26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] ad:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Wapomi.BA virus Sample 875ef5b3053d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 875ef5b3053d…. Malware family: Wapomi.BA virus. Threat score 100/100. 21/25 AV engines flagged this file. 14 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1","keywords":["Malicious","Wapomi.BA virus","malware analysis","sandbox report","threat intelligence","875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1"],"about":{"@type":"SoftwareApplication","name":"44112B6D303C7DF1528B55525872FEF0F08DE8C2A467F8E4D3B820F634F1F2C2.exe","applicationCategory":["peexe","executable"],"identifier":"875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Wapomi.BA virus","antivirusDetections":{"malicious":21,"total":25},"behavioralIndicators":{"malicious":14,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T6a0,file/memory contains long string(File: "7z.exe") Found string "invalid compression bit" (Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found string "unsupported compression algorithm" (Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found string "run length compression" (Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found string "zlib compression" (Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found string "compressionAlgorithm" (Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found string "invalid compression bit" (Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found string "unsupported compression algorithm" (Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found string "run length compression" (Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found string "zlib compression" (Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found string "compressionAlgorithm" (Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")28:T4d4,Found string "Content-Transfer-Encoding: base64%s" (Indicator: "Content-Transfer-Encoding: base64"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "Content-Transfer-Encoding: base64%s%s" (Indicator: "Content-Transfer-Encoding: base64"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "Content-Transfer-Encoding: base64%s" (Indicator: "Content-Transfer-Encoding: base64"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found string "Content-Transfer-Encoding: base64%s%s" (Indicator: "Content-Transfer-Encoding: base64"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found string "Content-Transfer-Encoding: base64%s" (Indicator: "Content-Transfer-Encoding: base64"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found string "Content-Transfer-Encoding: base64%s%s" (Indicator: "Content-Transfer-Encoding: base64"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")29:Tb43,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")2a:Ta9a,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") file/memory contains long string with (Indicator: "LoadLibrary"; File: "fTObFt.exe") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")2b:T470,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")2c:T485,Found reference to API "RpcStringFreeW" (Indicator: "RpcStringFree"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "RpcStringFreeA" (Indicator: "RpcStringFree"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "NdrServerCall2" (Indicator: "NdrServerCall2"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "NdrServerCall2" (Indicator: "NdrServerCall"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "RpcServerRegisterIfEx" (Indicator: "RpcServerRegisterIf"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "RpcBindingFree" (Indicator: "RpcBindingFree"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "RpcServerUseProtseqEpW" (Indicator: "RpcServerUse"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "RpcServerListen" (Indicator: "RpcServerListen"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1")2d:Tc00,Found reference to "DlSHA512 block transform for x86, CRYPTOGAMS by " (Indicator: "SHA512"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "HMAC routines" (Indicator: "HMAC"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "RC2_MAGIC_TO_METH" (Indicator: "RC2"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "RSA-SHA384" (Indicator: "SHA384"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "RSA-SHA512" (Indicator: "SHA512"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "HMAC-MD5" (Indicator: "HMAC"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "HMAC-SHA1" (Indicator: "HMAC"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "ecdsa-with-SHA384" (Indicator: "SHA384"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "ecdsa-with-SHA512" (Indicator: "SHA512"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "hmacWithSHA384" (Indicator: "SHA384"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "hmacWithSHA512" (Indicator: "SHA512"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "id-HMACGostR3411-94" (Indicator: "HMAC"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "HMAC GOST 34.11-94" (Indicator: "HMAC"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "RC2-CBC" (Indicator: "RC2"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "RC2-ECB" (Indicator: "RC2"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "RC2-CFB" (Indicator: "RC2"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "RC2-OFB" (Indicator: "RC2"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "PBE-SHA1-RC2-64" (Indicator: "RC2"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "pbeWithSHA1AndRC2-CBC" (Indicator: "RC2"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "RC2-40-CBC" (Indicator: "RC2"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "RC4-HMAC-MD5" (Indicator: "HMAC"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to "AES-128-CBC-HMAC-SHA1" (Indicator: "HMAC"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp")2e:T8e1,Found PE header "MZ" - Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002084.00000001.83879.001F0000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002796.00000001.80640.01700000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002872.00000000.88545.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00002872.00000001.89243.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003012.00000000.80268.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003012.00000001.81407.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003264.00000000.80114.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003264.00000001.80845.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003356.00000000.81682.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003356.00000001.83238.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003408.00000000.82164.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00003408.00000001.83263.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004356.00000000.78439.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004704.00000000.84197.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004704.00000001.84702.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004908.00000000.84985.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004908.00000001.85791.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004952.00000001.85265.00505000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005248.00000000.85539.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00005248.00000001.86827.00400000.00000040.mdmp")2f:T616,"875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" queried SystemProcessInformation at 00000000-00004356-00000105-17772990 [PID: 4356] "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" queried SystemProcessInformation at 00000000-00004356-00000105-17773453 [PID: 4356] "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" queried SystemProcessInformation at 00000000-00003264-00000105-16187757 [PID: 3264] "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" queried SystemProcessInformation at 00000000-00003264-00000105-16188319 [PID: 3264] "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" queried SystemProcessInformation at 00000000-00003012-00000105-22469505 [PID: 3012] "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" queried SystemProcessInformation at 00000000-00003012-00000105-22470016 [PID: 3012] "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" queried SystemProcessInformation at 00000000-00001952-00000105-31586251 [PID: 1952] "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" queried SystemProcessInformation at 00000000-00001952-00000105-31586873 [PID: 1952] "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" queried SystemProcessInformation at 00000000-00003356-00000105-29061673 [PID: 3356] "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" queried SystemProcessInformation at 00000000-00003356-00000105-29062199 [PID: 3356]30:T431,SetUnhandledExceptionFilter@KERNEL32.dll at 22399-234-00405C40 SetUnhandledExceptionFilter@KERNEL32.dll at 22399-235-00404E80 SetUnhandledExceptionFilter@KERNEL32.dll at 22399-400-004039C8 SetUnhandledExceptionFilter@KERNEL32.dll at 22399-4337-00409DB7 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004356-24844-27-004329EC SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004356-24844-6676-004329BB SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003264-31531-27-004329EC SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003264-31531-6673-004329BB SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003012-37598-27-004329EC SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003012-37598-6672-004329BB SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001952-46274-27-004329EC SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001952-46274-6672-004329BB SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003356-2016-27-004329EC SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003356-2016-6672-004329BB31:Tfda,Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found api reference "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found api reference "CryptSetHashParam" (Indicator: "CryptSetHashParam"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found api reference "CryptSetKeyParam" (Indicator: "CryptSetKeyParam"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp")32:T149b,Assembly shows XOR instruction xor eax ebp in Stream UID: 22399-234-00405C40 Assembly shows XOR instruction xor ecx ebp in Stream UID: 22399-234-00405C40 Assembly shows XOR instruction xor eax ebp in Stream UID: 22399-269-0040AB42 Assembly shows XOR instruction xor ecx ebp in Stream UID: 22399-269-0040AB42 Assembly shows XOR instruction xor eax ebp in Stream UID: 22399-270-0040CE03 Assembly shows XOR instruction xor ecx ebp in Stream UID: 22399-270-0040CE03 Assembly shows XOR instruction xor eax ecx in Stream UID: 22399-351-0040277F Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 22399-351-0040277F Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 22399-351-0040277F Assembly shows XOR instruction xor edx eax in Stream UID: 22399-351-0040277F Assembly shows XOR instruction xor eax ebp in Stream UID: 22399-382-0040BA37 Assembly shows XOR instruction xor ecx ebp in Stream UID: 