21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 6e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4e0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.MSIL.Basic.8 Sample 7f03083ac6ac… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7f03083ac6ac…. Malware family: Trojan.MSIL.Basic.8. Threat score 100/100. 20/27 AV engines flagged this file. 13 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e","keywords":["Malicious","Trojan.MSIL.Basic.8","malware analysis","sandbox report","threat intelligence","7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e"],"about":{"@type":"SoftwareApplication","name":"7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.MSIL.Basic.8","antivirusDetections":{"malicious":20,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T5af,Found string "SOFTWARE\\Valve\\Steam" (Indicator: "software\\valve\\steam"; File: "7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e.bin") Found string "SOFTWARE\Valve\Steam" (Indicator: "software\valve\steam"; Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "SOFTWARE\Valve\Steam" (Indicator: "software\valve\steam"; Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp") Found string "SOFTWARE\Valve\Steam" (Indicator: "software\valve\steam"; Source: "00000000-00003336.00000000.113191.04460000.00000004.mdmp, 00000000-00003336.00000001.113617.04460000.00000004.mdmp") Found string "SOFTWARE\Valve\Steam" (Indicator: "software\valve\steam"; Source: "00000000-00004136.00000001.111103.04DA0000.00000004.mdmp") Found string "SOFTWARE\Valve\Steam" (Indicator: "software\valve\steam"; Source: "00000000-00004480.00000001.111212.058C0000.00000004.mdmp") Found string "SOFTWARE\Valve\Steam" (Indicator: "software\valve\steam"; Source: "00000000-00005096.00000001.111204.05400000.00000004.mdmp") Found string "SOFTWARE\Valve\Steam" (Indicator: "software\valve\steam"; Source: "00000000-00005144.00000000.113190.052A0000.00000004.mdmp, 00000000-00005144.00000001.113604.052A0000.00000004.mdmp") Found string "SOFTWARE\Valve\Steam" (Indicator: "software\valve\steam"; Source: "00000000-00005332.00000000.113148.05500000.00000004.mdmp")23:T1225,Found string "Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression" (Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "compression" (Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "GZipStream" (Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "unknown compression method (0x{0:X2})2" (Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "Writing with decompression is not supported.|" (Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "Reading with compression is not supported.F" (Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "ZipFile: {0}" (Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "ZipFile::{0}@" (Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "Cannot read that as a ZipFile" (Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "The number of entries is 65535 or greater. Consider setting the UseZip64WhenSaving property on the ZipFile instance.^" (Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "ZipFile::Save: could not delete temp file: {0}." (Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "Unsupported compression method.\" (Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "The entry you are trying to add uses another compression method.r" (Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "Use OpenReader() only with ZipFile.h" (Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "You must call ZipFile.Save before calling OpenReader" (Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "Use Extract() only with ZipFile.x" (Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "You must call ZipFile.Save before calling any Extract method$" (Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "Entry {0} uses an unsupported compression method (0x{1:X2}, {2})"" (Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp 00000000-00002080.00000001.112767.04B50000.00000004.mdmp"), Found string "Offset within the zip archive exceeds 0xFFFFFFFF. Consider setting the UseZip64WhenSaving property on the ZipFile instance.R" (Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp 00000000-00002080.00000001.112767.04B50000.00000004.mdmp"), Found string "Compressed or Uncompressed size or offset exceeds the maximum value. Consider setting the UseZip64WhenSaving property on the ZipFile instance.D" (Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp 00000000-00002080.00000001.112767.04B50000.00000004.mdmp"), Found string "The archive requires a ZIP64 Central Directory. Consider setting the ZipFile.UseZip64WhenSaving property." (Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp 00000000-00002080.00000001.112767.04B50000.00000004.mdmp"), Found string "Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression" (Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp"), Found string "compression" (Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp"), Found string "GZipStream" (Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp"), Found string "unknown compression method (0x{0:X2})2" (Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp")24:T400,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "conhost.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "conhost.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "conhost.