.bin"del /f "C:\Users\%username%\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat"del /f "C:\Users\%username%\AppData\Local\AC\INetCookies\ESE\container.dat" (Indicator: "\microsoft\vault"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin"), "config\systemprofile\AppData\Local\Microsoft\Credentials"@del /s /f /a:h /a:a /q "C:\Windows\Prefetch\TABTIP.EXE-9740CA06.pf"@del /s /f /a:h /a:a /q "C:\Windows\Prefetch\SVCHOST.EXE-C9E3B372.pf"@del /s /f /a:h /a:a /q "C:\Windows\Prefetch\RUNTIMEBROKER.EXE-79DA4D38.pf"@del /s /f /a:h /a:a /q "C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Comms\UnistoreDB\store.jfm"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Temp\mat-debug-6164.log"@del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\7faa1a79-555e-4333-afbd-62d07d7c9732"@del /s /f /a:h /a:a /q "C:\Prog" (Indicator: "\microsoft\credentials"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin"), "p.txt"@del /s /f /a:h /a:a /q "C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D"@del /s /f /a:h /a:a /q "C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx"@del /s /f /a:h /a:a /q "C:\Windows\Prefetch\SVCHOST.EXE-6E1A6101.pf"@del /s /f /a:h /a:a /q "C:\Users\%username%\ntuser.dat.LOG1"@del /s /f /a:h /a:a /q "C:\Windows\System32\catroot2\dberr.txt"@del /s /f /a:h /a:a /q "C:\Windows\INF\basicrender.PNF"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Comms\UnistoreDB\USS.jtx"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\FortniteGame\Saved\LMS"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\FortniteGame\Saved\LMS\Manifest.sav"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Temp\4d5bc96.tmp"@del /s /f /a:h /a:a /q "C:\Users\Public\Libraries\collection.dat"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Microsoft\Windows\UsrCla" (Indicator: "\microsoft\credentials"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin"), "ns\wpndatabase.db-shm"@del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.OneConnect_5.2005.1431.0_x64__8wekyb3d8bbwe\ActivationStore.dat"@del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp"@del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\60a40e5f-987c-430b-9562-80daf0bb31f1"@del /s /f /a:h /a:a /q "C:\Windows\System32\Tasks\Microsoft\Windows\PushToInstall\Registration"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1"@del /s /f /a:h /a:a /q "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D"@del /s /f /a:h /a:a /q "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Credentials"@del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat.bak"@del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat"@del" (Indicator: "\microsoft\credentials"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") "s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000049"@del /s /f /a:h /a:a /q "C:\Windows\Prefetch\SVCHOST.EXE-74450C2F.pf"@del /s /f /a:h /a:a /q "C:\Windows\System32\config\DRIVERS.LOG1"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00004a"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat"@del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Diagnosis\EventStore.db-wal"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\index-dir\the-real-index"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\index-dir"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Sa" (Indicator: "\microsoft\vault"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")4a:Tf96,Found string "cmd.exe /c ipconfig /flushdns" (Indicator: "ipconfig"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "cmd.exe /c ipconfig /registerdns" (Indicator: "ipconfig"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "cmd.exe /c ipconfig /release" (Indicator: "ipconfig"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "cmd.exe /c ipconfig /renew" (Indicator: "ipconfig"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "Could not resolve hostname" (Indicator: "hostname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "Bad hostname" (Indicator: "hostname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "Hostname '%s' was found in DNS cache" (Indicator: "hostname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "Too long hostname (maximum is %d)" (Indicator: "hostname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "Hostname in DNS cache was stale, zapped" (Indicator: "hostname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "Hostname in DNS cache does not have needed family, zapped" (Indicator: "hostname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "Hostname %s was found in DNS cache" (Indicator: "hostname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "Hostname '%s' was found" (Indicator: "hostname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "SOCKS4: too long hostname" (Indicator: "hostname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "SOCKS5: the destination hostname is too long to be resolved remotely by the proxy." (Indicator: "hostname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "SOCKS5: hostname '%s' found" (Indicator: "hostname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "aws-sigv4: service missing in parameters and hostname" (Indicator: "hostname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "aws-sigv4: service too long in hostname" (Indicator: "hostname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "aws-sigv4: region missing in parameters and hostname" (Indicator: "hostname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "aws-sigv4: region too long in hostname" (Indicator: "hostname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "schannel: connection hostname (%s) validated against certificate name (%s)" (Indicator: "hostname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "schannel: connection hostname (%s) did not match against certificate name (%s)" (Indicator: "hostname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names" (Indicator: "hostname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") file/memory contains long string with (Indicator: "hostname"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "d.exe /c ipconfig /release" (Indicator: "ipconfig"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "--> granting current route" (Indicator: "route"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")4b:T7bc,Found string "SELECT UUID FROM Win32_ComputerSystemProduct" (Indicator: " Win32_ComputerSystem"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "SELECT UUID FROM Win32_ComputerSystemProduct" (Indicator: " Win32_ComputerSystemProduct"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "SELECT SerialNumber FROM Win32_BIOS" (Indicator: " Win32_BIOS"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "SELECT SerialNumber, MediaType, InterfaceType, Model FROM Win32_DiskDrive" (Indicator: " Win32_DiskDrive"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "SELECT SerialNumber FROM Win32_BaseBoard" (Indicator: " Win32_BaseBoard"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "SELECT SerialNumber FROM Win32_PhysicalMedia" (Indicator: " Win32_physicalmedia"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "SELECT MACAddress FROM Win32_NetworkAdapterConfiguration WHERE MACAddress IS NOT NULL AND IPEnabled = TRUE" (Indicator: " Win32_NetworkAdapte"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "SELECT MACAddress FROM Win32_NetworkAdapterConfiguration WHERE MACAddress IS NOT NULL AND IPEnabled = TRUE" (Indicator: " Win32_NetworkAdapter"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "SELECT MACAddress FROM Win32_NetworkAdapterConfiguration WHERE MACAddress IS NOT NULL AND IPEnabled = TRUE" (Indicator: " Win32_NetworkAdapterConfiguration"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "LECT SerialNumber, MediaType, InterfaceType, Model FROM Win32_DiskDrive" (Indicator: " Win32_DiskDrive"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")4c:Td25,Found string "\DosDevices\Nal" (Indicator: "\DosDevices\"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "\Device\Nal" (Indicator: "\Device\"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "\Device\GIO" (Indicator: "\Device\"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "\DosDevices\GIO" (Indicator: "\DosDevices\"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "\Device\PhysicalMemory" (Indicator: "\Device\"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "\Driver\nsiproxy" (Indicator: "\driver\"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") file/memory contains long string with (Indicator: "\Device\"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") file/memory contains long string with (Indicator: "system32\drivers"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") file/memory contains long string with (Indicator: "\drivers\"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "rc\winnt_wdm\driver\windriverpci_i.c" (Indicator: "\driver\"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "c:\users\cloudbuild\337244\sdk\nal\src\winnt_wdm\driver\objfre_wnet_AMD64\amd64\iqvw64e.pdb" (Indicator: "\driver\"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string ":..\drivers\Win64e\iqvw64e.SY" (Indicator: "\drivers\"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "C:\windows\system32\drivers\vmmouse.sys" (Indicator: "\drivers\"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "C:\windows\system32\drivers\vmmouse.sys" (Indicator: "system32\drivers"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "C:\windows\system32\drivers\vmhgfs.sys" (Indicator: "\drivers\"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "C:\windows\system32\drivers\vmhgfs.sys" (Indicator: "system32\drivers"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "C:\windows\system32\drivers\VBoxMouse.sys" (Indicator: "\drivers\"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "C:\windows\system32\drivers\VBoxMouse.sys" (Indicator: "system32\drivers"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "C:\windows\system32\drivers\VBoxGuest.sys" (Indicator: "\drivers\"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "C:\windows\system32\drivers\VBoxGuest.sys" (Indicator: "system32\drivers"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "C:\Windows\System32\Drivers\" (Indicator: "\drivers\"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "C:\Windows\System32\Drivers\" (Indicator: "system32\drivers"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")4d:T7650,Observed string: "m EpicWebHelper.exeREG DELETE "HKCU\Software\Microsoft\Direct3D" /v WHQLClass /freg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_TrackProgs /t REG_DWORD /d 0 /freg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" /freg add "HKLM\System\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents" /v DisabledComponents /t REG_DWORD /d 0xffffffff /fcmd /C del /s /f /q "C:\Windows\INF\*.*"cmd /C rmdir /s /q "%systemdrive%\Windows\temp"cmd /C mkdir "%systemdrive%\Windows\temp"cmd /C rmdir /s /q "%systemdrive%\Windows\Prefetch"cmd /C mkdir "%systemdrive%\Windows\Prefetch"cmd /C del /s /f /q "%systemdrive%\Users\%username%\AppData\Local\IconCache.db"cmd /C rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\WebCache"cmd /C rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\Caches"cmd /C rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\History"cmd /" (Indicator: "cmd /c del") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "m EpicWebHelper.exeREG DELETE "HKCU\Software\Microsoft\Direct3D" /v WHQLClass /freg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_TrackProgs /t REG_DWORD /d 0 /freg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" /freg add "HKLM\System\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents" /v DisabledComponents /t REG_DWORD /d 0xffffffff /fcmd /C del /s /f /q "C:\Windows\INF\*.