22399-382-0040BA37 Assembly shows XOR instruction xor eax ebp in Stream UID: 22399-383-0040CF44 Assembly shows XOR instruction xor ecx ebp in Stream UID: 22399-383-0040CF44 Assembly shows XOR instruction xor eax ebp in Stream UID: 22399-385-0040CEFB Assembly shows XOR instruction xor ecx ebp in Stream UID: 22399-385-0040CEFB Assembly shows XOR instruction xor eax ebp in Stream UID: 22399-400-004039C8 Assembly shows XOR instruction xor eax ebp in Stream UID: 22399-433-00405FCC Assembly shows XOR instruction xor ecx ebp in Stream UID: 22399-433-00405FCC Assembly shows XOR instruction xor eax ebp in Stream UID: 22399-435-0040B64D Assembly shows XOR instruction xor ecx ebp in Stream UID: 22399-435-0040B64D Assembly shows XOR instruction xor eax ebp in Stream UID: 22399-437-0040627F Assembly shows XOR instruction xor ecx ebp in Stream UID: 22399-437-0040627F Assembly shows XOR instruction xor byte ptr [ebx] dh in Stream UID: 22399-451-0040D8CE Assembly shows XOR instruction xor esi dword ptr [206E410Ah+ecx] in Stream UID: 22399-451-0040D8CE Assembly shows XOR instruction xor al 0Dh in Stream UID: 22399-451-0040D8CE Assembly shows XOR instruction xor cl byte ptr [6E202D0Ah] in Stream UID: 22399-451-0040D8CE Assembly shows XOR instruction xor byte ptr [43202D0Ah] cl in Stream UID: 22399-451-0040D8CE Assembly shows XOR instruction xor byte ptr [edx] dh in Stream UID: 22399-451-0040D8CE Assembly shows XOR instruction xor eax 202D0A0Dh in Stream UID: 22399-451-0040D8CE Assembly shows XOR instruction xor byte ptr [ecx] dh in Stream UID: 22399-451-0040D8CE Assembly shows XOR instruction xor byte ptr [eax] dh in Stream UID: 22399-451-0040D8CE Assembly shows XOR instruction xor cl byte ptr [66202D0Ah] in Stream UID: 22399-451-0040D8CE Assembly shows XOR instruction xor eax 00500030h in Stream UID: 22399-451-0040D8CE Assembly shows XOR instruction xor dh byte ptr [ebx] in Stream UID: 22399-451-0040D8CE Assembly shows XOR instruction xor al 35h in Stream UID: 22399-451-0040D8CE Assembly shows XOR instruction xor esi dword ptr [ebp-08h] in Stream UID: 22399-471-0040A290 Assembly shows XOR instruction xor esi eax in Stream UID: 22399-471-0040A290 Assembly shows XOR instruction xor eax dword ptr [ebp-10h] in Stream UID: 22399-471-0040A290 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004356-24844-17-00427FAE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004356-24844-17-00427FAE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004356-24844-23-00424168 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004356-24844-23-00424168 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004356-24844-29-0042A57A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004356-24844-29-0042A57A Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00004356-24844-40-0043263E Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00004356-24844-47-00432553 Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00004356-24844-50-00432534 Assembly shows XOR instruction xor eax dword ptr [0050AD20h] in Stream UID: 00000000-00004356-24844-94-00438908 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004356-24844-170-004211DD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004356-24844-170-004211DD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004356-24844-185-0042E003 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004356-24844-185-0042E003 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004356-24844-205-0043CA35 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004356-24844-205-0043CA35 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004356-24844-243-00426AB6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004356-24844-243-00426AB6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004356-24844-259-00454AE0 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004356-24844-259-00454AE033:T6aa,Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CryptImportKey" (Indicator: "CryptImportKey"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CryptAcquireContextA" (Indicator: "CryptAcquireContext"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "CryptSetKeyParam" (Indicator: "CryptSetKeyParam"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1")34:T69f,Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CryptGenRandom" (Indicator: "CryptGenRandom"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CryptImportKey" (Indicator: "CryptImportKey"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1")35:Tca0,Found string "ANY PRIVATE KEY" (Indicator: "private key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "ENCRYPTED PRIVATE KEY" (Indicator: "private key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "Private Key" (Indicator: "private key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "Subject Public Key Info:" (Indicator: "public key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "%12sPublic Key Algorithm:" (Indicator: "public key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "%12sUnable to load Public Key" (Indicator: "public key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "Public Key" (Indicator: "public key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "%s PRIVATE KEY" (Indicator: "private key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "RSA PRIVATE KEY" (Indicator: "private key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "EC PRIVATE KEY" (Indicator: "private key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "DSA PRIVATE KEY" (Indicator: "private key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "RSA PUBLIC KEY" (Indicator: "public key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "private key header missing" (Indicator: "private key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "unable to decode rsa private key" (Indicator: "private key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "unknown public key type" (Indicator: "public key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "unsupported public key type" (Indicator: "public key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "wrong public key type" (Indicator: "public key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "invalid private key" (Indicator: "private key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "missing private key" (Indicator: "private key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "invalid public key" (Indicator: "public key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "private key decode error" (Indicator: "private key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "private key encode error" (Indicator: "private key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "public key not rsa" (Indicator: "public key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "unsupported private key algorithm" (Indicator: "private key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "error converting private key" (Indicator: "private key"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp")36:T1121,Contains base64 string in header "Keep" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/8GJyPhuLa-4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we1/8GJyPhuLa-4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/8GJyPhuLa-4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/8GJyPhuLa-4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 02 Sep 2026 22:23:30 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /we1/8GJyPhuLa-4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 02 Sep 2026 22:23:30 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /we1/8GJyPhuLa-4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 02 Sep 2026 22:23:30 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/8GJyPhuLa-4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 02 Sep 2026 22:23:30 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog"37:T79e,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Decrypted SSL network traffic Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to attach base64 encoded attachment to an email Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to use AES encryption instructions Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Uses Windows cryptography API for obfuscation Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains key cryptographic functions of the CryptoAPI Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match - ChaCha20 encryption algorithm38:T4d18,Found XOR loop in file "tor-gencert.exe" at offset 1900475; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 1901003; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 1903374; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 2232508; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 2586447; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 2586646; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 3068138; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 3075455; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 3228613; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 3432525; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 3532249; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 3541709; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 3546639; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 3549639; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 3552699; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 3559619; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 3562581; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 3563933; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 3564433; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 3565443; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 3566967; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 3568699; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 3569473; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 3573291; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 3577245; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 3579703; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 3582929; code bytes = 30d0 Found XOR loop in file "tor-gencert.exe" at offset 2025630; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 2026400; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 2233221; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 2421956; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 2493573; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 2590600; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 2605957; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 2898476; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 3077030; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 3094133; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 3230284; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 3352944; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 3434196; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 3500667; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 3502387; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 3507803; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 3507969; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 