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "conhost.exe"25:T1a42,Found reference to "FoMvRC2SkDwP0A1QbyV" (Indicator: "RC2"; File: "7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e.bin") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; File: "7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e.bin") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; File: "7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e.bin") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; File: "7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e.bin") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e.bin") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp")26:T531,"nul\r\ncd \"" (Indicator: "w32tm "; File: "7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e.bin"), Found string "@echo off\r\nw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul\r\ndel /a /q /f \"" (Indicator: "w32tm "; File: "7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e.bin") Found string "@echo off\r\nw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul\r\nstart \"\" \"" (Indicator: "w32tm "; File: "7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e.bin"), Found string "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul" (Indicator: "w32tm "; Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp 00000000-00002080.00000001.112767.04B50000.00000004.mdmp"), Found string "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul" (Indicator: "w32tm "; Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp"), Found string "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul" (Indicator: "w32tm "; Source: "00000000-00003336.00000000.113191.04460000.00000004.mdmp 00000000-00003336.00000001.113617.04460000.00000004.mdmp"), Found string "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul" (Indicator: "w32tm "; Source: "00000000-00004136.00000001.111103.04DA0000.00000004.mdmp"), Found string "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul" (Indicator: "w32tm "; Source: "00000000-00004480.00000001.111212.058C0000.00000004.mdmp"), Found string "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul" (Indicator: "w32tm "; Source: "00000000-00005096.00000001.111204.05400000.00000004.mdmp"), Found string "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul" (Indicator: "w32tm "; Source: "00000000-00005144.00000000.113190.052A0000.00000004.mdmp 00000000-00005144.00000001.113604.052A0000.00000004.mdmp"), Found string "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul" (Indicator: "w32tm "; Source: "00000000-00005332.00000000.113148.05500000.00000004.mdmp")35:T9bb,"Idle.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "Idle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Idle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "Idle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "Idle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "Idle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "Idle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Idle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Idle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Idle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "Idle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "Idle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "Idle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "Idle.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")36:T96d,"Idle.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Idle.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Idle.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Idle.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Idle.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Idle.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Idle.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Idle.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Idle.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "Idle.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "Idle.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "Idle.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "Idle.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "Idle.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "Idle.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "Idle.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "Idle.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "Idle.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "Idle.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "Idle.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "Idle.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "Idle.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "Idle.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "Idle.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "Idle.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")37:T4cf,"Idle.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "Idle.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Idle.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Idle.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "Idle.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "Idle.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "Idle.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "Idle.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "Idle.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "Idle.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")38:T55b,"", Potential IP "4.0.0.0" found in string "4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a" allowDefiniti" Potential IP "4.0.0.0" found in string "n=4.0.0.0, Cul" Potential IP "4.0.0.0" found in string "ion=4.0.0.0, C" "2.5.29.10" "2.5.29.19" "2.5.29.14" "2.5.29.15" "2.5.29.37" Potential IP "4.0.0.0" found in string "ystem.Drawing,4.0.0.0,,b03f5f7f11d50a3a" Potential IP "4.0.0.0" found in string "ystem.Deployment,4.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "4.0.0.0" found in string "ystem.Runtime.Serialization.Formatters.Soap,4.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "4.0.0.0" found in string "ystem,4.0.0.0,,b77a5c561934e089" Potential IP "4.0.0.0" found in string "4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>", Potential IP "4.0.0.0" found in string "n=4.0.0.0 Culture", Potential IP "4.0.0.0" found in string "Soap 4.0.0.0 b03f5f7f11d50a3a MSIL", Potential IP "4.0.0.0" found in string "4.0.0.0 Culture4s", Potential IP "4.0.0.0" found in string "4.0.0.0 K}2Kt)", Potential IP "4.0.0.0" found in string "4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089", Potential IP "4.0.0.0" found in string "=4.0.0.0", Potential IP "4.0.0.0" found in string "ion=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a" requirePermission="false" />" Potential IP "4.0.0.0" found in string ".Formatters.Soap,4.