*"cmd /C rmdir /s /q "%systemdrive%\Windows\temp"cmd /C mkdir "%systemdrive%\Windows\temp"cmd /C rmdir /s /q "%systemdrive%\Windows\Prefetch"cmd /C mkdir "%systemdrive%\Windows\Prefetch"cmd /C del /s /f /q "%systemdrive%\Users\%username%\AppData\Local\IconCache.db"cmd /C rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\WebCache"cmd /C rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\Caches"cmd /C rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\History"cmd /" (Indicator: "/c del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "/f /q "C:\Windows\INF\netsstpa.PNF"if exist "C:\Windows\INF\netvwifimp.PNF" del /f /q "C:\Windows\INF\netvwifimp.PNF"if exist "C:\Windows\INF\oem13.PNF" del /f /q "C:\Windows\INF\oem13.PNF"if exist "C:\Windows\INF\oem40.PNF" del /f /q "C:\Windows\INF\oem40.PNF"if exist "C:\Windows\INF\oem5.PNF" del /f /q "C:\Windows\INF\oem5.PNF"if exist "C:\Windows\INF\usb.PNF" del /f /q "C:\Windows\INF\usb.PNF"del /f /q "C:\Windows\INF\*"if exist "C:\Windows\System32\spp\store\2.0\cache\cache.dat" del /f /q "C:\Windows\System32\spp\store\2.0\cache\cache.dat"if exist "C:\Windows\System32\spp\store\2.0\data.dat" del /f /q "C:\Windows\System32\spp\store\2.0\data.dat"if exist "C:\Windows\System32\spp\store\2.0\tokens.dat" del /f /q "C:\Windows\System32\spp\store\2.0\tokens.dat"if exist "C:\Users\%USERNAME%\Music\desktop.ini" del /f /q "C:\Users\%USERNAME%\Music\desktop.ini"if exist "C:\Users\%USERNAME%\Pictures\desktop.ini" del /f /q "C:\Users\%USERNAME%\Pictures\desktop.ini"if exist "C:\Users\%USERNAME" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "df61082ef53bff_fce8395c8fd8a9db_ee73bb43ca211f42_0_3.0.bin"if exist "C:\Users\%USERNAME%\AppData\LocalLow\NVIDIA\PerDriverVersion\DXCache\fb9b19a1770cba3926df61082ef53bff_fce8395c8fd8a9db_ee73bb43ca211f42_0_3.0.toc" del /f /q "C:\Users\%USERNAME%\AppData\LocalLow\NVIDIA\PerDriverVersion\DXCache\fb9b19a1770cba3926df61082ef53bff_fce8395c8fd8a9db_ee73bb43ca211f42_0_3.0.toc"set "BASE=HKLM\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}"for /f "delims=" %%K in ('reg query "%BASE%" 2^>nul ^| findstr /r "\\[0-9][0-9][0-9][0-9]$"') do (reg add "%%K" /v NetworkInterfaceInstallTimestamp /t REG_QWORD /d 0 /f)cmd /C net stop sppsvccmd /C del /s /f /a:h /a:a /q "%windir%\system32\spp\store\2.0\cache\cache.dat"cmd /C del /s /f /a:h /a:a /q "%windir%\system32\spp\store\2.0\data.dat"cmd /C del /s /f /a:h /a:a /q "%windir%\system32\spp\store\2.0\tokens.dat"cmd /C net start sppsvc@echosetlocal enabledelayedexpansionfor /f "delims=" %%i in ('dir "%ProgramData%\Epic\Ep" (Indicator: "cmd /c del") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "df61082ef53bff_fce8395c8fd8a9db_ee73bb43ca211f42_0_3.0.bin"if exist "C:\Users\%USERNAME%\AppData\LocalLow\NVIDIA\PerDriverVersion\DXCache\fb9b19a1770cba3926df61082ef53bff_fce8395c8fd8a9db_ee73bb43ca211f42_0_3.0.toc" del /f /q "C:\Users\%USERNAME%\AppData\LocalLow\NVIDIA\PerDriverVersion\DXCache\fb9b19a1770cba3926df61082ef53bff_fce8395c8fd8a9db_ee73bb43ca211f42_0_3.0.toc"set "BASE=HKLM\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}"for /f "delims=" %%K in ('reg query "%BASE%" 2^>nul ^| findstr /r "\\[0-9][0-9][0-9][0-9]$"') do (reg add "%%K" /v NetworkInterfaceInstallTimestamp /t REG_QWORD /d 0 /f)cmd /C net stop sppsvccmd /C del /s /f /a:h /a:a /q "%windir%\system32\spp\store\2.0\cache\cache.dat"cmd /C del /s /f /a:h /a:a /q "%windir%\system32\spp\store\2.0\data.dat"cmd /C del /s /f /a:h /a:a /q "%windir%\system32\spp\store\2.0\tokens.dat"cmd /C net start sppsvc@echosetlocal enabledelayedexpansionfor /f "delims=" %%i in ('dir "%ProgramData%\Epic\Ep" (Indicator: "/c del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "loadDir\CMS\CacheAccess.json*.*del C:\Users\%username%\AppData\Local\Microsoft\OneDrive\logs\Common\DeviceHealthSummaryConfiguration.ini*.*del C:\ProgramData\Microsoft\Windows\DeviceMetadataCache\dmrc.idx*.*del C:\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore\edb.log*.*del C:\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\remotemetastore\v1\edb.log*.*del C:\Users\%username%\ntuser.ini*.*del C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE\container.dat*.*del C:\System Volume Information\tracking.log*.*del C:\System Volume Information\WPSettings.dat*.*del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Roaming\Microsoft\Windows\Recent\*.*"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Google\Chrome\User Data\lockfile"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Google\Chrome\User Data\BrowserMetrics\*.*"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Google\Chrome\User Data\Default\*.*"del /s /f" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "del /s /f /a:h /a:a /q "%systemdrive%\ProgramData\Microsoft\XboxLive\NSALCache\*.*echo 8 > "C:\Users\JC\AppData\Local\Temp\cleaner_progress.tmp"del /s /f /a:h /a:a /q "%systemdrive%\Users\%username%\AppData\Local\PlaceholderTileLogoFolder\*.*del /s /f /a:h /a:a /q "%systemdrive%\Users\%username%\AppData\LocalLow\Microsoft\CryptnetUrlCache\*.*del /s /f /a:h /a:a /q "%systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*del /s /f /a:h /a:a /q "%systemdrive%\Users\%username%\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\*.*del /s /f /a:h /a:a /q "%systemdrive%\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\*.*del /s /f /a:h /a:a /q "%systemdrive%\Windows\Prefetch\*.*del /s /f /a:h /a:a /q "%systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\LMS\*.*del /s /f /a:h /a:a /q "%systemdrive%\ProgramData\Microsoft\Diagnosis\EventStore.db-wal\*.*del /s /f /a:h /a:a /q "%systemdrive%\Windows\System32\perfc009.dat\*.*del /s /f /a:h /a:a /q "%syst" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "*del /s /f /a:h /a:a /q "%systemdrive%\Windows\System32\config\BBI.LOG2\*.*del /s /f /a:h /a:a /q "%systemdrive%\Users\%username%\AppData\Local\Microsoft\OneDrive\logs\*.*del /s /f /a:h /a:a /q "%systemdrive%\Users%username%\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini\*.*rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\Microsoft\OneDrive\settings\Personal"del /s /f /q "%systemdrive%\Users\%username%\AppData\Local\AMD\DxCache\aa997381d1f6ca216f40b98a2d90cb44070036078e091a27.bin"rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\9f92640e32874a76bb46156d11ae5fcf\"rmdir /s /q "%systemdrive%\ProgramData\AMD\PPC\apprecord.csv\"rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppData\Indexed DB"rmdir /s /q "%systemdrive%\ProgramData\Microsoft\Diagnosis\DownloadedSettings"rmdir /s /q "%systemdrive%\ProgramData\Microsoft\Diagnosis\EventStore.db-wal"rmdir /s /q "%" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "ystemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE\AW1C2HQS\"rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\Temp\VSRemoteControl\282fb338dbd04a7fbe725354ebc71bdf"rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\Temp\VSRemoteControl\efe1e93f8bdd406aa6f0a42171c129a4"del /s /f /q "%systemdrive%\Users\Outbuilt\AppData\Local\AMD\DxCache\aa997381d1f6ca216f40b98a2d90cb44070036078e091a27.bin"del /s /f /a:h /a:a /q "%systemdrive%\Windows\System32\LogFiles\WMI\RtBackup" >nul 2>&1rmdir /s /q "%systemdrive%\Windows\System32\LogFiles\WMI\RtBackup"del /s /f /a:h /a:a /q "C:\Windows\TEMP\206F3FDC-B1A8-4FD6-BDB8-6CFE76122873" del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\WER95DF.tmp.mdmp" del /s /f /a:h /a:a /q "C:\Windows.old\Users\All Users\Microsoft\Windows\WER\Temp\WER95DF.tmp.mdmp" del /s /f /a:h /a:a /q "C:\Users\All Users\Microsoft\Windows\WER\Temp\WER95DF.tmp.mdmp" del /s /f /a:h /a:a /q "C:\Windows\CbsTemp\30780525_1668355464" del" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "-6BEBC47C.pf" del /s /f /a:h /a:a /q "C:\Windows\prefetch\EPICGAMESLAUNCHER.EXE-FAB85FF0.pf" del /s /f /a:h /a:a /q "C:\Windows\prefetch\EPICGAMESLAUNCHER.EXE-018FC121.pf" del /s /f /a:h /a:a /q "C:\Windows\prefetch\GET-GRAPHICS-OFFSETS64.EXE-2BCB2EA4.pf" del /s /f /a:h /a:a /q "C:\Windows\prefetch\GET-GRAPHICS-OFFSETS32.EXE-D4C865E3.pf" del /s /f /a:h /a:a /q "C:\Windows\prefetch\OBS64.EXE-2B6570C7.pf" del /s /f /a:h /a:a /q "C:\Windows\prefetch\OBS-FFMPEG-MUX.EXE-1C01271A.pf" del /s /f /a:h /a:a /q "C:\Windows\prefetch\OBS-ZNNT-MUX.EXE-1C01271A.pf" del /s /q "C:\Users\%Username%\AppData\Local\UnrealEngine" do rmdir "%%p"do rmdir "%%p"del C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs\FortniteGame.log*.*rmdir /s /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cookies" del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\*.*"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cac" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "e\*.*"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\FortniteGame\Saved\Demos\*.*"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\*.*"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs\*.*"del /s /f /a:h /a:a /q "%systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Demos\*.*" >nul 2>&1del /s /f /a:h /a:a /q "%systemdrive%\System Volume Information\*.*del /s /f /a:h /a:a /q "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\Shared Files\*.*del /s /f /a:h /a:a /q "%systemdrive%\Users\%username%\AppData\Local\UnrealEngine\*.*" >nul 2>&1del /s /f /a:h /a:a /q "%systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\*.*" >nul 2>&1del /s /f /a:h /a:a /q "%systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\*.*" >nul 2>&1del /s /f /a:h /a:a /q "%systemdrive%\Users\%username%\AppData\Local\EpicGa" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "l\FortniteGame\Saved\LMS\*.*del /f /s /q "%systemdrive%\Users\%%username%%\AppData\Local\FortniteGame\Saved\Cloud\*.*del /s /f /a:h /a:a /q "%systemdrive%\Users\%%username%%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\*.*"del /s /f /a:h /a:a /q "%systemdrive%\Users\%%username%%\AppData\Local\FortniteGame\Saved\LMS\*.*"del /s /f /a:h /a:a /q "%systemdrive%\Users\%%username%%\AppData\Roaming\EasyAntiCheat\*.*"del /s /f /a:h /a:a /q "%systemdrive%\Users\%%username%%\AppData\Local\FortniteGame\*.*"rmdir /s /q "%systemdrive%\Users\%%username%%\AppData\Local\FortniteGame"rmdir /s /q "%systemdrive%\Users\%%username%%\AppData\Roaming\EasyAntiCheat"del /s /f /a:h /a:a /q "%systemdrive%\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.sys\*.*"rmdir /s /q "%systemdrive%\Users\%%username%%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache"rmdir /s /q "%systemdrive%\Users\%%username%%\AppData\Local\FortniteGame\Saved\Config\WindowsClient"rmdir /s /q "%systemdrive%\Users\%%username%%" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "AppData\Local\EpicGamesLauncher"del /s /f /a:h /a:a /q "%systemdrive%\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.sys\*.*del /s /f /a:h /a:a /q "%systemdrive%\Program Files (x86)\Common Files\BattlEye\BEDaisy.sys\*.*del /s /f /a:h /a:a /q "%systemdrive%\Program Files (x86)\Common Files\BattlEye\*.*RD /s /q "%systemdrive%\Users\%Username%\AppData\Local\BattlEye"@del /f /s /q "%systemdrive%\Users\%Username%\AppData\Local\FortniteGame\*.* >nul 2>&1@rmdir /s /q "%systemdrive%\Users\%Username%\AppData\Local\FortniteGame" >nul 2>&1@del /f /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\Shared Files\*.*" >nul 2>&1@rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\Shared Files" >nul 2>&1@RD /S /Q "%localappdata%\FortniteGame" >nul 2>&1@RD /S /Q "%localappdata%\EpicGamesLauncher" >nul 2>&1@RD /S /Q "%localappdata%\UnrealEngine" >nul 2>&1@RD /S /Q "%localappdata%\UnrealEngineLauncher" >nul 2>&1@RD /S /Q "%localappda" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "Game\Saved\Cloud" >nul 2>&1@RD /S /Q "%localappdata%\Temp\ecache.bin"del /s /q "C:\Users\%Username%\AppData\Local\BattlEye" do rmdir "%%p"del C:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDirdel C:\ProgramData\Epic\UnrealEngineLauncher\LauncherInstalled.datdel /f /s /q "%systemdrive%\ProgramData\Epic\EpicGamesLauncher\Data\Manifests\Pending\*.*"del /f /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir\*.*"del /f /s /q "%systemdrive%\System Volume Information\*.*"del /s /q /f /a:h /a:a "%systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Compat.inidel /s /q /f /a:h /a:a "%systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\EditorPerProjectUserSettings.inidel /s /q /f /a:h /a:a "%systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Engine.inidel /s /q /f /a:h /a:a "%systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Conf" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "ogdel /s /q /f /a:h /a:a "%systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\LOG.olddel /s /q /f /a:h /a:a "%systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_www.epicgames.com_0.localstorage-journalecho 9 > "C:\Users\JC\AppData\Local\Temp\cleaner_progress.tmp"del /s /q /f /a:h /a:a "%systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39ca108634434c91f1\6dfe4cbf-2643-41f6-977a-7f1e6f36a2f2\index-dir\the-real-indexdel /s /q /f /a:h /a:a "%systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\Database\LOG.olddel /s /q /f /a:h /a:a "%systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\2cc80dabc69f58b6_0del /s /q /f /a:h /a:a "%systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "ers\All Users\Epic\UnrealEngineLauncher\LauncherInstalled.datdel /s /q /f /a:h /a:a "%systemdrive%\Users\All Users\Epic\EpicGamesLauncher\Data\EMSdel /s /q /f /a:h /a:a "%systemdrive%\Users\All Users\Epic\UnrealEngineLauncherdel /s /q /f /a:h /a:a "%systemdrive%\Windows\Prefetch\EASYANTICHEAT.EXE-4E9E548C.pfdel /s /q /f /a:h /a:a "%%systemdrive%%\Users\%%username%%\AppData\Local\UnrealEngine\*.