3521473; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 3526503; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 3532793; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 3533237; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 3534395; code bytes = 33c1 Found XOR loop in file "tor-gencert.exe" at offset 475794; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 475810; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 502037; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 502053; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 525317; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 525333; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 599576; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 599592; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 652380; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 652396; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 676928; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 676944; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 738535; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 738749; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 1306622; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 1306645; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2312738; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2312937; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2341259; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2354347; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2521519; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2532303; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2561534; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2715425; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2715641; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2715729; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2715846; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2715960; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2718108; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2718618; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2718706; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2718823; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2718937; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2721085; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2807359; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2830346; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2830527; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 2835262; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3068072; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3069470; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3143020; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3194638; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3196045; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3196684; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3329724; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3329788; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3329852; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3393444; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3393508; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3504306; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3505690; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3516504; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3525386; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3548638; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3551672; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3554592; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3559580; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3563877; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3564394; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3565404; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3566004; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3568680; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3573252; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3577212; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3579664; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3581050; code bytes = 8030 Found XOR loop in file "tor-gencert.exe" at offset 3582096; code bytes = 8030 Found XOR loop in file "SciTE.exe" at offset 809226; code bytes = 30d0 Found XOR loop in file "SciTE.exe" at offset 301261; code bytes = 33c1 Found XOR loop in file "SciTE.exe" at offset 328258; code bytes = 33c1 Found XOR loop in file "SciTE.exe" at offset 745376; code bytes = 33c1 Found XOR loop in file "SciTE.exe" at offset 745514; code bytes = 33c1 Found XOR loop in file "SciTE.exe" at offset 805077; code bytes = 33c1 Found XOR loop in file "SciTE.exe" at offset 805525; code bytes = 33c1 Found XOR loop in file "SciTE.exe" at offset 806101; code bytes = 33c1 Found XOR loop in file "SciTE.exe" at offset 806549; code bytes = 33c1 Found XOR loop in file "SciTE.exe" at offset 819706; code bytes = 33c1 Found XOR loop in file "SciTE.exe" at offset 829834; code bytes = 33c1 Found XOR loop in file "SciTE.exe" at offset 831749; code bytes = 33c1 Found XOR loop in file "SciTE.exe" at offset 832197; code bytes = 33c1 Found XOR loop in file "SciTE.exe" at offset 832773; code bytes = 33c1 Found XOR loop in file "SciTE.exe" at offset 833221; code bytes = 33c1 Found XOR loop in file "SciTE.exe" at offset 1082994; code bytes = 33c1 Found XOR loop in file "SciTE.exe" at offset 38510; code bytes = 8030 Found XOR loop in file "SciTE.exe" at offset 50803; code bytes = 8030 Found XOR loop in file "SciTE.exe" at offset 759783; code bytes = 8030 Found XOR loop in file "SciTE.exe" at offset 790780; code bytes = 8030 Found XOR loop in file "SciTE.exe" at offset 803130; code bytes = 8030 Found XOR loop in file "SciTE.exe" at offset 1067815; code bytes = 8030 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 112995; code bytes = 30d0 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 123390; code bytes = 30d0 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 396226; code bytes = 30d0 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 404481; code bytes = 30d0 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 595808; code bytes = 30d0 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 661697; code bytes = 30d0 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 783011; code bytes = 30d0 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 8957; code bytes = 33c1 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 157467; code bytes = 33c1 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 274380; code bytes = 33c1 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 301722; code bytes = 33c1 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 358408; code bytes = 33c1 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 385331; code bytes = 33c1 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 482679; code bytes = 33c1 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 489209; code bytes = 33c1 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 493782; code bytes = 33c1 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 510263; code bytes = 33c1 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 511588; code bytes = 33c1 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 538441; code bytes = 33c1 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 598340; code bytes = 33c1 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 665803; code bytes = 33c1 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 113055; code bytes = 8030 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 193728; code bytes = 8030 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 220124; code bytes = 8030 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 243774; code bytes = 8030 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 525976; code bytes = 8030 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 566507; code bytes = 8030 Found XOR loop in file "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" at offset 784198; code bytes = 8030 Found XOR loop in file "7zFM.exe" at offset 150250; code bytes = 30d0 Found XOR loop in file "7zFM.exe" at offset 346124; code bytes = 30d0 Found XOR loop in file "7zG.exe" at offset 119620; code bytes = 30d0 Found XOR loop in file "7zG.exe" at offset 237848; code bytes = 30d0 Found XOR loop in file "7zG.exe" at offset 236195; code bytes = 33c1 Found XOR loop in file "7zG.exe" at offset 236230; code bytes = 33c1 Found XOR loop in file "7zG.exe" at offset 236265; code bytes = 33c1 Found XOR loop in file "7zG.exe" at offset 236300; code bytes = 33c1 Found XOR loop in file "7zG.exe" at offset 49649; code bytes = 8030 Found XOR loop in file "KMSSS.exe" at offset 222196; code bytes = 30d0 Found XOR loop in file "KMSSS.exe" at offset 238322; code bytes = 30d0 Found XOR loop in file "KMSSS.exe" at offset 290917; code bytes = 30d0 Found XOR loop in file "KMSSS.exe" at offset 295281; code bytes = 30d0 Found XOR loop in file "KMSSS.exe" at offset 111978; code bytes = 33c1 Found XOR loop in file "KMSSS.exe" at offset 112597; code bytes = 33c1 Found XOR loop in file "KMSSS.exe" at offset 236504; code bytes = 33c1 Found XOR loop in file "KMSSS.exe" at offset 92984; code bytes = 8030 Found XOR loop in file "KMSSS.exe" at offset 240739; code bytes = 8030 Found XOR loop in file "KMSSS.exe" at offset 287320; code bytes = 8030 Found XOR loop in file "KMSSS.exe" at offset 295264; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 201059; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 201094; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 201129; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 201164; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 46387; code bytes = 8030 Found XOR loop in file "HimTrayIcon.exe" at offset 118939; code bytes = 30d0 Found XOR loop in file "HimTrayIcon.exe" at offset 9908; code bytes = 33c1 Found XOR loop in file "HimTrayIcon.exe" at offset 10529; code bytes = 33c1 Found XOR loop in file "HimTrayIcon.exe" at offset 118900; code bytes = 8030 Found XOR loop in file "devcon.exe" at offset 76015; code bytes = 30d0 Found XOR loop in file "devcon.exe" at offset 23915; code bytes = 33c1 Found XOR loop in file "devcon.exe" at offset 12314; code bytes = 8030 Found XOR loop in file "devcon.exe" at offset 75996; code bytes = 8030 Found XOR loop in file "devcon.exe" at offset 76407; code bytes = 30d0 Found XOR loop in file "devcon.exe" at offset 76388; code bytes = 8030 Found XOR loop in file "Uninstall.exe" at offset 5268; code bytes = 8030 Found XOR loop in file "FakeClient.exe" at offset 7719; code bytes = 30d0 Found XOR loop in file "HJIMESV.EXE" at offset 21020; code bytes = 30d0 Found XOR loop in file "HJIMESV.EXE" at offset 21077; code bytes = 30d0 Found XOR loop in file "HJIMESV.EXE" at offset 41142; code bytes = 8030 Found XOR loop in file "HJIMESV.EXE" at offset 72428; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A995B5D.bin" at offset 76665; code bytes = 30d0 Found XOR loop in file "DISMHOST.EXE.6A995B5D.bin" at offset 77648; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A995B5D.bin" at