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "4.0.0.0" found in string "=4.0.0.0, Cultu" Potential IP "4.0.0.0" found in string "4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />", Potential IP "4.0.0.0" found in string "4.0.0.0 Culture", Potential IP "4.0.0.0" found in string "on=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a" allowLocation="false" />" Potential IP "4.0.0.0" found in string "n=4.0.0.0, C" Potential IP "4.0.0.0" found in string "=4.0.0.0, Cultur4" Potential IP "4.0.0.0" found in string "sion=4.0.0.0, CuF"55:T1438,Heuristic match: "f+(9.co" Heuristic match: "ipinfo.io" Heuristic match: "cn394214.tw1.ru" Heuristic match: "soft.net" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "ystem.windows.fo" Heuristic match: "m.web.co" Heuristic match: "/.net/netclasses/httpwebrequest/connect__group$$/" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#withcomments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/tr/1999/rec-xpath-19991116" Pattern match: "http://www.w3.org/tr/1999/rec-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#xml" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://schemas.microsoft.com/.netconfiguration/v2.0" Pattern match: "system.web/anonymousidentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browsercaps" Pattern match: "system.web/clienttarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customerrors" Pattern match: "system.web/deployment" Pattern match: "system.web/devicefilters" Pattern match: "system.web/fulltrustassemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthmonitoring" Pattern match: "system.web/hostingenvironment" Pattern match: "system.web/httpcookies" Pattern match: "system.web/httphandlers" Pattern match: "system.web/httpmodules" Pattern match: "system.web/httpruntime" Pattern match: "system.web/identity" Pattern match: "system.web/machinekey" Pattern match: "system.web/membership" Pattern match: "system.web/mobilecontrols" Pattern match: "system.web/pages" Pattern match: "system.web/partialtrustvisibleassemblies" Pattern match: "system.web/processmodel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/rolemanager" Pattern match: "system.web/securitypolicy" Pattern match: "system.web/sessionpagestate" Pattern match: "system.web/sessionstate" Pattern match: "system.web/sitemap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlmappings" Pattern match: "system.web/webcontrols" Pattern match: "system.web/webparts" Pattern match: "system.web/webservices" Pattern match: "system.web/xhtmlconformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputcache" Pattern match: "system.web/caching/outputcachesettings" Pattern match: "system.web/caching/sqlcachedependency" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "system.web/rolh" Heuristic match: "osoft.windows.co" Heuristic match: "ystem.drawing.ni" Heuristic match: "me=system.data.rs" Heuristic match: "5~.ke" Heuristic match: "lowdefin^|.kn" Heuristic match: "ystem.se" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://go.microsoft.com/fwlink/?linkic" Heuristic match: "ion.ni" Heuristic match: "t=.com;.exe;.ba" Heuristic match: "system.co"56:Ta222,Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\globalization\idle.exe.configc:\windows\globalization\idle.exe.configfile:///c:/windows/globalization/idle.exec:/windows/globalization/idle.exec:\windows\globalization\idle.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\path2path1c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptormachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\0v-" - Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\globalization\idle.exe.configc:\windows\globalization\idle.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userte" - Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\globalization\idle.exe.configc:\windows\globalization\idle.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userte" - Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00003336.00000000.113191.04460000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\globalization\idle.exe.configc:\windows\globalization\idle.exe.configfile:///c:/windows/globalization/idle.exec:/windows/globalization/idle.exec:\windows\globalization\idle.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\path2path1c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptormachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\0v/" - Source: "00000000-00003336.00000000.113191.04460000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00003336.00000001.113617.04460000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\globalization\idle.exe.configc:\windows\globalization\idle.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userte" - Source: "00000000-00003336.00000001.113617.04460000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00003336.00000001.113617.04460000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004136.00000000.110044.02890000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004136.00000001.111103.02890000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00004136.00000001.111103.04DA0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\recovery\conhost.exe.configc:\recovery\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_usernnot" - Source: "00000000-00004136.00000001.111103.04DA0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00004136.00000001.111103.04DA0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004480.00000000.110040.03090000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004480.00000001.111212.03090000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00004480.00000001.111212.058C0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\globalization\idle.exe.configc:\windows\globalization\idle.