*"del /s /q /f /a:h /a:a "%%systemdrive%%\Users\%%username%%\AppData\Local\EpicGamesLauncher\Saved\Logs\*.*"del /s /q /f /a:h /a:a "%%systemdrive%%\Users\%%username%%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\*.*"del /s /q /f /a:h /a:a "%%systemdrive%%\Users\%%username%%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\*.*"del /s /q /f /a:h /a:a "%%systemdrive%%\Users\%%username%%\AppData\Local\FortniteGame\Saved\Config\WindowsClient\*.*"del /s /q /f /a:h /a:a "%%systemdrive%%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir\*.*"del /s /q /" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "/a:h /a:a "%%systemdrive%%\Users\%%username%%\AppData\Local\FortniteGame\Saved\LMS\*.*"del /s /q /f /a:h /a:a "%%systemdrive%%\Users\%%username%%\AppData\Local\FortniteGame\Saved\Cloud\*.*"del /s /q /f /a:h /a:a "%%systemdrive%%\Users\%%username%%\AppData\Local\UnrealEngine\*.* "del /s /q /f /a:h /a:a "%%systemdrive%%\Users\%%username%%\AppData\Local\EpicGamesLauncher\Saved\Logs\*.* "del /s /q /f /a:h /a:a "%%systemdrive%%\Users\%%username%%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\*.* "del /s /q /f /a:h /a:a "%%systemdrive%%\Users\%%username%%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\*.* "del /s /q /f /a:h /a:a "%%systemdrive%%\Users\%%username%%\AppData\Local\FortniteGame\Saved\Config\WindowsClient\*.* "del /s /q /f /a:h /a:a "%%systemdrive%%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir\*.* "del /s /q /f /a:h /a:a "%%systemdrive%%\Users\%%username%%\AppData\Local\FortniteGame\Saved\LMS\*.* "del /s /q /f /a:h /a:a "%" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "systemdrive%%\Users\%%username%%\AppData\Local\FortniteGame\Saved\Cloud\*.* "rmdir /s /q "%%systemdrive%%\Users\%%username%%\AppData\Local\UnrealEngine"rmdir /s /q "%%systemdrive%%\Users\%%username%%\AppData\Local\EpicGamesLauncher\Saved\Logs"rmdir /s /q "%%systemdrive%%\Users\%%username%%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage"rmdir /s /q "%%systemdrive%%\Users\%%username%%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache"rmdir /s /q "%%systemdrive%%\Users\%%username%%\AppData\Local\FortniteGame\Saved\Config\WindowsClient"rmdir /s /q "%%systemdrive%%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir"rmdir /s /q "%%systemdrive%%\Users\%%username%%\AppData\Local\FortniteGame\Saved\LMS"rmdir /s /q "%%systemdrive%%\Users\%%username%%\AppData\Local\FortniteGame\Saved\Cloud"del /s /q /f /a:h /a:a "%%systemdrive%%\Users\%%username%%\AppData\Roaming\EasyAntiCheat\*.* "del /s /q /f /a:h /a:a "%%systemdrive%%\Program Files (x86)\EasyAnt" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "Cheat\EasyAntiCheat.sys\*.* "del /s /q /f /a:h /a:a "%systemdrive%\Users\%%username%%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\*.*" >nul 2>&1"del /s /q /f /a:h /a:a "%systemdrive%\Users\%%username%%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\*.*" >nul 2>&1"del /s /q /f /a:h /a:a "%systemdrive%\Users\%%username%%\AppData\Local\FortniteGame\Saved\Config\WindowsClient\*.*" >nul 2>&1"del /s /q /f /a:h /a:a "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir\*.*" >nul 2>&1"del /s /q /f /a:h /a:a "%systemdrive%\Users\%%username%%\AppData\Local\FortniteGame\Saved\LMS\*.*" >nul 2>&1"del /s /q /f /a:h /a:a "%systemdrive%\Users\%%username%%\AppData\Local\FortniteGame\Saved\Cloud\*.*" >nul 2>&1"del /s /q /f /a:h /a:a "%systemdrive%\Recovery\ntuser.sys\*.*" >nul 2>&1"del /s /q /f /a:h /a:a "%systemdrive%\Users\%%username%%\AppData\Local\UnrealEngine\*.*"del /s /q /f /a:h /a:a "%systemdrive%\Users\%%username%%\AppData\Local\E" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "icGamesLauncher\Saved\Logs\*.*"del /s /q /f /a:h /a:a "%systemdrive%\Users\%%username%%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\*.*"del /s /q /f /a:h /a:a "%systemdrive%\Users\%%username%%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\*.*"del /s /q /f /a:h /a:a "%systemdrive%\Users\%%username%%\AppData\Local\FortniteGame\Saved\Config\WindowsClient\*.*"del /s /q /f /a:h /a:a "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir\*.*"del /s /q /f /a:h /a:a "%systemdrive%\Users\%%username%%\AppData\Local\FortniteGame\Saved\LMS\*.*"del /s /q /f /a:h /a:a "%systemdrive%\Users\%%username%%\AppData\Local\FortniteGame\Saved\Cloud\*.*"del /s /q /f /a:h /a:a "%systemdrive%\Users\%%username%%\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\Recovery\Active\*.*" >nul 2>&1"del /s /q /f /a:h /a:a "%systemdrive%\Users\%%username%%\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "#!002\MicrosoftEdge\User\Default\AppCache\*.*" >nul 2>&1"del /s /q /f /a:h /a:a "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\Shared Files\*.*"rmdir /s /q "%systemdrive%\Users\%%username%%\AppData\Roaming\EasyAntiCheat""del /s /q /f /a:h /a:a "%systemdrive%\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.sys\*.*"rmdir /s /q "%systemdrive%\Users\%%username%%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache""rmdir /s /q "%systemdrive%\Program Files (x86)\Common Files\BattlEye""rmdir /s /q "%systemdrive%\Users\%%username%%\AppData\Local\FortniteGame\Saved\Config\WindowsClient""rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir""rmdir /s /q "%systemdrive%\Users\%%username%%\AppData\Local\EpicGamesLauncher""rmdir /s /q "%systemdrive%\Users\%%username%%\AppData\Local\FortniteGame""rmdir /s /q "%%systemdrive%%\Users\%%username%%\AppData\Local\UnrealEngine"rmdir /s /q "%%systemdrive%%\Users\%%username%%\AppData" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "Local\EpicGamesLauncher\Saved\Logs"rmdir /s /q "%%systemdrive%%\Users\%%username%%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage"rmdir /s /q "%%systemdrive%%\Users\%%username%%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache"rmdir /s /q "%%systemdrive%%\Users\%%username%%\AppData\Local\FortniteGame\Saved\Config\WindowsClient"rmdir /s /q "%%systemdrive%%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir"rmdir /s /q "%%systemdrive%%\Users\%%username%%\AppData\Local\FortniteGame\Saved\LMS"cd C:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\cd D:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\cd E:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\cd F:\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\RD /s /q "C:\Users\%Username%\AppData\Local\BattlEye"del /s /q "C:\Users\%Username%\AppData\Local\BattlEye" do rmdir "%%p"RD /s /q "C:\Users\%Username%\AppData\Local\CEF"de" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "/s /q "C:\Users\%Username%\AppData\Local\CEF" do rmdir "%%p"RD /s /q "C:\Users\%Username%\AppData\Local\Comms"del /s /q "C:\Users\%Username%\AppData\Local\Comms" do rmdir "%%p"RD /s /q "C:\Users\%Username%\AppData\Local\ConnectedDevicesPlatform"del /s /q "C:\Users\%Username%\AppData\Local\ConnectedDevicesPlatform" do rmdir "%%p"RD /s /q "C:\Users\%Username%\AppData\Local\CrashDumps"del /s /q "C:\Users\%Username%\AppData\Local\CrashDumps" do rmdir "%%p"RD /s /q "C:\Users\%Username%\AppData\Local\CrashReportClient"del /s /q "C:\Users\%Username%\AppData\Local\CrashReportClient" do rmdir "%%p"RD /s /q "C:\Users\%Username%\AppData\Local\D3DSCache"del /s /q "C:\Users\%Username%\AppData\Local\D3DSCache" do rmdir "%%p"RD /s /q "C:\Users\%Username%\AppData\Local\DBG"del /s /q "C:\Users\%Username%\AppData\Local\DBG" do rmdir "%%p"RD /s /q "C:\Users\%Username%\AppData\Local\EpicGamesLauncher"del /s /q "C:\Users\%Username%\AppData\Local\EpicGamesLauncher" do rmdir "%%p"RD /s /q "C:\U" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "ers\%Username%\AppData\Local\FortniteGame"del /s /q "C:\Users\%Username%\AppData\Local\FortniteGame" do rmdir "%%p"RD /s /q "C:\Users\%Username%\AppData\Local\Microsoft\Feeds"del /s /q "C:\Users\%Username%\AppData\Local\Microsoft\Feeds" do rmdir "%%p"RD /s /q "C:\Users\%Username%\AppData\Local\VirtualStore"del /s /q "C:\Users\%Username%\AppData\Local\VirtualStore" do rmdir "%%p"RD /s /q "C:\Users\%Username%\AppData\Local\UnrealEngineLauncher"del /s /q "C:\Users\%Username%\AppData\Local\UnrealEngineLauncher" do rmdir "%%p"RD /s /q "C:\Users\%Username%\AppData\Local\UnrealEngine"del /s /q "C:\Users\%Username%\AppData\Local\UnrealEngine" do rmdir "%%p"RD /s /q "C:\Users\%Username%\AppData\Local\Speech Graphics"del /s /q"C:\Users\%Username%\AppData\Local\Speech Graphics" do rmdir "%%p"RD /s /q "C:\Users\%Username%\AppData\Local\Publishers"del /s /q "C:\Users\%Username%\AppData\Local\Publishers" do rmdir "%%p"RD /s /q "C:\Users\%Username%\AppData\Local\Programs\Common"del /s /q "C:\U" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "ers\%Username%\AppData\Local\Programs\Common" do rmdir "%%p"RD /s /q "C:\Users\%Username%\AppData\Local\PlaceholderTileLogoFolder"del /s /q "C:\Users\%Username%\AppData\Local\PlaceholderTileLogoFolder" do rmdir "%%p"RD /s /q "C:\Users\%Username%\AppData\Roaming\EasyAntiCheat"del /s /q "C:\Users\%Username%\AppData\Roaming\EasyAntiCheat" do rmdir "%%p"del /f /s /q "C:\Users\%username%\AppData\Local\FortniteGame\*.*"rmdir /s /q "C:\Users\%username%\AppData\Local\FortniteGame"del /f /s /q "C:\Users\Public\Libraries\*.*"rmdir /s /q "C:\Users\Public\Libraries"del /f /s /q "C:\Users\%username%\AppData\Local\Microsoft\Feeds\*.*"rmdir /s /q "C:\Users\%username%\AppData\Local\Microsoft\Feeds"del /f /s /q "C:\Users\%username%\AppData\Local\FortniteGame\Saved\LMS\Manifest.sav\*.*"rmdir /s /q "C:\Users\%username%\AppData\Local\FortniteGame\Saved\LMS\Manifest.sav"del /q /s "C:\Users\%username%\AppData\Local\Microsoft\Feeds"del /a /q /s "C:\Users\%Username%\AppData\Local\updater.log"del /a /q" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "4\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5\*.*" >nul 2>&1@del /s /f /a:h /a:a /q "%systemdrive%\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\*.*" >nul 2>&1@del /s /f /a:h /a:a /q "%systemdrive%\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\*.*" >nul 2>&1@del /s /f /a:h /a:a /q "%systemdrive%\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\*.*" >nul 2>&1del /f /s /q "%systemdrive%\Recovery\ntuser.sys\*.*del /f /s /q "%systemdrive%\Users\Public\Libraries\collection.dat\*.*del /f /s /q "%systemdrive%\MSOCache\{71230000-00E2-0000-1000-00000000}\Setup.dat\*.*del /f /s /q "%systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*del /f /s /q "%systemdrive%\Users\%username%\AppData\Local\Microsoft\Feeds\*.*"del /f /s /q "%systemdrive%\ProgramData\Microsoft\DataMart\PaidWiFi\NetworksCache\*.*del /f /s /q "%systemdrive%\Prog" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin Observed string: "%\Users\%username%\AppData\Roaming\EasyAntiCheat"@del /s /f /a:h /a:a /q "%systemdrive%\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.sys\*.*rmdir /s /q "%systemdrive%\Users\%username%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations"rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache"rmdir /s /q "%systemdrive%\Program Files (x86)\Common Files\BattlEye"@del /s /f /a:h /a:a /q "%systemdrive%\Users%username%\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini\*.