offset 77788; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A995B5D.bin" at offset 78978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 112995; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 123390; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 396226; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 404481; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 595808; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 661697; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 783011; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8957; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 157467; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 274380; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 301722; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 358408; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 385331; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 482679; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 489209; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 493782; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 510263; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 511588; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 538441; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 598340; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 665803; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 113055; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 193728; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 220124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 243774; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 525976; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 566507; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 784198; code bytes = 803039:T772,Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResourceW"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveTypeA"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStringsW"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResourceW"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveTypeA"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResourceW"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveTypeA"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")3a:T62e,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") file/memory contains long string with (Indicator: "GetCursorPos"; File: "7zFM.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "7zG.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "gswin32.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "gswin32c.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "HimTrayIcon.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "gbb.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "Uninstall.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "HJIMESV.EXE") file/memory contains long string with (Indicator: "GetCommandLine"; File: "DISMHOST.EXE.6A995B5D.bin") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")3b:Te95,Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")3c:T950,Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "GetTimeFormatA" (Indicator: "GetTimeFormat"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "GetDateFormatA" (Indicator: "GetDateFormat"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")3d:T739,file/memory contains long string with (Indicator: "sendmessage"; File: "7zFM.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "7zG.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "gswin32.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "gswin32c.exe") file/memory contains long string with (Indicator: "postmessage"; File: "HimTrayIcon.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "Uninstall.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00005872-00000C2C-228540114") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")3e:T345a,"875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001c00a8e91c00a3e91c0000000000000000000000180000000001b8e11200000000001cef120095e1b777bef86a00feffffff435cbb775059bb77aa000000b8000000a2e91c00a0e91c0040e3120078e7120000000000000000000000000000000000000000000000000000000000000000001c5cba7760d8ba75ffffffff17000000f0e212002400000003000000e0e712000ced120078e71200860000001ce3120096edbb77cae91c00a06a91758600000040e3120078e712000000000086008800a06a917540e31200916c9175cae91c00a06a9175a06a9175b0e7120002020000 (UID: 00000000-00005872) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005872) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000000000f4f1120058afad6818fa120092e0ac6877383a44feffffffacf812004c9cac68680c0000c8f812005f9cac68000000000000000000000000000000000000000000000000e4f9120001000000d8f8120001000000f8f81200935cbc774083c377d4a0bb776e12c377e4f9120001000000 (UID: 00000000-00005872) "fTObFt.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000004900c06750006dd1ac77fb4d3e2c6cae4377000000000000000000e1a90028f24d00b82e49000100000000004900500149000c000000c0675000b82e490002000002180000000102000386000000000000000000000003000000c0e0a900860000008101000000000000785f002706000000c075b4772884540000000000c075b477dce0a9000c2f490000000000b82e490034e1a900dbd2ac77c067500028f24d00034c3e2c86000000ff2bbb77270f787701000000040249000000490040e0a900dce0a900080072032300000053fc6a00feffffffe063bb771664bb77 (UID: 00000000-00005956) "fTObFt.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000bb775059bb7734020000400200008a052603880526031000000080000000ff2bbb778f0fd97420a3116eac0149000000490001000000a00f4e00140098001a00000000d10f74ac0149000000490088052603150093001a0000001a000000bceebb77e86e4900000026032000000016008e0000000000607f4f00d86b4900f86c4900a0d75600a07049000000260350e10803607f4f00d0e2080395e1b7774bf26a00feffffffff2bbb779a2abb7720a3116e10a3116e000000004bf26a00feffffff00000000bce20803307b17024ce2080380f42b7700001a000000000089f42b77 (UID: 00000000-00005956) "fTObFt.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005956) "fTObFt.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000490018000000aa000000000000000000000040a45b00d86b4900406d490088825b00f07749004600430004d3a900310045000ce0a90088825b00e9e9bb7788825b0000000000aa00000030d4a90068d8a90000000000000000000000000000000000000000000000000000000000000000001c5cba7760d8ba75ffffffff17000000e0d3a9002400000003000000d0d8a900fcdda90068d8a900860000000cd4a90096edbb77aa825b00a06a91758600000030d4a90068d8a9000000000086008800a06a917530d4a900916c9175aa825b00a06a9175a06a9175a0d8a90002020000 (UID: 00000000-00005956) "fTObFt.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005956) "fTObFt.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002c54ba77e4160b723401000000000000000000000000000044cf2d001b800800c0cf2d00580600004cd62d007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036003057b52c94cf2d006d8248767c0b4f0004010000 (UID: 00000000-00005956) "fTObFt.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005c00660054004f006200460074002e006500780065000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2bbb77ef54fc77d8eb3b77ac01490000004900000000000000000021007f00c90100000000000000000000000000000000000022007a00c90100000000000000000000e86e490000000000200000000000000000000000c0a55b00d86b4900f86c4900e0f55400a07049000000000030ba2d0000000000b0bb2d00 (UID: 00000000-00005956) "fTObFt.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000f4c82d005a005c0094c82d00b8ca2d0074c92d0553002d0031002d0035002d00320031002d0032003000390032003300350036003000340033002d0034003000340031003700300030003800310037002d003600360033003100320037003200300034002d0031003000300031000000dccd2d009e00620130c92d0070cb2d00440000007a030000180000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036001451b52c70c92d006d8248767c0b4f0004010000 (UID: 00000000-00005956) "fTObFt.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000fc7750774d00240449000000490050014900000000000000000050014900000000007c014900000000000a00000000000000500149005e0000000000490098835600000000000a00000a5400000040865600481e4d00f8874f0050000000000049000000004098835600d8c92d000464bb7738014900e063bb778327fc770000000000004900a0835600010000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036001451b52c70c92d006d8248767c0b4f0004010000 (UID: 00000000-00005956) "fTObFt.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000fc7750774d002404490000004900500149000000000000000000500149000000000080014900000000002600000000000000500149007a0000000000490080b05a0000000000260000265400000028b35a0098845600b825550030010000000049000000000480b05a00d8c92d000464bb7738014900e063bb778327fc77000000000000490088b05a00010000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036001451b52c70c92d006d8248767c0b4f0004010000 (UID: 00000000-00005956) "fTObFt.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000fc7750774d002404490000004900500149000000000000000000500149000000000080014900000000002600000000000000500149007a0000000000490080b05a0000000000260000265400000028b35a0040855600b825550030010000000049000000000480b05a00d8c92d000464bb7738014900e063bb778327fc77000000000000490088b05a00010000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036001451b52c70c92d006d8248767c0b4f0004010000 (UID: 00000000-00005956) "fTObFt.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000fc7750774d002404490000004900500149000000000000000000500149000000000080014900000000002600000000000000500149007a0000000000490080b05a0000000000260000265400000028b35a00a81f5700b825550030010000000049000000000480b05a00d8c92d000464bb7738014900e063bb778327fc77000000000000490088b05a00010000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036001451b52c70c92d006d8248767c0b4f0004010000 (UID: 00000000-00005956) "fTObFt.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000fc7788b05a002404490000004900500149000000000000000000500149000000000080014900000000002a00000000000000500149007e00000000004900a01f5700000000002a00002a5400000048225700f0784d00b82555005001000000004900f0030000a01f5700d8c92d000464bb7738014900e063bb778327fc770000000000004900a81f5700010000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036001451b52c70c92d006d8248767c0b4f0004010000 (UID: 00000000-00005956) "fTObFt.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000fc77a81f5700240449000000490050014900000000000000000050014900000000007c014900000000000700000000000000500149005b0000000000490078b15a0000000000070000075400000020b45a0068834d00f8a34f0038000000000049000000000878b15a00d8c92d000464bb7738014900e063bb778327fc77000000000000490080b15a00010000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036001451b52c70c92d006d8248767c0b4f0004010000 (UID: 00000000-00005956) "fTObFt.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000fc77a81f57002404490000004900500149000000000000000000500149000000000080014900000000002a00000000000000500149007e0000000000490058a65600000000002a00002a5400000000a9560028b25a00a8794d0050010000000049000000004058a65600d8c92d000464bb7738014900e063bb778327fc77000000000000490060a65600010000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036001451b52c70c92d006d8248767c0b4f0004010000 (UID: 00000000-00005956) "fTObFt.