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_useres," - Source: "00000000-00004480.00000001.111212.058C0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00004480.00000001.111212.058C0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005096.00000000.110117.02A00000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005096.00000001.111204.02A00000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkicxui" - Source: "00000000-00005096.00000001.111204.02AD1000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00005096.00000001.111204.05400000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\program" - Source: "00000000-00005096.00000001.111204.05400000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00005096.00000001.111204.05400000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00005144.00000000.113190.052A0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\recovery\conhost.exe.configc:\recovery\conhost.exe.configfile:///c:/recovery/conhost.exec:/recovery/conhost.exec:\recovery\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\path2path1c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptormachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\0v-" - Source: "00000000-00005144.00000000.113190.052A0000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00005144.00000001.113604.052A0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\recovery\conhost.exe.configc:\recovery\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfter0for" - Source: "00000000-00005144.00000001.113604.052A0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00005144.00000001.113604.052A0000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00005332.00000000.113148.05500000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\program" - Source: "00000000-00005332.00000000.113148.05500000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005332.00000000.113148.05500000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00005332.00000000.113148.05500000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005792.00000000.111505.03180000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00005792.00000000.111505.04F80000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\recovery\conhost.exe.configc:\recovery\conhost.exe.configfile:///c:/recovery/conhost.exec:/recovery/conhost.exec:\recovery\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\path2path1c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptormachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00005792.00000000.111505.04F80000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005792.00000000.111505.04F80000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00005792.00000000.111505.04F80000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00005792.00000001.111862.04F80000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\recovery\conhost.exe.configc:\recovery\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_usernnot" - Source: "00000000-00005792.00000001.111862.04F80000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00005792.00000001.111862.04F80000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00006860.00000000.111726.04A00000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\program" - Source: "00000000-00006860.00000000.111726.04A00000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006860.00000000.111726.04A00000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00006860.00000000.111726.04A00000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00006860.00000001.112061.04A00000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\program" - Source: "00000000-00006860.00000001.112061.04A00000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00006860.00000001.112061.04A00000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00006968.00000000.113190.04E00000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\immersivecontrolpanel\microsoft.system.package.metadata\autogen\csrss.exe.configc:\windows\immersivecontrolpanel\microsoft.system.package.metadata\autogen\csrss.exe.configfile:///c:/windows/immersivecontrolpanel/microsoft.system.package.metadata/autogen/csrss.exec:/windows/immersivecontrolpanel/microsoft.system.package.metadata/autogen/csrss.exec:\windows\immersivecontrolpanel\microsoft.system.package.metadata\autogen\csrss.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\path2path1c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptormachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\0v0" - Source: "00000000-00006968.00000000.113190.04E00000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00006968.00000001.113601.04E00000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\immersivecontrolpanel\microsoft.system.package.metadata\autogen\csrss.exe.configc:\windows\immersivecontrolpanel\microsoft.system.package.metadata\autogen\csrss.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_user" - Source: "00000000-00006968.00000001.113601.04E00000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00006968.00000001.113601.04E00000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007488.00000000.110043.02700000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007488.00000001.111201.02700000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00007488.00000001.111201.05200000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\immersivecontrolpanel\microsoft.system.package.metadata\autogen\csrss.exe.configc:\windows\immersivecontrolpanel\microsoft.system.package.metadata\autogen\csrss.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_usered.fpngcop(" - Source: "00000000-00007488.00000001.111201.05200000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007488.00000001.111201.05200000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007568.00000000.109655.02810000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00007568.00000000.109655.04BF0000.00000004.mdmp") Found URL "http://cn394214.tw1.ru/@=ewm1ewyirzn" - Source: "00000000-00007568.00000000.109655.04BF0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1290eff48e8094d0\idle.exe.configc:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1290eff48e8094d0\idle.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_user" - Source: "00000000-00007568.00000000.109655.04BF0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007568.00000000.109655.04BF0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007568.00000001.111577.02810000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czco!yj>9iqmgvw,czc[(;1fwr/" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,17addtrust" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9'://crl.veris" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://www.micbeswxc\*25vj+q8" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?ign.vslo&1!0>1xsecom" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.132.0.34ecdp1.3.132.0.32ecdp1.3.132.0.30@eckp1.2.840.10045.3.1.7@eckp1.3.132.0.30@eckp2.23.43.1.4.9ecdp1.3.132.0.33ecdp1.3.132.0.33@eckp1.3.132.0.34@eckp1.3.132.0.35ecdp" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://microsoft.com0!n" - Source: "00000000-00007568.00000001.111577.1DD50000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007568.00000002.113496.02810000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czco!yj>9iqmgvw,czc[(;1fwr/" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,17addtrust" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9'://crl.veris" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://www.micbeswxc\*25vj+q8" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?ign.vslo&1!0>1xsecom" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.132.0.34ecdp1.3.132.0.32ecdp1.3.132.0.30@eckp1.2.840.10045.3.1.7@eckp1.3.132.0.30@eckp2.23.43.1.4.9ecdp1.3.132.0.33ecdp1.3.132.0.33@eckp1.3.132.0.34@eckp1.3.132.0.35ecdp" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://microsoft.com0!n" - Source: "00000000-00007568.00000002.113496.1DD50000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007668.00000000.113946.029D9000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00007668.00000000.113946.04C00000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\immersivecontrolpanel\microsoft.system.package.metadata\autogen\csrss.exe.configc:\windows\immersivecontrolpanel\microsoft.system.package.metadata\autogen\csrss.exe.configfile:///c:/windows/immersivecontrolpanel/microsoft.system.package.metadata/autogen/csrss.exec:/windows/immersivecontrolpanel/microsoft.system.package.metadata/autogen/csrss.exec:\windows\immersivecontrolpanel\microsoft.system.package.metadata\autogen\csrss.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\path2path1c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptormachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00007668.00000000.113946.04C00000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007668.00000000.113946.04C00000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007668.00000000.113946.04C00000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00007684.00000000.113948.04C10000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\recovery\conhost.exe.configc:\recovery\conhost.exe.configfile:///c:/recovery/conhost.exec:/recovery/conhost.exec:\recovery\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\path2path1c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptormachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00007684.00000000.113948.04C10000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007684.00000000.113948.04C10000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007684.00000000.113948.04C10000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00007792.00000000.112398.05110000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\recovery\conhost.exe.configc:\recovery\conhost.exe.configfile:///c:/recovery/conhost.exec:/recovery/conhost.exec:\recovery\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\path2path1c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptormachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\0v." - Source: "00000000-00007792.00000000.112398.05110000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00007792.00000001.112791.05110000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\recovery\conhost.exe.configc:\recovery\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfterfor" - Source: "00000000-00007792.00000001.112791.05110000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007792.00000001.112791.05110000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00007832.00000000.114082.05060000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\globalization\idle.exe.configc:\windows\globalization\idle.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userte" - Source: "00000000-00007832.00000000.114082.05060000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007832.00000000.114082.05060000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008228.00000000.109263.03140000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00008228.00000001.109356.03140000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00008264.00000000.111531.04E00000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\immersivecontrolpanel\microsoft.system.package.metadata\autogen\csrss.exe.configc:\windows\immersivecontrolpanel\microsoft.system.package.metadata\autogen\csrss.exe.configfile:///c:/windows/immersivecontrolpanel/microsoft.system.package.metadata/autogen/csrss.exec:/windows/immersivecontrolpanel/microsoft.system.package.metadata/autogen/csrss.exec:\windows\immersivecontrolpanel\microsoft.system.package.metadata\autogen\csrss.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\path2path1c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptormachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\0v0" - Source: "00000000-00008264.00000000.111531.04E00000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00008264.00000001.111968.04E00000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\immersivecontrolpanel\microsoft.system.package.metadata\autogen\csrss.exe.configc:\windows\immersivecontrolpanel\microsoft.system.package.metadata\autogen\csrss.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_user" - Source: "00000000-00008264.00000001.111968.04E00000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00008264.00000001.111968.04E00000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00008328.00000000.112406.04A00000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00008328.00000001.112805.04A00000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\program" - Source: "00000000-00008328.00000001.112805.04A00000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00008328.00000001.112805.04A00000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00008468.00000000.113779.05600000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\program" - Source: "00000000-00008468.00000000.113779.05600000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00008468.00000000.113779.05600000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00008468.00000001.113905.05600000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\program" - Source: "00000000-00008468.00000001.113905.05600000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00008468.00000001.113905.05600000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00008800.00000000.112397.05000000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\immersivecontrolpanel\microsoft.system.package.metadata\autogen\csrss.exe.configc:\windows\immersivecontrolpanel\microsoft.system.package.metadata\autogen\csrss.exe.configfile:///c:/windows/immersivecontrolpanel/microsoft.system.package.metadata/autogen/csrss.exec:/windows/immersivecontrolpanel/microsoft.system.package.metadata/autogen/csrss.exec:\windows\immersivecontrolpanel\microsoft.system.package.metadata\autogen\csrss.