*rmdir /s /q "%systemdrive%\Users\virtuos\AppData\Local\Microsoft\OneDrive\settings\Personal"rmdir /s /q "%systemdrive%\Windows\Logs"rmdir /s /q "%systemdrive%\Windows\SoftwareDistribution\PostRebootEventCache.V2"rmdir /s /q "%systemdrive%\Windows\INF"rmdir /s /q "%%systemdrive%%\Users\%%username%%\AppData\Local\FortniteGame\Saved\Cloud"del /s /f /a:h /a:a /q "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\" (Indicator: ""del ") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin4e:T542,Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "CopySid" (Indicator: "CopySid"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")4f:T800,Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin]50:T6192,"runtimebroker.exe" (Indicator: "runtimebroker.exe") "ity\" /freg delete "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig" /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSVendor /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSReleaseDate /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemProductName /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /freg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /freg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" /v SystemStartOptions /fdel /s /f /a:h /a:a /q "C:\Windows\prefetch\CLEANER.EXE-08C569E3.pf" del /s /f /a:h /a:a /q "C:\Windows\prefetch\RUNTIMEBROKER.EXE-4551A062.pf" del /s /f /a:h /a:a /q "C:\Windows\prefetch\TOOL.EXE-7A8EFD97.pf" del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749" del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local" (Indicator: "runtimebroker.exe") "/f /a:h /a:a /q "C:\Windows\Prefetch\RUNTIMEBROKER.EXE-806F0521.pf"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Roaming\discord\c58e08f1-4e20-491c-9c9e-240c80ea2af0.tmp"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Roaming\discord\TransportSecurity~RF1ab69f.TMP"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Roaming\discord\Cache\f_000040"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Roaming\discord\Cache\f_000041"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\FortniteGame\Saved\Demos\UnsavedReplay-2020.06.04-23.26.55.replay"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Roaming\discord\d3bbce75-5eb1-4bd1-8c7a-db6b2aba918c.tmp"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Roaming\discord\TransportSecurity~RF1ade8a.TMP"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Roaming\discord\9f8fa2d6-5650-4fae-988b-8357cf409bae.tmp"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Roaming\discord\TransportSecurity~RF1b316d.TMP"del /s /f /a:h /a:a /q" (Indicator: "runtimebroker.exe") ""C:\Windows\Prefetch\RUNTIMEBROKER.EXE-B7F1BDCA.pf"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Roaming\discord\02bafda1-3674-4218-a419-49e62548b9e1.tmp"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Roaming\discord\TransportSecurity~RF1c0e30.TMP"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Roaming\discord\69b0a059-1022-40e7-8701-4dce90baabdb.tmp"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Roaming\discord\TransportSecurity~RF1c3e0a.TMP"del /s /f /a:h /a:a /q "C:\Users\%username%\ntuser.ini"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Roaming\discord\0c09aaba-b0c8-4bda-82de-a984ef48bb37.tmp"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Roaming\discord\Network Persistent State~RF1d30c7.TMP"del /s /f /a:h /a:a /q "C:\Windows\WindowsUpdate.log"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\FortniteGame\Saved\Crashes\UE4CC-Windows-53CF5BA8415772474DC91FBEF42F7CD9_0000"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\FortniteGame\Saved" (Indicator: "runtimebroker.exe"), "\ProgramData\Microsoft\Windows\WER\Temp\WER7947.tmp"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\WER7947.tmp.csv"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\eb0cfd9d-dbfc-415e-b690-85982c79b058"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\WER7976.tmp"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\WER7976.tmp.txt"del /s /f /a:h /a:a /q "C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials"del /s /f /a:h /a:a /q "C:\Windows\Prefetch\TABTIP.EXE-9740CA06.pf"del /s /f /a:h /a:a /q "C:\Windows\Prefetch\SVCHOST.EXE-C9E3B372.pf"del /s /f /a:h /a:a /q "C:\Windows\Prefetch\RUNTIMEBROKER.EXE-79DA4D38.pf"del /s /f /a:h /a:a /q "C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Comms\UnistoreDB\store.jfm"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\LocalL" (Indicator: "runtimebroker.exe"), "\Windows\WER\Temp\WER28F8.tmp"del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp\WER28F8.tmp.txt"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\notifications.json~RF1d3192.TMP"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\LocalBridge.exe.log"del /s /f /a:h /a:a /q "C:\Windows\Prefetch\RUNTIMEBROKER.EXE-E09C4F85.pf"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\NVIDIA Corporation\GfnRuntimeSdk\GfnRuntimeSdk.log"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\NVIDIA Corporation\GfeSDK\FortniteClient-Win64-Shipping_6712.log"del /s /f /a:h /a:a /q "C:\Windows\System32\eac_usermode_401424855163510.dll"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000046"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker"@del /s /q /f /a ".\desktop.ini"de" (Indicator: "runtimebroker.exe") "DLLHOST.EXE-4B6CB38A.pf"del /s /f /a:h /a:a /q "C:\Windows\Prefetch\DLLHOST.EXE-15CDDA9C.pf"del /s /f /a:h /a:a /q "C:\Windows\Prefetch\SVCHOST.EXE-62677B80.pf"del /s /f /a:h /a:a /q "C:\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-4EED4AF4.pf"del /s /f /a:h /a:a /q "C:\Windows\Prefetch\TASKHOSTW.EXE-2E5D4B75.pf"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\R4WA2BLZ\trans[4].gif"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\FXE0B9PV\trans[4].gif"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\FXE0B9PV"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.jfm"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppData\Indexed DB\edb.chk"del /s" (Indicator: "backgroundtaskhost.exe"), "q "C:\Users\%username%\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\notifications.json"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\CrashDumps\YourPhone.exe.3696.dmp"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\CrashDumps\HxTsr.exe.10192.dmp"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\CrashDumps\backgroundTaskHost.exe.10176.dmp"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\CrashDumps"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\CrashDumps\YourPhone.exe.7740.dmp"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache\EcsCache0\Ecs.dat"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache\EcsCache0"del /s /f /a:h /a:a /q "C:\Users\" (Indicator: "backgroundtaskhost.exe") "a:a /q "C:\Windows\Prefetch\AgAppLaunch.db*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\AgGlFaultHistory.db*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\AgGlFgAppHistory.db*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\AgGlGlobalHistory.db*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\AgRobust.db*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-5F0CC07F.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\BESERVICE.EXE-622E150D.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\CHROME.EXE-CCF9F3F5.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\CHROME.EXE-CCF9F3FC.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\CMD.EXE-CD245F9E.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\CONHOST.EXE-F98A1078.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\CONSENT.EXE-2D674CE4.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\DISCORD.EXE-DA10859E.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\DISCORD.EXE-DA10859F.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\DISCORD.EXE-" (Indicator: "backgroundtaskhost.exe"), "KER.EXE-0184E3F4.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\RUNTIMEBROKER.EXE-C0DC707E.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\SMARTSCREEN.EXE-3A39E32D.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\SVCHOST.EXE-3B02DA08.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\SVCHOST.EXE-4F8D34FD.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\SVCHOST.EXE-5B401A7E.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\SVCHOST.EXE-9B43C62A.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\SVCHOST.EXE-B7096CEF.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\SVCHOST.EXE-C8680DC4.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\SVCHOST.EXE-EE3A9739.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\UNREALCEFSUBPROCESS.EXE-C0266DD1.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\UPDATE.EXE-106FED12.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\WPCTOK.EXE-B25EEA42.pf*.*del /s /f /a:h /a:a /q "C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaDa" (Indicator: "runtimebroker.exe") "Windows\Installer\SourceHash{6A3B09CD-8B4A-4A66-9C90-833023E463E9}del /s /q /f /a:h /a:a C:\Windows\Logs\WindowsUpdate\WindowsUpdate.20200531.010502.740.1.etldel /s /q /f /a:h /a:a C:\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-A47A6076.pfdel /s /q /f /a:h /a:a C:\Windows\Prefetch\DRVINST.EXE-26FFA444.pfdel /s /q /f /a:h /a:a C:\Windows\Prefetch\LOCALBRIDGE.EXE-EB9704C4.pfdel /s /q /f /a:h /a:a C:\Windows\Prefetch\NETCFG.EXE-C0380465.pfdel /s /q /f /a:h /a:a C:\Windows\Prefetch\REG.EXE-6A8B6960.pfdel /s /q /f /a:h /a:a C:\Windows\Prefetch\ROUTE.EXE-C5FB9965.pfdel /s /q /f /a:h /a:a C:\Windows\Prefetch\RUNDLL32.EXE-81640945.pfdel /s /q /f /a:h /a:a C:\Windows\Prefetch\RUNTIMEBROKER.EXE-44AE8610.pfdel /s /q /f /a:h /a:a C:\Windows\Prefetch\RUNTIMEBROKER.EXE-4C6B2545.pfdel /s /q /f /a:h /a:a C:\Windows\Prefetch\RUNTIMEBROKER.EXE-6A3C531B.pfdel /s /q /f /a:h /a:a C:\Windows\Prefetch\RUNTIMEBROKER.EXE-6FDF82D2.pfdel /s /q /f /a:h /a:a C:\Windows\Prefetch\RUNTIMEBROKER.EXE-8DA067BF.pfdel /s" (Indicator: "backgroundtaskhost.exe") ".excdel /s /f /a:h /a:a /q C:\Users\%username%\AppData\Local\\Saved\Cloud\e3e213c0aede4bc6b4d9a540cdff0f7c\ClientSettings.Savdel /s /f /a:h /a:a /q C:\Users\%username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppData\IndexedDB\IndexedDB.jfmdel /s /f /a:h /a:a /q C:\Users\%username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppData\IndexedDB\IndexedDB.edbdel /s /f /a:h /a:a /q C:\Users\%username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppData\IndexedDB\edb.chkdel /s /f /a:h /a:a /q C:\Users\%username%\AppData\Local\\Saved\PersistentDownloadDir\CMS\CacheAccess.jsondel /s /f /a:h /a:a /q C:\Windows\Prefetch\RUNTIMEBROKER.EXE-8A8295D7.pfdel /s /f /a:h /a:a /q C:\Windows\Prefetch\RUNTIMEBROKER.EXE-A27A047C.pfdel /s /f /a:h /a:a /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\Staged\e3e213c0aede4bc6b4d9a540cdff0f7c.datdel /s /f /a:h /a:a /q C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Microso" (Indicator: "runtimebroker.exe") "D7X"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Roaming\discord\Cache\f_00003f"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\RUNTIMEBROKER.EXE-806F0521.pf"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Roaming\discord\c58e08f1-4e20-491c-9c9e-240c80ea2af0.tmp"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Roaming\discord\TransportSecurity~RF1ab69f.TMP"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Roaming\discord\Cache\f_000040"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Roaming\discord\Cache\f_000041"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\FortniteGame\Saved\Demos\UnsavedReplay-2020.06.04-23.26.55.replay"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Roaming\discord\d3bbce75-5eb1-4bd1-8c7a-db6b2aba918c.tmp"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Roaming\discord\TransportSecurity~RF1ade8a.TMP"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Roaming\discord\9f8fa2d6-5650-4fae-988b-8357cf409bae.tmp"del /s /f /a:h /a:a /q "C" (Indicator: "runtimebroker.exe") "\Users\%USERNAME%\AppData\Roaming\discord\TransportSecurity~RF1b316d.TMP"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\RUNTIMEBROKER.EXE-B7F1BDCA.pf"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Roaming\discord\02bafda1-3674-4218-a419-49e62548b9e1.tmp"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Roaming\discord\TransportSecurity~RF1c0e30.TMP"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Roaming\discord\69b0a059-1022-40e7-8701-4dce90baabdb.tmp"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Roaming\discord\TransportSecurity~RF1c3e0a.TMP"del /s /f /a:h /a:a /q "D:\Users\%username%\ntuser.ini"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Roaming\discord\0c09aaba-b0c8-4bda-82de-a984ef48bb37.tmp"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Roaming\discord\Network Persistent State~RF1d30c7.TMP"del /s /f /a:h /a:a /q "D:\Windows\WindowsUpdate.log"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\FortniteGame\Saved\Crashes\UE4CC-Windows-53CF5BA8415772474D" (Indicator: "runtimebroker.exe") "/a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\ec4dd07a-ecf7-4337-a4fa-e10887cc18f7"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\WER7947.tmp"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\WER7947.tmp.csv"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\eb0cfd9d-dbfc-415e-b690-85982c79b058"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\WER7976.tmp"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp\WER7976.tmp.txt"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\TABTIP.EXE-9740CA06.pf"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\SVCHOST.EXE-C9E3B372.pf"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\RUNTIMEBROKER.EXE-79DA4D38.pf"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\Comms\UnistoreDB\store.jfm"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4"del /s /f /a:h /a:a /q "C:\U" (Indicator: "runtimebroker.exe"), "a /q "C:\Users\%USERNAME%\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\notifications.json~RF1d3192.TMP"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\LocalBridge.exe.log"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\RUNTIMEBROKER.EXE-E09C4F85.pf"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\NVIDIA Corporation\GfnRuntimeSdk\GfnRuntimeSdk.log"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\NVIDIA Corporation\GfeSDK\FortniteClient-Win64-Shipping_6712.log"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000046"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\FOLDERCHANGESVIEW.EXE-B277C3B5.pf"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\EpicGamesLauncher\Saved\Config"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\EpicGamesLauncher\Sa" (Indicator: "runtimebroker.exe") "che\R4WA2BLZ\fpconfig.min[1].json"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\DLLHOST.EXE-E9BDD97B.pf"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\NOTEPAD.EXE-C5670914.pf"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\DLLHOST.EXE-4B6CB38A.pf"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\DLLHOST.EXE-15CDDA9C.pf"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\SVCHOST.EXE-62677B80.pf"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-4EED4AF4.pf"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\TASKHOSTW.EXE-2E5D4B75.pf"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\R4WA2BLZ\trans[4].gif"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\FXE0B9PV\trans[4].gif"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\FXE0B9PV"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\Package" (Indicator: "backgroundtaskhost.exe") "municationsapps_8wekyb3d8bbwe\Settings\settings.dat"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\CrashDumps\YourPhone.exe.3696.dmp"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\CrashDumps\HxTsr.exe.10192.dmp"echo 28 > "C:\Users\JC\AppData\Local\Temp\cleaner_progress.tmp"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\CrashDumps\backgroundTaskHost.exe.10176.dmp"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\CrashDumps"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\CrashDumps\YourPhone.exe.7740.dmp"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache\EcsCache0\Ecs.dat"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache\EcsCache0"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\L" (Indicator: "backgroundtaskhost.exe") "indows\Prefetch\AgGlFgAppHistory.db*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\AgGlGlobalHistory.db*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\AgRobust.db*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-5F0CC07F.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\BESERVICE.EXE-622E150D.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\CHROME.EXE-CCF9F3F5.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\CHROME.EXE-CCF9F3FC.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\CMD.EXE-CD245F9E.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\CONHOST.EXE-F98A1078.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\CONSENT.EXE-2D674CE4.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\DISCORD.EXE-DA10859E.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\DISCORD.EXE-DA10859F.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\DISCORD.EXE-DA1085A0.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\DISCORD.EXE-DA1085A6.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\DISCORDHOOK" (Indicator: "backgroundtaskhost.exe") "ELPER64.EXE-F16A4BE4.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\DLLHOST.EXE-38926D07.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\EASYANTICHEAT_SETUP.EXE-A6C69E49.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\FORTNITECLIENT-WIN64-SHIPPING-5D7C37E5.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\FORTNITECLIENT-WIN64-SHIPPING-9E5A8D8B.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\FORTNITELAUNCHER.EXE-CEAE6228.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\GAMEBARPRESENCEWRITER.EXE-FE591E8F.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\REGSHOT-X64-ANSI.EXE-0BE896DE.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\ResPriHMStaticDb.ebd*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\RUNDLL32.EXE-2C88A316.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\RUNDLL32.EXE-81640945.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\RUNTIMEBROKER.EXE-0184E3F4.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\RUNTIMEBROKER.EXE-C0DC707E.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefe" (Indicator: "runtimebroker.exe"), "/a:a D:\Windows\appcompat\Programs\Amcache.hve.tmp.LOG1del /s /q /f /a:h /a:a D:\Windows\appcompat\Programs\Amcache.hve.tmp.LOG2del /s /q /f /a:h /a:a D:\Windows\AppReadiness\S-1-5-21-2570960266-2216518384-2913187921-1001del /s /q /f /a:h /a:a D:\Windows\INF\netavpna.PNFdel /s /q /f /a:h /a:a D:\Windows\INF\netrasa.PNFdel /s /q /f /a:h /a:a D:\Windows\INF\netsstpa.PNFdel /s /q /f /a:h /a:a D:\Windows\INF\setupapi.dev.logdel /s /q /f /a:h /a:a D:\Windows\Installer\3f43e7.msidel /s /q /f /a:h /a:a D:\Windows\Installer\SourceHash{6A3B09CD-8B4A-4A66-9C90-833023E463E9}del /s /q /f /a:h /a:a D:\Windows\Logs\WindowsUpdate\WindowsUpdate.20200531.010502.740.1.etldel /s /q /f /a:h /a:a D:\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-A47A6076.pfdel /s /q /f /a:h /a:a D:\Windows\Prefetch\DRVINST.EXE-26FFA444.pfdel /s /q /f /a:h /a:a D:\Windows\Prefetch\LOCALBRIDGE.EXE-EB9704C4.pfdel /s /q /f /a:h /a:a D:\Windows\Prefetch\NETCFG.EXE-C0380465.pfdel /s /q /f /a:h /a:a D:\Windows\Prefetch\REG.EXE-6A8B" (Indicator: "backgroundtaskhost.exe"), "960.pfdel /s /q /f /a:h /a:a D:\Windows\Prefetch\ROUTE.EXE-C5FB9965.pfdel /s /q /f /a:h /a:a D:\Windows\Prefetch\RUNDLL32.EXE-81640945.pfdel /s /q /f /a:h /a:a D:\Windows\Prefetch\RUNTIMEBROKER.EXE-44AE8610.pfdel /s /q /f /a:h /a:a D:\Windows\Prefetch\RUNTIMEBROKER.EXE-4C6B2545.pfdel /s /q /f /a:h /a:a D:\Windows\Prefetch\RUNTIMEBROKER.EXE-6A3C531B.pfdel /s /q /f /a:h /a:a D:\Windows\Prefetch\RUNTIMEBROKER.EXE-6FDF82D2.pfdel /s /q /f /a:h /a:a D:\Windows\Prefetch\RUNTIMEBROKER.EXE-8DA067BF.pfdel /s /q /f /a:h /a:a D:\Windows\Prefetch\SVCHOST.EXE-09597DEE.pfdel /s /q /f /a:h /a:a D:\Windows\Prefetch\SVCHOST.EXE-350EF3E6.pfdel /s /q /f /a:h /a:a D:\Windows\Prefetch\SVCHOST.EXE-574A519D.pfdel /s /q /f /a:h /a:a D:\Windows\Prefetch\SVCHOST.EXE-71309655.pfdel /s /q /f /a:h /a:a D:\Windows\Prefetch\SVCHOST.EXE-A505D0B6.pfdel /s /q /f /a:h /a:a D:\Windows\Prefetch\SVCHOST.EXE-B7096CEF.pfdel /s /q /f /a:h /a:a D:\Windows\Prefetch\SVCHOST.EXE-C82C6B72.pfdel /s /q /f /a:h /a:a D:\Windows\" (Indicator: "runtimebroker.exe"), "ProgramData\Microsoft\Windows\WER\Temp\1853b1d2-d62d-4d62-a880-e38c9f375708"del /s /f /a:h /a:a /q "E:\Windows\Prefetch\UPDATE.EXE-51DEF9C0.pf"del /s /f /a:h /a:a /q "E:\Windows\Prefetch\RUNTIMEBROKER.EXE-806F0521.pf"del /s /f /a:h /a:a /q "E:\Windows\Prefetch\RUNTIMEBROKER.EXE-B7F1BDCA.pf"del /s /f /a:h /a:a /q "E:\Users\%username%\ntuser.ini"del /s /f /a:h /a:a /q "E:\Windows\WindowsUpdate.log"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Windows\AppRepository\Packages\InputApp_1000.18362.449.0_neutral_neutral_cw5n1h2txyewy\ActivationStore.dat"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json.bk"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.DIAGNOSTICS.xml.new"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\WINDOWS.DIAGNOSTICS.xml.temp"del /s /f /a:h /a:a /q "E:\ProgramData" (Indicator: "runtimebroker.exe"), "f\9740fb48-fb07-4761-9a62-0356c756abde"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Windows\WER\Temp\ec4dd07a-ecf7-4337-a4fa-e10887cc18f7"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Windows\WER\Temp\WER7947.tmp"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Windows\WER\Temp\WER7947.tmp.csv"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Windows\WER\Temp\eb0cfd9d-dbfc-415e-b690-85982c79b058"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Windows\WER\Temp\WER7976.tmp"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Windows\WER\Temp\WER7976.tmp.txt"del /s /f /a:h /a:a /q "E:\Windows\Prefetch\TABTIP.EXE-9740CA06.pf"del /s /f /a:h /a:a /q "E:\Windows\Prefetch\SVCHOST.EXE-C9E3B372.pf"del /s /f /a:h /a:a /q "E:\Windows\Prefetch\RUNTIMEBROKER.EXE-79DA4D38.pf"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Windows\WER\Temp\7faa1a79-555e-4333-afbd-62d07d7c9732"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Windows\WER\Temp\WER278F.tmp"del /s /f /a:h /a:a /q "E:\ProgramData\Micro" (Indicator: "runtimebroker.exe"), "-95c3-41fb-aa42-e692b8cdac5d\c4b19633-7027-457d-ba27-44f66fb03f05"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Windows\WER\Temp\912ebb1c-4984-4d9d-b19b-5777b47007a6"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Windows\WER\Temp\WER28B8.tmp"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Windows\WER\Temp\WER28B8.tmp.csv"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Windows\WER\Temp\9c844648-64b9-4072-a736-cf395107746e"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Windows\WER\Temp\WER28F8.tmp"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Windows\WER\Temp\WER28F8.tmp.txt"del /s /f /a:h /a:a /q "E:\Windows\Prefetch\RUNTIMEBROKER.EXE-E09C4F85.pf"del /s /f /a:h /a:a /q "E:\Windows\Prefetch\FOLDERCHANGESVIEW.EXE-B277C3B5.pf"del /s /f /a:h /a:a /q "E:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe"del /s /f /a:h /a:a /q "E:\Windows\Prefetch\EASYANTICHEAT_SETUP.EXE-487D2C5D.pf"del /s /f /a:h /a:a /q "E:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.sys"del /s /f /a:h /a" (Indicator: "runtimebroker.exe")51:Tdd2,Found string "21782-1001\Software\Microsoft\Windows\CurrentVersion\SettingSync\LastLocalChangeTime" /freg delete "HKU\S-1-5-21-3562401221-3456852255-1175621782-1001\Software\Microsoft\Windows\CurrentVersion\SettingSync\Namespace\windows\NotificationSettings\LastBackupSettingChangeTime" /freg delete "HKU\S-1-5-21-3562401221-3456852255-1175621782-1001\Software\Microsoft\Windows\CurrentVersion\SettingSync\Namespace\windows\NotificationSettings\LastBackupSettingChangeTime" /freg delete "HKU\S-1-5-21-3562401221-3456852255-1175621782-1001\Software\Microsoft\Windows\CurrentVersion\SettingSync\Namespace\windows\NotificationSettings\BackupConsistencyTimestamp" /freg delete "HKU\S-1-5-21-3562401221-3456852255-1175621782-1001\Software\Microsoft\Windows\CurrentVersion\SettingSync\Namespace\windows\NotificationSettings\BackupConsistencyTimestamp" /freg delete "HKU\S-1-5-21-3562401221-3456852255-1175621782-1001\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\PUUActive" /freg delete "HKU\S-1-5-21-3562401221-3456852255-" (Indicator: "software\microsoft\windows nt\currentversion\winlogon"; in File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "175621782-1001\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\PUUActive" /freg delete "HKU\S-1-5-21-3562401221-3456852255-1175621782-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\HAM\AUI\ppleae38af2e007f4358a809ac99a64a67c1\V1\LU\PCT" /freg delete "HKU\S-1-5-21-3562401221-3456852255-1175621782-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\HAM\AUI\ppleae38af2e007f4358a809ac99a64a67c1\V1\LU\PCT" /freg delete "HKU\S-1-5-21-3562401221-3456852255-1175621782-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\HAM\AUI\ppleae38af2e007f4358a809ac99a64a67c1\V1\LU\PTT" /freg delete "HKU\S-1-5-21-3562401221-3456852255-1175621782-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Current" (Indicator: "software\microsoft\windows nt\currentversion\winlogon"; in File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "ingSync\LastLocalChangeTime" /freg delete "HKU\S-1-5-21-3562401221-3456852255-1175621782-1001\Software\Microsoft\Windows\CurrentVersion\SettingSync\Namespace\windows\NotificationSettings\LastBackupSettingChangeTime" /freg delete "HKU\S-1-5-21-3562401221-3456852255-1175621782-1001\Software\Microsoft\Windows\CurrentVersion\SettingSync\Namespace\windows\NotificationSettings\BackupConsistencyTimestamp" /freg delete "HKU\S-1-5-21-3562401221-3456852255-1175621782-1001\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\PUUActive" /freg delete "HKU\S-1-5-21-3562401221-3456852255-1175621782-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\HAM\AUI\ppleae38af2e007f4358a809ac99a64a67c1\V1\LU\PCT" /freg delete "HKU\S-1-5-21-3562401221-3456852255-1175621782-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\H" (Indicator: "software\microsoft\windows nt\currentversion\winlogon"; in File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")52:T417,YARA signature "INDICATOR_SUSPICIOUS_ClearWinLogs" matched file "sample.bin" as "Detects executables containing commands for clearing Windows Event Logs" (Author: ditekSHen) YARA signature "INDICATOR_SUSPICIOUS_References_SecTools" matched file "sample.bin" as "Detects executables referencing many IR and analysis tools" (Author: ditekSHen) YARA signature "INDICATOR_SUSPICIOUS_EXE_RawPaste_URL" matched file "sample.bin" as "Detects executables (downlaoders) containing URLs to raw contents of a paste" (Author: ditekSHen) YARA signature "INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess" matched file "sample.bin" as "Detects executables calling ClearMyTracksByProcess" (Author: ditekSHen) YARA signature "INDICATOR_SUSPICIOUS_EXE_DiscordURL" matched file "sample.bin" as "Detects executables Discord URL observed in first stage droppers" (Author: ditekSHen) YARA signature "INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb" matched file "sample.bin" as "Detects executables referencing combination of virtualization drivers" (Author: ditekSHen)53:T30c7,Found string "ROOT\CIMV2" (Indicator: "root\cimv2"; in File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "ropMap\CiPT0000.000" del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppData\CacheStorage\CACHES~1.JFM" del /s /f /a:h /a:a /q "C:\Windows\prefetch\WERMGR.EXE-F439C551.pf" del /s /f /a:h /a:a /q "C:\Windows\INF\Zenonite.clr" del /s /f /a:h /a:a /q "C:\Windows\INF\monitor.PNF" del /s /f /a:h /a:a /q "C:\Windows\INF\netvwifimp.PNF" del /s /f /a:h /a:a /q "C:\Windows\INF\msports.PNF" del /s /f /a:h /a:a /q "C:\Windows\INF\wmiacpi.PNF" del /s /f /a:h /a:a /q "C:\Windows\INF\iaLPSS2i_GPIO2_SKL.PNF" del /s /f /a:h /a:a /q "C:\Windows\INF\intelpep.PNF" del /s /f /a:h /a:a /q "C:\Windows\INF\ndisvirtualbus.PNF" del /s /f /a:h /a:a /q "C:\Windows\INF\rdpbus.PNF" del /s /f /a:h /a:a /q "C:\Windows\INF\usbxhci.PNF" del /s /f /a:h /a:a /q "C:\Windows\System32\wbem\repository\MAPPING1.MAP" del /s /f /a:h /a:a /q "C:\Windows\prefetch\WMIPRVSE.EXE-39F97B2D.pf" del /s /f /a:h /a:a /q "C:\Windows\System32\wbem\repository\WRITABLE.TST" " (Indicator: "wmiprvse.exe"; in File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin"), Found string "s /f /a:h /a:a /q "C:\Windows\prefetch\CMD.EXE-6D6290C5.pf" del /s /f /a:h /a:a /q "C:\Windows\prefetch\FINDSTR.EXE-5986D423.pf" del /s /f /a:h /a:a /q "C:\Windows\prefetch\WMIC.EXE-311B5CB4.pf" del /s /f /a:h /a:a /q "C:\Windows\prefetch\reg.EXE-0AC99A87.pf" del /s /f /a:h /a:a /q "C:\Windows\prefetch\SVCHOST.EXE-C5837514.pf" del /s /f /a:h /a:a /q "C:\Windows\prefetch\WMIPRVSE.EXE-E8B8DD29.pf" del C:\Users\%username%\AppData\Local\FortniteGame\Saved\LMS\Manifest.sav*.*del C:\Users\Public\Libraries\collection.dat*.*del C:\MSOCache\{71230000-00E2-0000-1000-00000000}\Setup.dat*.*del C:\Users\%username%\AppData\Local\Microsoft\Feeds:KnownSources*.*del C:\Recovery\ntuser.sys*.*del C:\Users\%username%\AppData\Local\AC\INetCookies\ESE\container.dat*.*del C:\Users\%username%\AppData\Local\Packages\Settings\settings.dat*.*del C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\WindowsClient\GameUserSettings.ini*.*del C:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDow" (Indicator: "wmic.exe"; in File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin"), Found string "\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC\INetCache\K1P1XB13"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC\INetCache\AT2DHMOO\ab[1].json"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC\INetCache\AT2DHMOO"del /s /f /a:h /a:a /q "C:\Windows\Prefetch\GAMEBAR.EXE-F128C052.pf"del /s /f /a:h /a:a /q "C:\Windows\Prefetch\SVCHOST.EXE-9E5372D6.pf"del /s /f /a:h /a:a /q "C:\Windows\Prefetch\GAMEBARFTSERVER.EXE-893F5327.pf"del /s /f /a:h /a:a /q "C:\Windows\Prefetch\GAMEBARFT.EXE-361978C4.pf"del /s /f /a:h /a:a /q "C:\Windows\System32\wbem\Performance\WmiApRpl_new.h"del /s /f /a:h /a:a /q "C:\Windows\Prefetch\WMIADAP.EXE-BB21CD77.pf"del /s /f /a:h /a:a /q "C:\Windows\Prefetch\WMIPRVSE.EXE-E8B8DD29.pf"del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\NVIDIA Corporation\GfeSDK\FortniteClient-Win64-Shipping_5932.log"del /s /f /a:h /a:a /q "C:\Use" (Indicator: "wmiprvse.exe"; in File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin"), Found string "indows\Prefetch\SEARCHPROTOCOLHOST.EXE-C6CFE2A8.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\SVCHOST.EXE-2372004C.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\SVCHOST.EXE-C2AC774B.pf*.*del /s /f /a:h /a:a /q "C:\Windows\Prefetch\WMIPRVSE.EXE-BB49B536.pf*.*del /s /f /a:h /a:a /q "C:\Windows\System32\wbem\Repository\MAPPING1.MAP*.*del /s /f /a:h /a:a /q "C:\$RECYCLE.BIN*.*del /s /f /a:h /a:a /q "C:\$RECYCLE.BIN\S-1-5-21-5762298-1752560107-289628738-1001*.*del /s /f /a:h /a:a /q "C:\ProgramData\Microsoft\Windows\WER\Temp*.*del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\D3DSCache*.*del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\D3DSCache\d4c9c2a7325eb61e*.*del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher*.*del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Intermediate*.*del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Intermediate\Config*.*del /s /f /a:h /a:a /q "C:\Users\%usern" (Indicator: "wmiprvse.exe"; in File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "GamingOverlay_8wekyb3d8bbwe\AC\INetCache\AT2DHMOO"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\GAMEBAR.EXE-F128C052.pf"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\SVCHOST.EXE-9E5372D6.pf"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\GAMEBARFTSERVER.EXE-893F5327.pf"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\GAMEBARFT.EXE-361978C4.pf"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\WMIADAP.EXE-BB21CD77.pf"del /s /f /a:h /a:a /q "D:\Windows\Prefetch\WMIPRVSE.EXE-E8B8DD29.pf"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\NVIDIA Corporation\GfeSDK\FortniteClient-Win64-Shipping_5932.log"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\EpicGamesLauncher\Saved\Data\Staged\60ceea72acec404a8814e29f533cd218.dat"del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\EpicGamesLauncher\Saved\Data\60ceea72acec404a8814e29f533cd218.dat"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.chk"del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\SmsRouter\MessageStore\Sm" (Indicator: "wmiprvse.exe"; in File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "5-18_NonPackagedApp\Geofence.dat*.*del /s /f /a:h /a:a /q "D:\Users\All Users\Microsoft\Windows\Parental Controls\settings\settings.bin*.*del /s /f /a:h /a:a /q "D:\Users\All Users\NVIDIA Corporation\Drs\nvAppTimestamps*.*del /s /f /a:h /a:a /q "D:\Windows\appcompat\Programs\Amcache.hve.tmp.LOG2*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\SEARCHFILTERHOST.EXE-10E4267C.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\SEARCHPROTOCOLHOST.EXE-C6CFE2A8.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\SVCHOST.EXE-2372004C.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\SVCHOST.EXE-C2AC774B.pf*.*del /s /f /a:h /a:a /q "D:\Windows\Prefetch\WMIPRVSE.EXE-BB49B536.pf*.*del /s /f /a:h /a:a /q "D:\$RECYCLE.BIN*.*del /s /f /a:h /a:a /q "D:\$RECYCLE.BIN\S-1-5-21-5762298-1752560107-289628738-1001*.*del /s /f /a:h /a:a /q "D:\ProgramData\Microsoft\Windows\WER\Temp*.*del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\D3DSCache*.*del /s /f /a:h /a:a /q "C:\Users\%USERNAME%\AppData\Local\D3DS" (Indicator: "wmiprvse.exe"; in File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin"), Found string "EBARFT.EXE-361978C4.pf"del /s /f /a:h /a:a /q "E:\Windows\Prefetch\WMIADAP.EXE-BB21CD77.pf"del /s /f /a:h /a:a /q "E:\Windows\Prefetch\WMIPRVSE.EXE-E8B8DD29.pf"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.chk"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.log"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.jfm"del /s /f /a:h /a:a /q "E:\Windows\INF\WmiApRpl\0009\WmiApRpl.ini"del /s /f /a:h /a:a /q "E:\Windows\INF\WmiApRpl\0009"del /s /f /a:h /a:a /q "E:\Windows\INF\WmiApRpl\WmiApRpl.h"del /s /f /a:h /a:a /q "E:\Windows\INF\WmiApRpl\WmiApRpl.ini"del /s /f /a:h /a:a /q "E:\Windows\bootstat.dat"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Windows\AppRepository\StateRepository-Deployment.srd"del /s /f /a:h /a:a /q "E:\ProgramData\Microsoft\Windows\AppRepository\StateRepository-Deployment.srd" (Indicator: "wmiprvse.exe"; in File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin"), Found string "log*.*del /s /f /a:h /a:a /q "E:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db*.*del /s /f /a:h /a:a /q "E:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.jfm*.*del /s /f /a:h /a:a /q "E:\Users\All Users\Microsoft\Windows\LfSvc\Geofence\S-1-5-18_NonPackagedApp\Geofence.dat*.*del /s /f /a:h /a:a /q "E:\Users\All Users\Microsoft\Windows\Parental Controls\settings\settings.bin*.*del /s /f /a:h /a:a /q "E:\Users\All Users\NVIDIA Corporation\Drs\nvAppTimestamps*.*del /s /f /a:h /a:a /q "E:\Windows\appcompat\Programs\Amcache.hve.tmp.LOG2*.*del /s /f /a:h /a:a /q "E:\Windows\Prefetch\SEARCHFILTERHOST.EXE-10E4267C.pf*.*del /s /f /a:h /a:a /q "E:\Windows\Prefetch\SEARCHPROTOCOLHOST.EXE-C6CFE2A8.pf*.*del /s /f /a:h /a:a /q "E:\Windows\Prefetch\SVCHOST.EXE-2372004C.pf*.*del /s /f /a:h /a:a /q "E:\Windows\Prefetch\SVCHOST.EXE-C2AC774B.pf*.*del /s /f /a:h /a:a /q "E:\Windows\Prefetch\WMIPRVSE.EXE-BB49B536.pf*.*del /s /f /a:h /a:a /q "E:\$RECYCLE.BIN*.*" (Indicator: "wmiprvse.exe"; in File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin"), Found string "/a:a /q "F:\Windows\Prefetch\GAMEBARFT.EXE-361978C4.pf"del /s /f /a:h /a:a /q "F:\Windows\Prefetch\WMIADAP.EXE-BB21CD77.pf"del /s /f /a:h /a:a /q "F:\Windows\Prefetch\WMIPRVSE.EXE-E8B8DD29.pf"del /s /f /a:h /a:a /q "F:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.chk"del /s /f /a:h /a:a /q "F:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db"del /s /f /a:h /a:a /q "F:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.log"del /s /f /a:h /a:a /q "F:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.jfm"del /s /f /a:h /a:a /q "F:\Windows\INF\WmiApRpl\0009\WmiApRpl.ini"del /s /f /a:h /a:a /q "F:\Windows\INF\WmiApRpl\0009"del /s /f /a:h /a:a /q "F:\Windows\INF\WmiApRpl\WmiApRpl.h"del /s /f /a:h /a:a /q "F:\Windows\INF\WmiApRpl\WmiApRpl.ini"del /s /f /a:h /a:a /q "F:\Windows\bootstat.dat"del /s /f /a:h /a:a /q "F:\ProgramData\Microsoft\Windows\AppRepository\StateRepository-Deployment.srd"del /s /f /a:h /a:a /q "F:\ProgramData\Microsoft\Windows\AppRepositor" (Indicator: "wmiprvse.exe"; in File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin") Found string "soft\SmsRouter\MessageStore\edb.log*.*del /s /f /a:h /a:a /q "F:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db*.*del /s /f /a:h /a:a /q "F:\Users\All Users\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.jfm*.*del /s /f /a:h /a:a /q "F:\Users\All Users\Microsoft\Windows\LfSvc\Geofence\S-1-5-18_NonPackagedApp\Geofence.dat*.*del /s /f /a:h /a:a /q "F:\Users\All Users\Microsoft\Windows\Parental Controls\settings\settings.bin*.*del /s /f /a:h /a:a /q "F:\Users\All Users\NVIDIA Corporation\Drs\nvAppTimestamps*.*del /s /f /a:h /a:a /q "F:\Windows\appcompat\Programs\Amcache.hve.tmp.LOG2*.