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000fc77a81f57002404490000004900500149000000000000000000500149000000000080014900000000002a00000000000000500149007e0000000000490058a65600000000002a00002a5400000000a9560028b25a00b825550050010000000049000000004058a65600d8c92d000464bb7738014900e063bb778327fc77000000000000490060a65600010000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036001451b52c70c92d006d8248767c0b4f0004010000 (UID: 00000000-00005956) "fTObFt.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000fc77a81f57002404490000004900500149000000000000000000500149000000000080014900000000002a00000000000000500149007e0000000000490058a65600000000002a00002a5400000000a95600b00e5d00b825550050010000000049000000004058a65600d8c92d000464bb7738014900e063bb778327fc77000000000000490060a65600010000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036001451b52c70c92d006d8248767c0b4f0004010000 (UID: 00000000-00005956) "fTObFt.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000fbb05d2c90d22d0090d22d001e75aa680000000018954d00c8d92d004c0200000000000000000000000000006cd72d005ecb62764c02000000000000005d6076c8d92d000e5d607660d52d00dcaa6476010000000000000072000000ffffffffffffffffe8d22d00780200000000000025000000e8d22d007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600644bb52c40d32d006d8248767c0b4f0004010000 (UID: 00000000-00005956)3f:T2210,"875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005872) "fTObFt.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005956) "fTObFt.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005956) "fTObFt.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb3b77e0f5540000c0fd7f9a5cbc7700f0fd7f74bb2d0044c0fd7f00000000400000003f0000002300000000c0fd7f68bb2d00c15cbc776082c3772300000000c0fd7f9a5cbc7700f0fd7f8cbb2d005789bb778083c3771317bb75d8eb3b77 (UID: 00000000-00005956) "ntvdm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001280) "ntvdm.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001192) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb3b7798b5680200f0fd7f9a5cbc7700e0fd7fa4a6120044f0fd7f00000000400000003f0000002000000000f0fd7f98a61200c15cbc776082c3772000000000f0fd7f9a5cbc7700e0fd7fbca612005789bb778083c3771317bb75d8eb3b77 (UID: 00000000-00004356) "icacls.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb3b7760422e000040fd7f9a5cbc7700f0fd7fa0e214004440fd7f00000000400000003f000000090000000040fd7f94e21400c15cbc776082c377090000000040fd7f9a5cbc7700f0fd7fb8e214005789bb778083c3771317bb75d8eb3b77 (UID: 00000000-00002188) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb3b77187f2e000050fd7f9a5cbc7700f0fd7f88a812004450fd7f00000000400000003f000000200000000050fd7f7ca81200c15cbc776082c377200000000050fd7f9a5cbc7700f0fd7fa0a812005789bb778083c3771317bb75d8eb3b77 (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb3b7738a259020050fd7f9a5cbc7700f0fd7f88a812004450fd7f00000000400000003f000000200000000050fd7f7ca81200c15cbc776082c377200000000050fd7f9a5cbc7700f0fd7fa0a812005789bb778083c3771317bb75d8eb3b77 (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb3b77905a330000f0fd7f9a5cbc7700e0fd7f88a8120044f0fd7f00000000400000003f0000002000000000f0fd7f7ca81200c15cbc776082c3772000000000f0fd7f9a5cbc7700e0fd7fa0a812005789bb778083c3771317bb75d8eb3b77 (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003356)40:T428,GetTickCount@KERNEL32.dll at 22399-471-0040A290 GetTickCount@KERNEL32.DLL at 00000000-00004356-24844-4609-00482470 GetTickCount@KERNEL32.DLL at 00000000-00004356-24844-4611-00481920 GetTickCount@KERNEL32.DLL at 00000000-00004356-24844-8694-00432626 GetTickCount@KERNEL32.DLL at 00000000-00003264-31531-4606-00482470 GetTickCount@KERNEL32.DLL at 00000000-00003264-31531-4608-00481920 GetTickCount@KERNEL32.DLL at 00000000-00003264-31531-8691-00432626 GetTickCount@KERNEL32.DLL at 00000000-00003012-37598-4605-00482470 GetTickCount@KERNEL32.DLL at 00000000-00003012-37598-4607-00481920 GetTickCount@KERNEL32.DLL at 00000000-00003012-37598-8690-00432626 GetTickCount@KERNEL32.DLL at 00000000-00001952-46274-4605-00482470 GetTickCount@KERNEL32.DLL at 00000000-00001952-46274-4607-00481920 GetTickCount@KERNEL32.DLL at 00000000-00001952-46274-8689-00432626 GetTickCount@KERNEL32.DLL at 00000000-00003356-2016-4605-00482470 GetTickCount@KERNEL32.DLL at 00000000-00003356-2016-4607-00481920 GetTickCount@KERNEL32.DLL at 00000000-00003356-2016-8692-0043262641:T6f9,GetLocaleInfoA@KERNEL32.dll at 22399-385-0040CEFB GetUserDefaultLCID@KERNEL32.DLL at 00000000-00004356-24844-6490-004388B2 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00004356-24844-6495-004387C8 GetLocaleInfoW@KERNEL32.DLL at 00000000-00004356-24844-6496-0043884E GetUserDefaultLCID@KERNEL32.DLL at 00000000-00004356-24844-6504-00438423 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00004356-24844-6505-00437E27 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00004356-24844-6506-00437F00 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00004356-24844-6508-00437E83 GetLocaleInfoW@KERNEL32.DLL at 00000000-00004356-24844-6510-004382A2 GetLocaleInfoW@KERNEL32.DLL at 00000000-00004356-24844-6695-00437D77 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00004356-24844-6698-00437E67 GetLocaleInfoW@KERNEL32.DLL at 00000000-00004356-24844-6699-00437F83 GetLocaleInfoW@KERNEL32.DLL at 00000000-00004356-24844-6700-0043834F GetLocaleInfoW@KERNEL32.DLL at 00000000-00004356-24844-6701-00438178 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00003264-31531-6487-004388B2 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00003264-31531-6492-004387C8 GetLocaleInfoW@KERNEL32.DLL at 00000000-00003264-31531-6493-0043884E GetUserDefaultLCID@KERNEL32.DLL at 00000000-00003264-31531-6501-00438423 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00003264-31531-6502-00437E27 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00003264-31531-6503-00437F00 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00003264-31531-6505-00437E83 GetLocaleInfoW@KERNEL32.DLL at 00000000-00003264-31531-6507-004382A2 GetLocaleInfoW@KERNEL32.DLL at 00000000-00003264-31531-6692-00437D77 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00003264-31531-6695-00437E67 GetLocaleInfoW@KERNEL32.DLL at 00000000-00003264-31531-6696-00437F8342:T4b3,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")43:T716,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")44:T688,GetProcessHeap@KERNEL32.DLL at 00000000-00004356-24844-1-00424141 OpenProcess@KERNEL32.DLL at 00000000-00004356-24844-54-00419F90 OpenProcess@KERNEL32.DLL at 00000000-00004356-24844-111-00412220 GetProcessHeap@KERNEL32.DLL at 00000000-00004356-24844-505-00447CAC OpenProcess@KERNEL32.DLL at 00000000-00004356-24844-639-00412440 GetProcessHeap@KERNEL32.DLL at 00000000-00004356-24844-677-004278D5 GetProcessHeap@KERNEL32.DLL at 00000000-00003264-31531-1-00424141 OpenProcess@KERNEL32.DLL at 00000000-00003264-31531-54-00419F90 OpenProcess@KERNEL32.DLL at 00000000-00003264-31531-111-00412220 GetProcessHeap@KERNEL32.DLL at 00000000-00003264-31531-505-00447CAC OpenProcess@KERNEL32.DLL at 00000000-00003264-31531-639-00412440 GetProcessHeap@KERNEL32.DLL at 00000000-00003264-31531-677-004278D5 GetProcessHeap@KERNEL32.DLL at 00000000-00003012-37598-1-00424141 OpenProcess@KERNEL32.DLL at 00000000-00003012-37598-54-00419F90 OpenProcess@KERNEL32.DLL at 00000000-00003012-37598-111-00412220 GetProcessHeap@KERNEL32.DLL at 00000000-00003012-37598-505-00447CAC OpenProcess@KERNEL32.DLL at 00000000-00003012-37598-639-00412440 GetProcessHeap@KERNEL32.DLL at 00000000-00003012-37598-677-004278D5 GetProcessHeap@KERNEL32.DLL at 00000000-00001952-46274-1-00424141 OpenProcess@KERNEL32.DLL at 00000000-00001952-46274-54-00419F90 OpenProcess@KERNEL32.DLL at 00000000-00001952-46274-111-00412220 GetProcessHeap@KERNEL32.DLL at 00000000-00001952-46274-505-00447CAC OpenProcess@KERNEL32.DLL at 00000000-00001952-46274-639-00412440 GetProcessHeap@KERNEL32.DLL at 00000000-00001952-46274-677-004278D5 GetProcessHeap@KERNEL32.DLL at 00000000-00003356-2016-1-0042414145:T6bb,PathFileExistsW@SHLWAPI.DLL at 00000000-00004356-24844-65-00411CD0 PathFileExistsA@SHLWAPI.DLL at 00000000-00004356-24844-156-00410A50 PathFileExistsA@SHLWAPI.DLL at 00000000-00004356-24844-638-004124E0 PathFileExistsW@SHLWAPI.DLL at 00000000-00004356-24844-5602-00410160 PathFileExistsW@SHLWAPI.DLL at 00000000-00004356-24844-5611-0040F730 PathFileExistsW@SHLWAPI.DLL at 00000000-00003264-31531-65-00411CD0 PathFileExistsA@SHLWAPI.DLL at 00000000-00003264-31531-156-00410A50 PathFileExistsA@SHLWAPI.DLL at 00000000-00003264-31531-638-004124E0 PathFileExistsW@SHLWAPI.DLL at 00000000-00003264-31531-5599-00410160 PathFileExistsW@SHLWAPI.DLL at 00000000-00003264-31531-5608-0040F730 PathFileExistsW@SHLWAPI.DLL at 00000000-00003012-37598-65-00411CD0 PathFileExistsA@SHLWAPI.DLL at 00000000-00003012-37598-156-00410A50 PathFileExistsA@SHLWAPI.DLL at 00000000-00003012-37598-638-004124E0 PathFileExistsW@SHLWAPI.DLL at 00000000-00003012-37598-5598-00410160 PathFileExistsW@SHLWAPI.DLL at 00000000-00003012-37598-5607-0040F730 PathFileExistsW@SHLWAPI.DLL at 00000000-00001952-46274-65-00411CD0 PathFileExistsA@SHLWAPI.DLL at 00000000-00001952-46274-156-00410A50 PathFileExistsA@SHLWAPI.DLL at 00000000-00001952-46274-638-004124E0 PathFileExistsW@SHLWAPI.DLL at 00000000-00001952-46274-5598-00410160 PathFileExistsW@SHLWAPI.DLL at 00000000-00001952-46274-5607-0040F730 PathFileExistsW@SHLWAPI.DLL at 00000000-00003356-2016-65-00411CD0 PathFileExistsA@SHLWAPI.DLL at 00000000-00003356-2016-156-00410A50 PathFileExistsA@SHLWAPI.DLL at 00000000-00003356-2016-638-004124E0 PathFileExistsW@SHLWAPI.DLL at 00000000-00003356-2016-5598-00410160 PathFileExistsW@SHLWAPI.DLL at 00000000-00003356-2016-5607-0040F73046:T47b,Found reference to API "PathFileExistsA" (Indicator: "PathFileExist"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") file/memory contains long string with (Indicator: "PathFileExist"; File: "fTObFt.exe") Found reference to API "PathFileExistsW" (Indicator: "PathFileExist"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "PathFileExistsA" (Indicator: "PathFileExist"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "PathFileExistsW" (Indicator: "PathFileExist"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "PathFileExistsA" (Indicator: "PathFileExist"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "PathFileExistsW" (Indicator: "PathFileExist"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")47:T630,Found API call GetVersion@KERNEL32.DLL directly followed by "cmp al, 05h" and "jbe 0041A6F9h" at 00000000-00004356-24844-54-00419F90 Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by "cmp eax, FFFFFFFFh" and "je 0043004Bh" at 00000000-00004356-24844-587-0042FE47 Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by "cmp eax, FFFFFFFFh" and "je 0043004Bh" at 00000000-00004356-28333-587-0042FE47 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp al, 05h" and "jbe 0041A6F9h" at 00000000-00003264-31531-54-00419F90 Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by "cmp eax, FFFFFFFFh" and "je 0043004Bh" at 00000000-00003264-31531-587-0042FE47 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp al, 05h" and "jbe 0041A6F9h" at 00000000-00003012-37598-54-00419F90 Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by "cmp eax, FFFFFFFFh" and "je 0043004Bh" at 00000000-00003012-37598-587-0042FE47 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp al, 05h" and "jbe 0041A6F9h" at 00000000-00001952-46274-54-00419F90 Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by "cmp eax, FFFFFFFFh" and "je 0043004Bh" at 00000000-00001952-46274-587-0042FE47 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp al, 05h" and "jbe 0041A6F9h" at 00000000-00003356-2016-54-00419F90 Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by "cmp eax, FFFFFFFFh" and "je 0043004Bh" at 00000000-00003356-2016-587-0042FE4748:Tbe5,"fTObFt.