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework64\v4.0.30319\c:\windows\microsoft.net\framework64\v4.0.30319\path2path1c:\windows\microsoft.net\framework64\v4.0.30319\configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptormachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\0v0" - Source: "00000000-00008800.00000000.112397.05000000.00000004.mdmp")57:T51b,Found string "POST / HTTP/1.1\r\nHost:" (Indicator: "HTTP/1.1"; File: "7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e.bin") Found string "POST / HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "POST / HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp") Found string "POST / HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00003336.00000000.113191.04460000.00000004.mdmp, 00000000-00003336.00000001.113617.04460000.00000004.mdmp") Found string "POST / HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004136.00000001.111103.04DA0000.00000004.mdmp") Found string "POST / HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004480.00000001.111212.058C0000.00000004.mdmp") Found string "POST / HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00005096.00000001.111204.05400000.00000004.mdmp") Found string "POST / HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00005144.00000000.113190.052A0000.00000004.mdmp, 00000000-00005144.00000001.113604.052A0000.00000004.mdmp") Found string "POST / HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00005332.00000000.113148.05500000.00000004.mdmp")58:T550,Found string "+ncalrpc:[OLEE0DC1C7B4854C36B8F98C552953F]" (Indicator: "ncalrpc"; Source: "00000000-00002080.00000000.112392.02D60000.00000004.mdmp, 00000000-00002080.00000001.112767.02D60000.00000004.mdmp") Found string "+ncalrpc:[OLEE6FD9DDCDEE704FBE301430CC788]" (Indicator: "ncalrpc"; Source: "00000000-00002956.00000000.111546.02D60000.00000004.mdmp, 00000000-00002956.00000001.112013.02D60000.00000004.mdmp") Found string "+ncalrpc:[OLEDA8B673C7575BFDB899FC10C18F1]" (Indicator: "ncalrpc"; Source: "00000000-00003336.00000000.113191.02580000.00000004.mdmp, 00000000-00003336.00000001.113617.02580000.00000004.mdmp") Found string "+ncalrpc:[OLE0C63840D9DE596D28F42DE7A6D1B]" (Indicator: "ncalrpc"; Source: "00000000-00004136.00000001.111103.02890000.00000004.mdmp") Found string "+ncalrpc:[OLE3DD10905DA1ADCE0E3E2D918D5CA]" (Indicator: "ncalrpc"; Source: "00000000-00004480.00000001.111212.03090000.00000004.mdmp") Found string "ncalrpc" (Indicator: "ncalrpc"; Source: "00000000-00005096.00000001.111204.02A27000.00000004.mdmp") Found string "+ncalrpc:[OLE7C6010BACDE8F35FFDEE275406A7]" (Indicator: "ncalrpc"; Source: "00000000-00005144.00000000.113190.03400000.00000004.mdmp, 00000000-00005144.00000001.113604.03400000.00000004.mdmp") Found string "ncalrpc" (Indicator: "ncalrpc"; Source: "00000000-00005332.00000000.113148.03313000.00000004.mdmp")59:Tdaa,Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp") Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp") Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00003336.00000001.113617.04460000.00000004.mdmp") Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00003336.00000001.113617.04460000.00000004.mdmp") Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00004136.00000001.111103.04DA0000.00000004.mdmp, 00000000-00004136.00000001.111103.1DF60000.00000004.mdmp") Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00004136.00000001.111103.04DA0000.00000004.mdmp") Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00004480.00000001.111212.058C0000.00000004.mdmp") Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00004480.00000001.111212.058C0000.00000004.mdmp") Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005096.00000001.111204.02AD1000.00000004.mdmp, 00000000-00005096.00000001.111204.05400000.00000004.mdmp") Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005096.00000001.111204.05400000.00000004.mdmp") Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005144.00000001.113604.052A0000.00000004.mdmp") Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005144.00000001.113604.052A0000.00000004.mdmp") Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005332.00000000.113148.05500000.00000004.mdmp")5a:T90d,"" (Indicator: "password"; Source: "00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "Missing password.`" (Indicator: "password"; Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp") Found string "bad password." (Indicator: "password"; Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp") Found string "Supply a password to use AES encryption." (Indicator: "password"; Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp") Found string "This entry requires a password.6" (Indicator: "password"; Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp") Found string "The password did not match." (Indicator: "password"; Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp")5e:T4d3,Found string "hostname" (Indicator: "hostname"; File: "7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e.bin") Found string "hostname" (Indicator: "hostname"; Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "hostname" (Indicator: "hostname"; Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp") Found string "hostname" (Indicator: "hostname"; Source: "00000000-00003336.00000000.113191.04460000.00000004.mdmp, 00000000-00003336.00000001.113617.04460000.00000004.mdmp") Found string "hostname" (Indicator: "hostname"; Source: "00000000-00004136.00000001.111103.04DA0000.00000004.mdmp") Found string "hostname" (Indicator: "hostname"; Source: "00000000-00004480.00000001.111212.058C0000.00000004.mdmp") Found string "hostname" (Indicator: "hostname"; Source: "00000000-00005096.00000001.111204.05400000.00000004.mdmp") Found string "hostname" (Indicator: "hostname"; Source: "00000000-00005144.00000000.113190.052A0000.00000004.mdmp, 00000000-00005144.00000001.113604.052A0000.00000004.mdmp") Found string "hostname" (Indicator: "hostname"; Source: "00000000-00005332.00000000.113148.05500000.00000004.mdmp")5f:T79a,Found string "SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')" (Indicator: " Win32_PnPEntity"; File: "7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e.bin") Found string "SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')" (Indicator: " Win32_PnPEntity"; Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')" (Indicator: " Win32_PnPEntity"; Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp") Found string "SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')" (Indicator: " Win32_PnPEntity"; Source: "00000000-00003336.00000000.113191.04460000.00000004.mdmp, 00000000-00003336.00000001.113617.04460000.00000004.mdmp") Found string "SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')" (Indicator: " Win32_PnPEntity"; Source: "00000000-00004136.00000001.111103.04DA0000.00000004.mdmp") Found string "SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')" (Indicator: " Win32_PnPEntity"; Source: "00000000-00004480.00000001.111212.058C0000.00000004.mdmp") Found string "SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')" (Indicator: " Win32_PnPEntity"; Source: "00000000-00005096.00000001.111204.05400000.00000004.mdmp") Found string "SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')" (Indicator: " Win32_PnPEntity"; Source: "00000000-00005144.00000000.113190.052A0000.00000004.mdmp, 00000000-00005144.00000001.113604.052A0000.00000004.mdmp") Found string "SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')" (Indicator: " Win32_PnPEntity"; Source: "00000000-00005332.00000000.113148.05500000.00000004.mdmp")60:T5cf,"" (Indicator: "SeDebugPrivilege"; Source: "00000000-00004480.00000001.111212.1E7A0000.00000004.mdmp"), Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00005096.00000001.111204.05400000.00000004.mdmp"), Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00005144.00000001.113604.052A0000.00000004.mdmp")63:T4c1,Observed string: "shutdown" (Indicator: "shutdown") in Source: 600028d-ctor Observed string: "shutdown" (Indicator: "shutdown") in Source: 00000000-00002080.00000000.112392.04B50000.00000004.mdmp 00000000-00002080.00000001.112767.04B50000.00000004.mdmp Observed string: "shutdown" (Indicator: "shutdown") in Source: 00000000-00002956.00000001.112013.04B70000.00000004.mdmp Observed string: "shutdown" (Indicator: "shutdown") in Source: 00000000-00003336.00000000.113191.04460000.00000004.mdmp 00000000-00003336.00000001.113617.04460000.00000004.mdmp Observed string: "shutdown" (Indicator: "shutdown") in Source: 00000000-00004136.00000001.111103.04DA0000.00000004.mdmp Observed string: "shutdown" (Indicator: "shutdown") in Source: 00000000-00004480.00000001.111212.058C0000.00000004.mdmp Observed string: "shutdown" (Indicator: "shutdown") in Source: 00000000-00005096.00000001.111204.05400000.00000004.mdmp Observed string: "shutdown" (Indicator: "shutdown") in Source: 00000000-00005144.00000000.113190.052A0000.00000004.mdmp 00000000-00005144.00000001.113604.052A0000.00000004.mdmp Observed string: "shutdown" (Indicator: "shutdown") in Source: 00000000-00005332.00000000.113148.05500000.00000004.mdmp64:T6e7,Found string "Antivirus" (Indicator: "antivir"; File: "7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e.bin") Found string "Antivirus:" (Indicator: "antivir"; Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "Antivirus" (Indicator: "antivir"; Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "Antivirus:" (Indicator: "antivir"; Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp") Found string "Antivirus" (Indicator: "antivir"; Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp") Found string "Antivirus:" (Indicator: "antivir"; Source: "00000000-00003336.00000000.113191.04460000.00000004.mdmp, 00000000-00003336.00000001.113617.04460000.00000004.mdmp") Found string "Antivirus" (Indicator: "antivir"; Source: "00000000-00003336.00000000.113191.04460000.00000004.mdmp, 00000000-00003336.00000001.113617.04460000.00000004.mdmp") Found string "Antivirus:" (Indicator: "antivir"; Source: "00000000-00004136.00000001.111103.04DA0000.00000004.mdmp") Found string "Antivirus" (Indicator: "antivir"; Source: "00000000-00004136.00000001.111103.04DA0000.00000004.mdmp") Found string "Antivirus:" (Indicator: "antivir"; Source: "00000000-00004480.00000001.111212.058C0000.00000004.mdmp") Found string "Antivirus" (Indicator: "antivir"; Source: "00000000-00004480.00000001.111212.058C0000.00000004.mdmp") Found string "Antivirus:" (Indicator: "antivir"; Source: "00000000-00005096.00000001.111204.05400000.00000004.mdmp") Found string "Antivirus" (Indicator: "antivir"; Source: "00000000-00005096.00000001.111204.05400000.00000004.mdmp")65:T73e,"" (Indicator: "runtimebroker.exe") "C:\Windows\Microsoft.NET\FraC:\Program Files\Microsoft\EdgeUpdater\RuntimeBroker.exe" (Indicator: "runtimebroker.exe") ":\Users\HAPUBWS\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log" (Indicator: "runtimebroker.exe") "rogram files\microsoft\edgeupdater\runtimebroker.exe" (Indicator: "runtimebroker.exe") "RuntimeBroker.exe" (Indicator: "runtimebroker.exe") "RuntimeBroker.exe.config" (Indicator: "runtimebroker.exe") "C:\Program Files\Microsoft\EdgeUpdater\RuntimeBroker.exe.config" (Indicator: "runtimebroker.exe") "file:///C:/Program Files/Microsoft/EdgeUpdater/RuntimeBroker.exe" (Indicator: "runtimebroker.exe") "\??\C:\Program Files\Microsoft\EdgeUpdater\RuntimeBroker.exe.config" (Indicator: "runtimebroker.exe") "C:/Program Files/Microsoft/EdgeUpdater/RuntimeBroker.exe" (Indicator: "runtimebroker.exe")69:T4c7,Process "%WINDIR%\Globalization\Idle.exe" launched with commandline "" (UID: 00000000-00004480) Process "%WINDIR%\ImmersiveControlPanel\microsoft.system.package.metadata\Autogen\csrss.exe" launched with commandline "" (UID: 00000000-00007488) Process "%WINDIR%\ImmersiveControlPanel\microsoft.system.package.metadata\Autogen\csrss.exe" launched with commandline "" (UID: 00000000-00008264) Process "%WINDIR%\Globalization\Idle.exe" launched with commandline "" (UID: 00000000-00002956) Process "%WINDIR%\Globalization\Idle.exe" launched with commandline "" (UID: 00000000-00002080) Process "%WINDIR%\ImmersiveControlPanel\microsoft.system.package.metadata\Autogen\csrss.exe" launched with commandline "" (UID: 00000000-00008800) Process "%WINDIR%\ImmersiveControlPanel\microsoft.system.package.metadata\Autogen\csrss.exe" launched with commandline "" (UID: 00000000-00006968) Process "%WINDIR%\Globalization\Idle.exe" launched with commandline "" (UID: 00000000-00003336) Process "%WINDIR%\ImmersiveControlPanel\microsoft.system.package.metadata\Autogen\csrss.exe" launched with commandline "" (UID: 00000000-00007668) Process "%WINDIR%\Globalization\Idle.exe" launched with commandline "" (UID: 00000000-00007832)6a:T51a,"conhost.