*del /s /f /a:h /a:a /q "F:\Windows\Prefetch\SEARCHFILTERHOST.EXE-10E4267C.pf*.*del /s /f /a:h /a:a /q "F:\Windows\Prefetch\SEARCHPROTOCOLHOST.EXE-C6CFE2A8.pf*.*del /s /f /a:h /a:a /q "F:\Windows\Prefetch\SVCHOST.EXE-2372004C.pf*.*del /s /f /a:h /a:a /q "F:\Windows\Prefetch\SVCHOST.EXE-C2AC774B.pf*.*del /s /f /a:h /a:a /q "F:\Windows\Prefetch\WMIPRVSE.EXE-BB49B536.pf*.*del /s /f /a" (Indicator: "wmiprvse.exe"; in File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin"), Found string "ay_8wekyb3d8bbwe\AC\INetCache\AT2DHMOO\ab[1].json"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC\INetCache\AT2DHMOO"@del /s /f /a:h /a:a /q "C:\Windows\Prefetch\GAMEBAR.EXE-F128C052.pf"@del /s /f /a:h /a:a /q "C:\Windows\Prefetch\SVCHOST.EXE-9E5372D6.pf"@del /s /f /a:h /a:a /q "C:\Windows\Prefetch\GAMEBARFTSERVER.EXE-893F5327.pf"@del /s /f /a:h /a:a /q "C:\Windows\Prefetch\GAMEBARFT.EXE-361978C4.pf"@del /s /f /a:h /a:a /q "C:\Windows\System32\wbem\Performance\WmiApRpl_new.h"@del /s /f /a:h /a:a /q "C:\Windows\Prefetch\WMIADAP.EXE-BB21CD77.pf"@del /s /f /a:h /a:a /q "C:\Windows\Prefetch\WMIPRVSE.EXE-E8B8DD29.pf"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\Staged\60ceea72acec404a8814e29f533cd218.dat"@del /s /f /a:h /a:a /q "C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\60ceea72acec404a8814e29f533cd218.dat"@del /s /f /a:h /a:a /q "C:\Windows\System32\wbem\Performanc" (Indicator: "wmiprvse.exe"; in File: "666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin")54:T484,RegOpenKeyExW ChangeServiceConfigW RegDeleteKeyA RegCreateKeyExW RegCloseKey RegDeleteValueW RegEnumKeyA CryptEncrypt OpenProcessToken RegCreateKeyExA GetUserNameA RegOpenKeyExA GetModuleHandleA GetSystemInfo GetSystemDirectoryW GetFileSizeEx FindNextFileW GetComputerNameA IsDebuggerPresent OpenProcess CreateFileMappingA SleepConditionVariableSRW CreateFileMappingW CreateProcessW GetModuleHandleW CreateDirectoryA Process32NextW LoadLibraryW VirtualProtect CheckRemoteDebuggerPresent GetStartupInfoW CreateToolhelp32Snapshot GetModuleFileNameW CreateThread FindFirstFileExW FindFirstFileW GetThreadContext CreateFileA SleepEx OutputDebugStringW GetProcAddress LoadLibraryA GetTickCount CreateDirectoryW Process32FirstW MapViewOfFile CreateProcessA CreateFileW GetTempPathA Sleep GetModuleFileNameA TerminateProcess CreateFile2 GetFileAttributesExW GetModuleFileNameExA GetModuleFileNameExW ShellExecuteA FindWindowW FindWindowExW GetCursorPos GetClipboardData FindWindowA listen send bind connect closesocket socket accept WSAStartup recv recvfrom sendto NtQueryInformationProcess1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":74,"unified_at_epoch_ms":1790321070829,"unified_at":"2026-09-25T07:24:30.829Z","metadata":{"hashes":{"sha256":"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4","sha1":"ac5feca8670bcbf500f29b45bb1d1b9f82e6b5f4","md5":"d9e5531bed49d6e436ae153f06a2f1ab","sha512":"0624a4db7e47f02cb297b84839f397c728807dac08d7254b22d7d253b00f892f9a277fce1a6285e16505ec83aaa0ceec6309899b9fb63944f93a289fda199fd8","ssdeep":"49152:wA5nfk9nrSxCh2MB16UZ1o5q8RSPO1amSgvtFuzoNrF4hOFOFOFOTwSOojunYyIW:wgqrSCKrR1amSgvtFuzoNry0yNbH","ssdeep_chunks":["49152:wA5nfk9","49152:A5nfk9n","49152:5nfk9nr","49152:nfk9nrS","49152:fk9nrSx","49152:k9nrSxC","49152:9nrSxCh","49152:nrSxCh2","49152:rSxCh2M","49152:SxCh2MB","49152:xCh2MB1","49152:Ch2MB16","49152:h2MB16U","49152:2MB16UZ","49152:MB16UZ1","49152:B16UZ1o","49152:16UZ1o5","49152:6UZ1o5q","49152:UZ1o5q8","49152:Z1o5q8R","49152:1o5q8RS","49152:o5q8RSP","49152:5q8RSPO","49152:q8RSPO1","49152:8RSPO1a","49152:RSPO1am","49152:SPO1amS","49152:PO1amSg","49152:O1amSgv","49152:1amSgvt","49152:amSgvtF","49152:mSgvtFu","49152:SgvtFuz","49152:gvtFuzo","49152:vtFuzoN","49152:tFuzoNr","49152:FuzoNrF","49152:uzoNrF4","49152:zoNrF4h","49152:oNrF4hO","49152:NrF4hOF","49152:rF4hOFO","49152:F4hOFOF","49152:4hOFOFO","49152:hOFOFOF","49152:OFOFOFO","49152:FOFOFOT","49152:OFOFOTw","49152:FOFOTwS","49152:OFOTwSO","49152:FOTwSOo","49152:OTwSOoj","49152:TwSOoju","49152:wSOojun","49152:SOojunY","49152:OojunYy","49152:ojunYyI","49152:junYyIW","98304:wA5nfk9","98304:A5nfk9n","98304:5nfk9nr","98304:nfk9nrS","98304:fk9nrSx","98304:k9nrSxC","98304:9nrSxCh","98304:nrSxCh2","98304:rSxCh2M","98304:SxCh2MB","98304:xCh2MB1","98304:Ch2MB16","98304:h2MB16U","98304:2MB16UZ","98304:MB16UZ1","98304:B16UZ1o","98304:16UZ1o5","98304:6UZ1o5q","98304:UZ1o5q8","98304:Z1o5q8R","98304:1o5q8RS","98304:o5q8RSP","98304:5q8RSPO","98304:q8RSPO1","98304:8RSPO1a","98304:RSPO1am","98304:SPO1amS","98304:PO1amSg","98304:O1amSgv","98304:1amSgvt","98304:amSgvtF","98304:mSgvtFu","98304:SgvtFuz","98304:gvtFuzo","98304:vtFuzoN","98304:tFuzoNr","98304:FuzoNrF","98304:uzoNrF4","98304:zoNrF4h","98304:oNrF4hO","98304:NrF4hOF","98304:rF4hOFO","98304:F4hOFOF","98304:4hOFOFO","98304:hOFOFOF","98304:OFOFOFO","98304:FOFOFOT","98304:OFOFOTw","98304:FOFOTwS","98304:OFOTwSO","98304:FOTwSOo","98304:OTwSOoj","98304:TwSOoju","98304:wSOojun","98304:SOojunY","98304:OojunYy","98304:ojunYyI","98304:junYyIW","49152:wgqrSCK","49152:gqrSCKr","49152:qrSCKrR","49152:rSCKrR1","49152:SCKrR1a","49152:CKrR1am","49152:KrR1amS","49152:rR1amSg","49152:R1amSgv","49152:FuzoNry","49152:uzoNry0","49152:zoNry0y","49152:oNry0yN","49152:Nry0yNb","49152:ry0yNbH"],"imphash":"02b2c680af574d02f82636ed71d52b98"},"file_info":{"file_name":"MeriumV3.8.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":6225408,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1775089166000,"last_seen":1775089173000,"last_multi_scan":1775089173000}},"detections":{"summary":{"verdict":"malicious","score":74,"tags":["windows-server-utility","evasive"]},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":93},"sandbox_signatures":{"informative_count":202,"suspicious_count":10,"malicious_count":0,"total":212},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Adware.Lazy.2862","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Adware.Lazy.2862 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/GenKryptik_AGen.AZE trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Agent.cev","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"Malicious","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Adware.Lazy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Firmware","attack_id":"T1592.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1592/003","identifiers":[{"type":"informative","value":"Able to gather system firmware table (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","identifiers":[{"type":"informative","value":"May contain SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains ability to execute windows services"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Contains ability to access the loader directly (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Able to perform sandbox evasion using APIs"},{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Contains a Wine emulator-related string"},{"type":"informative","value":"Able to identify virtual/sandbox environment"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify virtual/sandbox environment devices"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"Able to detect virtual machine (string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Contains ability to retrieve information set for devices (API string)"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify System Firewall","attack_id":"T1562.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/004","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Defense Evasion","technique":"Clear Windows Event Logs","attack_id":"T1070.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/001","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to delete device driver (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"},{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"},{"type":"informative","value":"Strings related to file managers detected"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Calls APIs used for find file/directory path"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"References to WMI query strings used to retrieve disk information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve windows environment variables"},{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Calls an API used to retrieve geographical location information"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"References to WMI query strings used to retrieve network adapter information"},{"type":"informative","value":"Found registry location string related to BIOS"},{"type":"informative","value":"Able to identify Internet Explorer version from registry"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Calls an API used to retrieve process information"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve TCP/IP network configuration"},{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Able to access Steam setting"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Contains ability to scan the ARP cache"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Contains ability to perform remote procedure calls (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"suspicious","value":"Contains ability to create directories"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"References filepaths used to store data"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Collection","technique":"Code Repositories","attack_id":"T1213.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1213/003","identifiers":[{"type":"informative","value":"Able to access code repositories"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Uses cURL to communicate over HTTPS"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"informative","value":"Able to use IDE tunneling for remote connection"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"},{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to transfer data using curl"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Shows ability to use asymmetric encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Calls an API used to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to stop windows services"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to access Steam setting","description":"file/memory contains long string with (Indicator: \"software\\valve\\steam\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1518","relevance":1,"id":"string-763","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"_NalFreeMemoryNonPagedEx: Memory entry 0x%p is not entered into the table. Not freeing anything.\" (Indicator: \"FreeMemory\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"ZwMapViewOfSection\" (Indicator: \"ZwMapViewOfSection\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"LoadLibrary Injector\" (Indicator: \"LoadLibrary\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"ZwSetValueKey\" (Indicator: \"ZwSetValueKey\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$26","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform remote procedure calls (API string)","description":"Found reference to API \"RpcStringFreeA\" (Indicator: \"RpcStringFree\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-160","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"MAPMEM.SYS: ZwUnmapViewOfSection failed\" (Indicator: \"UnmapViewOfSection\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$27","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$29","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"file/memory contains long string with (Indicator: \"\\msvcp140.dll\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2e","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2f","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"https://github.com/ocornut/imgui/blob/master/docs/FAQ.md#qa-usage\" (Indicator: \"github.com\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect virtual machine (string)","description":"Found string \"C:\\windows\\system32\\drivers\\vmmouse.sys\" (File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found string \"C:\\windows\\system32\\drivers\\vmhgfs.sys\" (File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found string \"C:\\windows\\system32\\drivers\\VBoxMouse.sys\" (File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found string \"C:\\windows\\system32\\drivers\\VBoxGuest.sys\" (File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-989","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"file/memory