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "fTObFt.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "fTObFt.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "fTObFt.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "fTObFt.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "fTObFt.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "fTObFt.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "fTObFt.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "fTObFt.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "fTObFt.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "")49:T54a,"fTObFt.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\248A6F69.BAT") "fTObFt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\248A6F69.BAT") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\875EF5B3053D4D322471A9A9C0A7EA0B44C75178ADD2BB43AC4619EC78209CF1.EXE") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\875EF5B3053D4D322471A9A9C0A7EA0B44C75178ADD2BB43AC4619EC78209CF1.EXE") "fTObFt.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\62823255.BAT") "fTObFt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\62823255.BAT") "fTObFt.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\1EAA308E.BAT") "fTObFt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\1EAA308E.BAT") "fTObFt.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\4EED3304.BAT") "fTObFt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\4EED3304.BAT") "fTObFt.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\3D7C6D63.BAT") "fTObFt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\3D7C6D63.BAT")4a:T42f,Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")4b:T41a,Found string "MoveFileA" (Indicator: "MoveFileA"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") file/memory contains long string with (Indicator: "MoveFileW"; File: "7zFM.exe") file/memory contains long string with (Indicator: "MoveFileW"; File: "7zG.exe") file/memory contains long string with (Indicator: "MoveFileW"; File: "7z.exe") file/memory contains long string with (Indicator: "MoveFileExW"; File: "Uninstall.exe") Found string "MoveFileW" (Indicator: "MoveFileW"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "MoveFileExW" (Indicator: "MoveFileExW"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found string "MoveFileW" (Indicator: "MoveFileW"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found string "MoveFileW" (Indicator: "MoveFileW"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")4c:T408,Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")4d:T865,"875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")4e:Taae,"fTObFt.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00005956) "fTObFt.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00005956) "fTObFt.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00005956) "fTObFt.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00005956) "fTObFt.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00005956) "fTObFt.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00005956) "fTObFt.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00005956) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\4e9c9c1e-50f3-4861-8c8d-fa7990428991 (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00003264)4f:Ta08,"875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "CreateProcessA" with parameter ""C:\875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe"" - (UID: 00000000-00005872) "fTObFt.exe" called "CreateProcessA" with parameter "%TEMP%\1FC421E4.exe" - (UID: 00000000-00005956) "fTObFt.exe" called "CreateProcessA" with parameter "%TEMP%\75193782.exe" - (UID: 00000000-00005956) "fTObFt.exe" called "CreateProcessA" with parameter "%TEMP%\026C2111.exe" - (UID: 00000000-00005956) "fTObFt.exe" called "CreateProcessW" with parameter ""%TEMP%\248a6f69.bat"" - (UID: 00000000-00005956) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "CreateProcessW" with parameter "icacls "%LOCALAPPDATA%\4e9c9c1e-50f3-4861-8c8d-fa7990428991" /deny *S-1-1-0:(OI)(CI)(DE,DC)" - (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "CreateProcessW" with parameter ""C:\875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" --Admin IsNotAutoStart IsNotTask" - (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "CreateProcessA" with parameter ""C:\875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" --Admin IsNotAutoStart IsNotTask" - (UID: 00000000-00003420) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "CreateProcessA" with parameter "%LOCALAPPDATA%\4e9c9c1e-50f3-4861-8c8d-fa7990428991\875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe --Task" - (UID: 00000000-00003244) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "CreateProcessA" with parameter "%LOCALAPPDATA%\4e9c9c1e-50f3-4861-8c8d-fa7990428991\875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe --Task" - (UID: 00000000-00002796) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "CreateProcessA" with parameter "%LOCALAPPDATA%\4e9c9c1e-50f3-4861-8c8d-fa7990428991\875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe --Task" - (UID: 00000000-00003968) "fTObFt.exe" called "CreateProcessW" with parameter ""%TEMP%\62823255.bat"" - (UID: 00000000-00005480) "fTObFt.exe" called "CreateProcessW" with parameter ""%TEMP%\1eaa308e.bat"" - (UID: 00000000-00003904) "fTObFt.exe" called "CreateProcessW" with parameter ""%TEMP%\4eed3304.bat"" - (UID: 00000000-00003532) "fTObFt.exe" called "CreateProcessW" with parameter ""%TEMP%\3d7c6d63.bat"" - (UID: 00000000-00003396)50:Ta9e1,"875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00005872) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005872) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00005872) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005872) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005872) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005872) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00005872) "fTObFt.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter %TEMP%\1FC421E4.exe (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter %TEMP%\75193782.exe (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter %TEMP%\026C2111.exe (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00005956) "fTObFt.exe" called "LoadLibrary" with a parameter %TEMP%\248a6f69.bat (UID: 00000000-00005956) "ntvdm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005812) "ntvdm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001280) "ntvdm.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001192) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter Shell32.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00004356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004356) "icacls.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002188) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003420) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00003420) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003420) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003420) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003420) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003420) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003244) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00003244) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003244) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003244) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003244) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003244) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00003264) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00003012) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002796) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00002796) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002796) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002796) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002796) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002796) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00001952) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003968) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00003968) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003968) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003968) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003968) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003968) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003356) "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" called "LoadLibrary" with a parameter Psapi.dll (UID: 00000000-00003356) "fTObFt.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005480) "fTObFt.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005480) "fTObFt.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00005480) "fTObFt.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005480) "fTObFt.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005480) "fTObFt.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00005480) "fTObFt.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00005480) "fTObFt.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00005480) "fTObFt.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005480) "fTObFt.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00005480) "fTObFt.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00005480) "fTObFt.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00005480) "fTObFt.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00005480) "fTObFt.exe" called "LoadLibrary" with a parameter %TEMP%\62823255.bat (UID: 00000000-00005480) "fTObFt.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003904) "fTObFt.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003904) "fTObFt.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003904) "fTObFt.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003904) "fTObFt.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003904) "fTObFt.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003904) "fTObFt.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003904) "fTObFt.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003904) "fTObFt.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003904) "fTObFt.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003904) "fTObFt.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003904) "fTObFt.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003904) "fTObFt.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003904) "fTObFt.exe" called "LoadLibrary" with a parameter %TEMP%\1eaa308e.bat (UID: 00000000-00003904) "cmd.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003672) "fTObFt.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003532) "fTObFt.