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [C:\Recovery\conhost.exe]- [targetUID: 00000000-00007792] "Idle.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [C:\found.000\dir0001.chk\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.17134.1_nl-nl_1290eff48e8094d0\Idle.exe]- [targetUID: 00000000-00002080] "OSPPSVC.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [%PROGRAMFILES%\(x86)\Internet Explorer\images\OSPPSVC.exe]- [targetUID: 00000000-00008228] "csrss.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [%WINDIR%\ImmersiveControlPanel\microsoft.system.package.metadata\Autogen\csrss.exe]- [targetUID: 00000000-00008264] "Idle.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [%WINDIR%\Globalization\Idle.exe]- [targetUID: 00000000-00002080] "RuntimeBroker.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [%PROGRAMFILES%\Microsoft\EdgeUpdater\RuntimeBroker.exe]- [targetUID: 00000000-00005096]6b:T5e2,Found string "schtasks.exe /delete /tn \"" (Indicator: "schtasks.exe /delete"; File: "7f03083ac6ac12edf7ea609f0fd333fa4cdb4270e72ea469e2c40cd5e19ab29e.bin"), Found string "schtasks.exe /delete /tn "" (Indicator: "schtasks.exe /delete"; Source: "00000000-00002080.00000000.112392.04B50000.00000004.mdmp, 00000000-00002080.00000001.112767.04B50000.00000004.mdmp") Found string "schtasks.exe /delete /tn "" (Indicator: "schtasks.exe /delete"; Source: "00000000-00002956.00000001.112013.04B70000.00000004.mdmp"), Found string "schtasks.exe /delete /tn "" (Indicator: "schtasks.exe /delete"; Source: "00000000-00003336.00000000.113191.04460000.00000004.mdmp, 00000000-00003336.00000001.113617.04460000.00000004.mdmp") Found string "schtasks.exe /delete /tn "" (Indicator: "schtasks.exe /delete"; Source: "00000000-00004136.00000001.111103.04DA0000.00000004.mdmp"), Found string "schtasks.exe /delete /tn "" (Indicator: "schtasks.exe /delete"; Source: "00000000-00004480.00000001.111212.058C0000.00000004.mdmp") Found string "schtasks.exe /delete /tn "" (Indicator: "schtasks.exe /delete"; Source: "00000000-00005096.00000001.111204.05400000.00000004.mdmp"), Found string "schtasks.exe /delete /tn "" (Indicator: "schtasks.exe /delete"; Source: "00000000-00005144.00000000.113190.052A0000.00000004.mdmp, 00000000-00005144.00000001.113604.052A0000.00000004.mdmp") Found string "schtasks.exe /delete /tn "" (Indicator: "schtasks.exe /delete"; Source: "00000000-00005332.00000000.113148.05500000.00000004.mdmp")6c:Tc39,19/26 Antivirus vendors marked spawned process "Idle.exe" (PID: 7568) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 19/26 Antivirus vendors marked spawned process "Idle.exe" (PID: 4480) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 19/26 Antivirus vendors marked spawned process "csrss.exe" (PID: 7488) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 19/26 Antivirus vendors marked spawned process "conhost.exe" (PID: 4136) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 19/26 Antivirus vendors marked spawned process "RuntimeBroker.exe" (PID: 5096) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 19/26 Antivirus vendors marked spawned process "conhost.exe" (PID: 5792) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 19/26 Antivirus vendors marked spawned process "csrss.exe" (PID: 8264) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 19/26 Antivirus vendors marked spawned process "Idle.exe" (PID: 2956) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 19/26 Antivirus vendors marked spawned process "RuntimeBroker.exe" (PID: 6860) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 19/26 Antivirus vendors marked spawned process "Idle.exe" (PID: 2080) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 19/26 Antivirus vendors marked spawned process "csrss.exe" (PID: 8800) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 19/26 Antivirus vendors marked spawned process "conhost.exe" (PID: 7792) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 19/26 Antivirus vendors marked spawned process "RuntimeBroker.exe" (PID: 8328) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 19/26 Antivirus vendors marked spawned process "RuntimeBroker.exe" (PID: 5332) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 19/26 Antivirus vendors marked spawned process "csrss.exe" (PID: 6968) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 19/26 Antivirus vendors marked spawned process "Idle.exe" (PID: 3336) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 19/26 Antivirus vendors marked spawned process "conhost.exe" (PID: 5144) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 19/26 Antivirus vendors marked spawned process "RuntimeBroker.exe" (PID: 8468) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 19/26 Antivirus vendors marked spawned process "conhost.exe" (PID: 7684) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 19/26 Antivirus vendors marked spawned process "csrss.exe" (PID: 7668) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 19/26 Antivirus vendors marked spawned process "Idle.exe" (PID: 7832) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate)6d:T4d6,Spawned process " HTTP/1.1 200 OK\naccess-control-allow-origin: *\nx-content-type-options: nosniff\ncontent-type: application/json; charset=utf-8\nContent-Length: 325\ndate: Fri\n 06 Feb 2026 16:28:08 GMT\nvary: accept-encoding\nvia: 1.1 google\nAlt-Svc: h3=\":443\"; ma=2592000\nh3-29=\":443\"; ma=2592000 with response body ==>7B0A2020226970223A202236342E3132342E31322E313632222C0A202022686F73746E616D65223A202236342E3132342E31322E3136322E696469612D313434.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6986166f67028bb53d0bf588"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$42","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6986166f67028bb53d0bf588"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"