contains long string(File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found string \"get PNPDeviceID /format:list 2>nul | findstr PNPDeviceID\" (File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found string \"wmic csproduct get UUID /format:list 2>nul | findstr UUID\" (File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-688","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system firmware table (API string)","description":"file/memory contains long string(File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1592.003","relevance":1,"id":"string-902","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify Internet Explorer version from registry","description":"file/memory contains long string(File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-898","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"GetSystemFirmwareTable\" (Indicator: \"GetSystemFirmwareTable\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"file/memory contains long string with (Indicator: \"software\\microsoft\\windows\\currentversion\\explorer\\recentdocs\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"C:\\windows\\system32\\drivers\\vmmouse.sys\" (Indicator: \"vmmouse\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found string \"C:\\windows\\system32\\drivers\\vmhgfs.sys\" (Indicator: \"vmhgfs\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found string \"C:\\windows\\system32\\drivers\\VBoxMouse.sys\" (Indicator: \"VBoxMouse\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found string \"C:\\windows\\system32\\drivers\\VBoxGuest.sys\" (Indicator: \"VBoxGuest\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment devices","description":"Found string \"C:\\windows\\system32\\drivers\\VBoxGuest.sys\" (Indicator: \"\\vboxguest\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-667","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"getaddrinfo() thread failed to start\" (Indicator: \"getaddrinfo\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\"\n Found system information discovery API: \"GetMonitorInfoW\" in file \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\"\n Found system information discovery API: \"NtQuerySystemInformation\" in file \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"FindWindowA\" (Indicator: \"findwindow\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls APIs used for find file/directory path","description":"Observed import api PathFindFileName (Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-183","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains a Wine emulator-related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":5,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 36522-6480-000000014005CFA5\n GetTickCount@KERNEL32.dll at 36522-6738-000000014006AEBA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 36522-16040-0000000140127F49","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 36522-16040-0000000140127F49","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.dll at 36522-5880-00000001400AA1D0\n GetLocaleInfoA@KERNEL32.dll at 36522-7568-00000001400ABA2E\n GetLocaleInfoEx@KERNEL32.dll at 36522-9143-00000001401265D5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"nul | findstr PNPDeviceID\" (Indicator: \"findstr \"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found string \"wmic csproduct get UUID /format:list 2>nul | findstr UUID\" (Indicator: \"findstr \"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1552","relevance":1,"id":"string-334","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"No password part in the URL\" (Indicator: \"password\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found string \"Bad password\" (Indicator: \"password\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found string \"schannel: Failed to import cert file %s, password is bad\" (Indicator: \"password\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found string \"Excessive password length for proxy auth\" (Indicator: \"password\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found string \"secret_ownerid_fetcher\" (Indicator: \"secret\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found string \"password\" (Indicator: \"password\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"$49","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Strings related to file managers detected","description":"\"a /q \"%systemdrive%\\ProgramData\\Origin\\NonOriginContentCache\\*\"del /s /f /a:h /a:a /q \"%systemdrive%\\ProgramData\\Origin\\Subscription\\*\"del /s /f /a:h /a:a /q \"%systemdrive%\\ProgramData\\Origin\\Telemetry\\*\"rd /s /a:h /a:a /q \"%systemdrive%\\ProgramData\\Origin\"for /f \"skip=2 tokens=3*\" %%i in ('netsh interface show interface') do (netsh int ip set address \"%%j\" dhcpnetsh int ip set dns \"%%j\" dhcpnetsh interface set interface name=\"%%j\" admin=enablednetsh advfirewall resetecho offdel /f \"C:\\Windows\\win.ini\"del /f \"C:\\Riot Games\\VALORANT\\live\\Manifest_NonUFSFiles_Win64.txt\"del /f \"C:\\Riot Games\\VALORANT\\live\\Engine\\Binaries\\ThirdParty\\CEF3\\Win64\\icudtl.dat\"del /f \"C:\\Riot Games\\Riot Client\\UX\\Plugins\\plugin-manifest.json\"del /f \"C:\\Riot Games\\Riot Client\\UX\\icudtl.dat\"del /f \"C:\\Riot Games\\Riot Client\\UX\\natives_blob.bin\"del /f \"C:\\Users\\%username%\\AppData\\Local\\Microsoft\\Vault\\UserProfileRoaming\\Latest.dat\"del /f \"C:\\Users\\%username%\\AppData\\Local\\AC\\INetCookies\\ESE\\container.dat\" (Indicator: \"\\win.ini\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":3,"id":"string-136","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigW\" (Indicator: \"changeserviceconfigw\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyA\" in file \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"System Security","name":"Calls an API used to change the configuration parameters of a service","description":"Observed import api \"ChangeServiceConfig\" which can be \"used to change the configuration parameters of a service\" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-193","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device driver (API string)","description":"Found reference to API \"Nal Windows Driver Unload: IoDeleteDevice NOT called: NULL DeviceObject\" (Indicator: \"IoDeleteDevice\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"IoDeleteDevice\" (Indicator: \"IoDeleteDevice\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-463","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown and remove SSL, start\" (Indicator: \"shutdown \") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\n Observed string: \"shutdown and remove SSL, done -> %d\" (Indicator: \"shutdown \") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\n Observed string: \"shutdown -> %d, done=%d\" (Indicator: \"shutdown \") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to stop windows services","description":"file/memory contains long string with (Indicator: \"net stop\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-522","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$4f","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"System Security","name":"May contain SSL certificate","description":"\"-----BEGIN CERTIFICATE-----\" (Indicator: \"----begin certificate----\") in Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin","origin":"File/Memory","mitre_attack_id":"T1588.004","relevance":1,"id":"string-574","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"$50","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/26 Antivirus vendors marked sample as malicious (19% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"suspicious","category":"General","name":"Contains ability to create directories","description":"CreateDirectoryA@KERNEL32.dll at 36522-6471-000000014005C76C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1074.001","relevance":3,"id":"stream-102","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Able to perform sandbox evasion using APIs","description":"Observed import api \"GetSystemFirmwareTable\" which can \"Retrieves the specified firmware table\" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin]\n Observed import api \"NtQuerySystemInformation\" which can \"Retrieves system information\" [Source: 666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin]","origin":"Static Parser","mitre_attack_id":"T1497.001","relevance":1,"id":"static-184","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"$51","origin":"File/Memory","mitre_attack_id":"T1547","relevance":5,"id":"string-184","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to scan the ARP cache","description":"Found string \"cmd.exe /c arp -d\" (Indicator: \"cmd.exe /c arp\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")\n Found string \"cmd.exe /c arp -d\" (Indicator: \"/c arp\"; File: \"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-363","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"$52","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$53","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtQueryInformationProcess@ntdll.dll at 36522-6147-0000000140047822","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$54","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]}],"incidents":[{"name":"Spyware","details_count":6,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"},{"detail":"Contains ability to read clipboard data"},{"detail":"Found browser information locations related strings"},{"detail":"Found desktop apps credentials related location strings"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Identified FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]},{"name":"Evasive","details_count":6,"details":[{"detail":"Checks a device property (often used to detect VM artifacts)"},{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":42,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["windows-server-utility","evasive"],"sandbox_reports":[{"id":"69cdb61458c651421707a3e3","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":74,"malware_family":"Gen:Variant.Adware.Lazy","submit_name":"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin","analysis_start_time":"2026-04-02T00:19:33+00:00","indicators_count":{"informative":202,"suspicious":49,"malicious":0},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69cdb61458c651421707a3e3"}],"processes":[{"pid":612,"ppid":0,"name":"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin.exe","command_line":"","sha256":"666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4","normalized_path":"C:\\666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4.bin.exe","uid":"00000000-00000612","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["rpcrt4.dll","shell32.dll","bcryptprimitives.dll","windows.storage.dll","ole32.dll","msvcp_win.dll","sechost.dll","dxgi.dll","combase.dll","shlwapi.dll","psapi.dll","msasn1.dll","bcrypt.dll","powrprof.dll","vcruntime140_1.dll","oleaut32.dll","vcruntime140.dll","ntdll.dll","apphelp.dll","user32.dll","win32u.dll","kernel.appcore.dll","msvcp140.dll","crypt32.dll","KernelBase.dll","SHCore.dll","setupapi.dll","GdiPlus.dll","userenv.dll","kernel32.dll","d3d11.dll","profapi.dll","imm32.dll","ws2_32.dll","winhttp.dll","dwmapi.dll","gdi32full.dll","cfgmgr32.dll","ucrtbase.dll","msvcrt.dll","gdi32.dll","advapi32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["69cdb61458c651421707a3e3"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Adware.Lazy.Generic Sample 666e31dee445… — Score 74/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 666e31dee445…. Malware family: Adware.Lazy.Generic. Threat score 74/100. 6/27 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4"}],["$","meta","4",{"property":"og:title","content":"Malicious Adware.Lazy.Generic Sample 666e31dee445… — Score 74/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 666e31dee445…. Malware family: Adware.Lazy.Generic. Threat score 74/100. 6/27 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/666e31dee445064bdba82e2f209e4aeb8ae314f03e77fc6e743a0d0f83fc31c4"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Adware.Lazy.Generic Sample 666e31dee445… — Score 74/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 666e31dee445…. Malware family: Adware.Lazy.Generic. Threat score 74/100. 6/27 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L55","11",{}]]