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003532) "fTObFt.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003532) "fTObFt.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003532) "fTObFt.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003532) "fTObFt.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003532) "fTObFt.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003532) "fTObFt.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003532) "fTObFt.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003532) "fTObFt.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003532) "fTObFt.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003532) "fTObFt.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003532) "fTObFt.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003532) "fTObFt.exe" called "LoadLibrary" with a parameter %TEMP%\4eed3304.bat (UID: 00000000-00003532) "fTObFt.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003396) "fTObFt.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003396) "fTObFt.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003396) "fTObFt.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003396) "fTObFt.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003396) "fTObFt.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003396) "fTObFt.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003396) "fTObFt.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003396) "fTObFt.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003396) "fTObFt.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003396) "fTObFt.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003396) "fTObFt.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003396) "fTObFt.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003396) "fTObFt.exe" called "LoadLibrary" with a parameter %TEMP%\3d7c6d63.bat (UID: 00000000-00003396)51:T414,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")52:T4c2,Found reference to API "CreateDirectoryExW" (Indicator: "CreateDirectory"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")53:T714,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "CreateFile2" (Indicator: "CreateFile"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")54:T64e,Sleep@KERNEL32.dll at 22399-228-00404525 Sleep@KERNEL32.dll at 22399-249-00407DC1 Sleep@KERNEL32.dll at 22399-263-00407E06 Sleep@KERNEL32.dll at 22399-407-00407E52 Sleep@KERNEL32.DLL at 00000000-00004356-24844-42-004329C9 WaitForSingleObject@KERNEL32.DLL at 00000000-00004356-24844-54-00419F90 Sleep@KERNEL32.DLL at 00000000-00004356-24844-112-00411A10 WaitForSingleObject@KERNEL32.DLL at 00000000-00004356-24844-5617-0041F100 WaitForSingleObject@KERNEL32.DLL at 00000000-00004356-24844-5621-0041E590 Sleep@KERNEL32.DLL at 00000000-00004356-24844-6078-00411B10 WaitForSingleObject@KERNEL32.DLL at 00000000-00004356-24844-6208-00410A10 WaitForSingleObject@KERNEL32.DLL at 00000000-00004356-24844-6267-0041FA40 WaitForSingleObject@KERNEL32.DLL at 00000000-00004356-24844-6270-0041FDF0 Sleep@KERNEL32.DLL at 00000000-00003264-31531-42-004329C9 WaitForSingleObject@KERNEL32.DLL at 00000000-00003264-31531-54-00419F90 Sleep@KERNEL32.DLL at 00000000-00003264-31531-112-00411A10 WaitForSingleObject@KERNEL32.DLL at 00000000-00003264-31531-5614-0041F100 WaitForSingleObject@KERNEL32.DLL at 00000000-00003264-31531-5618-0041E590 Sleep@KERNEL32.DLL at 00000000-00003264-31531-6075-00411B10 WaitForSingleObject@KERNEL32.DLL at 00000000-00003264-31531-6205-00410A10 WaitForSingleObject@KERNEL32.DLL at 00000000-00003264-31531-6264-0041FA40 WaitForSingleObject@KERNEL32.DLL at 00000000-00003264-31531-6267-0041FDF0 Sleep@KERNEL32.DLL at 00000000-00003012-37598-42-004329C9 WaitForSingleObject@KERNEL32.DLL at 00000000-00003012-37598-54-00419F90 Sleep@KERNEL32.DLL at 00000000-00003012-37598-112-00411A1055:T4c8,Found GetProcAddress() and LoadLibraryA() in an import section (Source: 875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1) Found GetProcAddress() and LoadLibraryA() in an import section (Source: tor-gencert.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: SciTE.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: 875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: 7zFM.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: 7zG.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: gswin32.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: gswin32c.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: HimTrayIcon.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: gbb.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: FakeClient.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: fTObFt.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: HJIMESV.EXE)56:T660,LoadLibraryA@KERNEL32.dll at 22399-231-0040A4C9 LoadLibraryW@KERNEL32.dll at 22399-309-00402668 LoadLibraryA@KERNEL32.dll at 22399-355-00402F9F LoadLibraryExW@KERNEL32.DLL at 00000000-00004356-24844-29-0042A57A LoadLibraryW@KERNEL32.DLL at 00000000-00004356-24844-65-00411CD0 LoadLibraryW@KERNEL32.DLL at 00000000-00004356-24844-111-00412220 LoadLibraryA@KERNEL32.DLL at 00000000-00004356-24844-2818-004C28F0 LoadLibraryA@KERNEL32.DLL at 00000000-00004356-24844-2819-004C2700 LoadLibraryW@KERNEL32.DLL at 00000000-00004356-24844-5605-0040F310 LoadLibraryW@KERNEL32.DLL at 00000000-00004356-24844-5632-0041DC3C LoadLibraryA@KERNEL32.DLL at 00000000-00004356-24844-8721-004C20F0 LoadLibraryExW@KERNEL32.DLL at 00000000-00003264-31531-29-0042A57A LoadLibraryW@KERNEL32.DLL at 00000000-00003264-31531-65-00411CD0 LoadLibraryW@KERNEL32.DLL at 00000000-00003264-31531-111-00412220 LoadLibraryA@KERNEL32.DLL at 00000000-00003264-31531-2815-004C28F0 LoadLibraryA@KERNEL32.DLL at 00000000-00003264-31531-2816-004C2700 LoadLibraryW@KERNEL32.DLL at 00000000-00003264-31531-5602-0040F310 LoadLibraryW@KERNEL32.DLL at 00000000-00003264-31531-5629-0041DC3C LoadLibraryA@KERNEL32.DLL at 00000000-00003264-31531-8718-004C20F0 LoadLibraryExW@KERNEL32.DLL at 00000000-00003012-37598-29-0042A57A LoadLibraryW@KERNEL32.DLL at 00000000-00003012-37598-65-00411CD0 LoadLibraryW@KERNEL32.DLL at 00000000-00003012-37598-111-00412220 LoadLibraryA@KERNEL32.DLL at 00000000-00003012-37598-2814-004C28F0 LoadLibraryA@KERNEL32.DLL at 00000000-00003012-37598-2815-004C2700 LoadLibraryW@KERNEL32.DLL at 00000000-00003012-37598-5601-0040F31057:T49c,Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")58:T4c4,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")59:T6c4,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")5a:T534,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "WSASetLastError" (Indicator: "SetLastError"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")5b:T763,"SciTE.exe" contains export function called "luaL_addlstring" at ordinal 1 "SciTE.exe" contains export function called "luaL_addstring" at ordinal 2 "SciTE.exe" contains export function called "luaL_addvalue" at ordinal 3 "SciTE.exe" contains export function called "luaL_argerror" at ordinal 4 "SciTE.exe" contains export function called "luaL_buffinit" at ordinal 5 "SciTE.exe" contains export function called "luaL_callmeta" at ordinal 6 "SciTE.exe" contains export function called "luaL_checkany" at ordinal 7 "SciTE.exe" contains export function called "luaL_checkinteger" at ordinal 8 "SciTE.exe" contains export function called "luaL_checklstring" at ordinal 9 "SciTE.exe" contains export function called "luaL_checknumber" at ordinal 10 "SciTE.exe" contains export function called "luaL_checkoption" at ordinal 11 "SciTE.exe" contains export function called "luaL_checkstack" at ordinal 12 "SciTE.exe" contains export function called "luaL_checktype" at ordinal 13 "SciTE.exe" contains export function called "luaL_checkudata" at ordinal 14 "SciTE.exe" contains export function called "luaL_error" at ordinal 15 "SciTE.exe" contains export function called "luaL_findtable" at ordinal 16 "SciTE.exe" contains export function called "luaL_getmetafield" at ordinal 17 "SciTE.exe" contains export function called "luaL_gsub" at ordinal 18 "SciTE.exe" contains export function called "luaL_loadbuffer" at ordinal 19 "SciTE.exe" contains export function called "luaL_loadfile" at ordinal 20 "SciTE.exe" contains export function called "luaL_loadstring" at ordinal 21 "SciTE.exe" contains export function called "luaL_newmetatable" at ordinal 22 "SciTE.exe" contains export function called "luaL_newstate" at ordinal 23 "SciTE.exe" contains export function called "luaL_openlib" at ordinal 24 "SciTE.exe" contains export function called "luaL_openlibs" at ordinal 255c:T878,"Software\Microsoft\Windows\CurrentVersion\Run" in Source: 24844-65-00411CD0 "Software\Microsoft\Windows\CurrentVersion" in Source: 24844-6207-0040C6A0 "Software\Policies\Microsoft\SystemCertificates\Disallowed" in Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp "Software\Policies\Microsoft\SystemCertificates\TrustedPeople" in Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0" in Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2" in Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4" in Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003356.00000000.81682.001B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001512.00000000.83255.00400000.00000040.mdmp 00000000-00001512.00000001.83981.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001512.00000000.83255.00400000.00000040.mdmp 00000000-00001512.00000001.83981.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001512.00000000.83255.00700000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001512.00000001.83981.007A4000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001952.00000000.80899.00400000.00000040.mdmp 00000000-00001952.00000001.82622.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001952.00000000.80899.00400000.00000040.mdmp 00000000-00001952.00000001.82622.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001952.00000001.82622.002EF000.00000004.mdmp5d:T463,"tor-gencert.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "KMSSS.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "HimTrayIcon.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "devcon.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "FakeClient.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "fTObFt.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "DISMHOST.EXE.6A995B5D.bin" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE5e:T44a,Found string "%PROGRAMFILES%\HNC\Common80\Sub\Twitter\*" (Indicator: "twitter"; Source: "00000000-00005956-00000C2D-8813431454") Found string "ads.linkedin.com" (Indicator: "linkedin.com"; File: "00000000-00003356.00000001.83238.001B0000.00000004.mdmp") Found string "www.linkedin.com" (Indicator: "linkedin.com"; File: "00000000-00003356.00000001.83238.001B0000.00000004.mdmp") Found string "craigslist.org" (Indicator: "craigslist.org"; File: "00000000-00003356.00000001.83238.001B0000.00000004.mdmp") Found string "facebook.com" (Indicator: "facebook.com"; File: "00000000-00003356.00000001.83238.001B0000.00000004.mdmp") Found string "badoo.com" (Indicator: "badoo.com"; File: "00000000-00003356.00000001.83238.001B0000.00000004.mdmp") Found string "twitter.com" (Indicator: "twitter"; File: "00000000-00003356.00000001.83238.001B0000.00000004.mdmp") Found string "youtube.com" (Indicator: "youtube"; File: "00000000-00003356.00000001.83238.001B0000.00000004.mdmp") Found string "linkedin.com" (Indicator: "linkedin.com"; File: "00000000-00003356.00000001.83238.001B0000.00000004.mdmp")5f:T3431,"Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001512.00000000.83255.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001512.00000000.83255.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001512.00000000.83255.00700000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001512.00000001.83981.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001512.00000001.83981.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001512.00000001.83981.007A4000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001952.00000000.80899.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001952.00000000.80899.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001952.00000001.82622.002EF000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001952.00000001.82622.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001952.00000001.82622.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002796.00000001.80640.01700000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002796.00000001.80640.01700000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002872.00000000.88545.00260000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002872.00000000.88545.00260000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002872.00000000.88545.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002872.00000000.88545.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002872.00000001.89243.00300000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002872.00000001.89243.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00002872.00000001.89243.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003012.00000000.80268.00250000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003012.00000000.80268.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003012.00000000.80268.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003012.00000001.81407.00250000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003012.00000001.81407.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003012.00000001.81407.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003264.00000000.80114.00200000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003264.00000000.80114.00200000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003264.00000000.80114.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003264.00000000.80114.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003264.00000001.80845.0026E000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003264.00000001.80845.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003264.00000001.80845.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003356.00000000.81682.001B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003356.00000000.81682.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003356.00000000.81682.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003356.00000001.83238.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003356.00000001.83238.00400000.00000040.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003364.00000001.90368.009F1000.00000020.mdmp "SOFTWARE\GTplus" in Source: 00000000-00003396.00000000.90116.01073000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003408.00000000.82164.00230000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003408.00000000.82164.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003408.00000000.82164.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003408.00000001.83263.00230000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003408.00000001.83263.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003408.00000001.83263.00400000.00000040.mdmp "SOFTWARE\GTplus" in Source: 00000000-00003532.00000001.88971.00AA3000.00000002.mdmp "SOFTWARE\GTplus" in Source: 00000000-00003904.00000000.87939.01353000.00000002.mdmp "04-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003904.00000000.87946.00300000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003904.00000000.87946.00300000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003904.00000000.87946.00300000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004356.00000000.78439.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004356.00000000.78439.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004356.00000000.78439.00730000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004356.00000000.78439.00730000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004356.00000001.79507.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004356.00000001.79507.00400000.00000040.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004356.00000001.79507.00730000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004356.00000001.79507.00730000.00000004.mdmp "17-663127204-1001\Software\Microsoft\Wind" in Source: 00000000-00004356.00000001.79507.00730000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004704.00000000.84197.00190000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004704.00000000.84197.00190000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004704.00000000.84197.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004704.00000000.84197.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004704.00000001.84702.00190000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004704.00000001.84702.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004704.00000001.84702.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004908.00000000.84985.00270000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004908.00000000.84985.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004908.00000000.84985.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004908.00000001.85791.002DE000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004908.00000001.85791.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00004908.00000001.85791.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005248.00000000.85539.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005248.00000000.85539.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005248.00000000.85539.00700000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005248.00000001.86827.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005248.00000001.86827.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005248.00000001.86827.00700000.00000004.mdmp "SOFTWARE\GTplus" in Source: 00000000-00005480.00000001.86153.00143000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005572.00000000.89696.002A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005572.00000000.89696.002A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005572.00000000.89696.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005572.00000000.89696.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005572.00000001.90258.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005572.00000001.90258.00400000.00000040.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005912.00000000.86955.00300000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005912.00000000.86955.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005912.00000000.86955.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005912.00000001.87707.00300000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005912.00000001.87707.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005912.00000001.87707.00400000.00000040.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005956.00000000.77717.00490000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005956.00000000.77717.00490000.00000004.mdmp "SOFTWARE\GTplus" in Source: 00000000-00005956.00000000.77717.00BE3000.00000002.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005956.00000001.79638.00490000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005956.00000001.79638.00490000.00000004.mdmp "SOFTWARE\Classes\PROTOCOLS\Filter\text/html" in Source: 00000000-00005956.00000001.79638.00490000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005956.00000001.79638.00490000.00000004.mdmp "ISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005956.00000002.81562.00490000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005956.00000002.81562.00490000.00000004.mdmp "SOFTWARE\Classes\PROTOCOLS\Filter\text/html" in Source: 00000000-00005956.00000002.81562.00490000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005956.00000002.81562.00490000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005956.00000003.85129.00490000.00000004.mdmp "SOFTWARE\Classes\PROTOCOLS\Filter\text/html" in Source: 00000000-00005956.00000003.85129.00490000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00005956.00000003.85129.00490000.00000004.mdmp "04-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005956.00000003.85129.00490000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00005956.00000003.85129.00490000.00000004.mdmp60:T1ffe,"GET /r/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1871 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu 03 Sep 2026 01:21:41 GMT Expires: Thu 03 Sep 2026 02:11:41 GMT Cache-Control: public max-age=3000 Age: 211 Last-Modified: Mon 31 Aug 2026 08:08:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282074B30C2820633020101300D06092AC28648C286C3B70D01010B05003057310B300906035504061302424531193017060355040A1310476C6F62616C53....... "GET /r/r4.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 528 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu 03 Sep 2026 01:04:07 GMT Expires: Thu 03 Sep 2026 01:54:07 GMT Cache-Control: public max-age=3000 Age: 1265 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282020C30C28201C293020101300A06082AC28648C38E3D0403033047310B300906035504061302555331223020060355040A1319476F6F676C6520547275....... "GET /we1/8GJyPhuLa-4.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 310 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu 03 Sep 2026 00:51:23 GMT Expires: Thu 03 Sep 2026 01:41:23 GMT Cache-Control: public max-age=3000 Age: 2030 Last-Modified: Wed 02 Sep 2026 22:23:30 GMT Content-Type: application/pkix-crl with response body ==>30C282013230C281C398020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C652054727573....... "GET /we1/8GJyPhuLa-4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 02 Sep 2026 22:23:30 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Thu 03 Sep 2026 00:51:23 GMT Expires: Thu 03 Sep 2026 01:41:23 GMT Age: 2053 Last-Modified: Wed 02 Sep 2026 22:23:30 GMT Cache-Control: public max-age=3000 with no response body "GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Thu 03 Sep 2026 01:21:41 GMT Expires: Thu 03 Sep 2026 02:11:41 GMT Age: 235 Last-Modified: Mon 31 Aug 2026 08:08:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Thu 03 Sep 2026 01:04:07 GMT Expires: Thu 03 Sep 2026 01:54:07 GMT Age: 1289 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /we1/8GJyPhuLa-4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 02 Sep 2026 22:23:30 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Thu 03 Sep 2026 00:51:23 GMT Expires: Thu 03 Sep 2026 01:41:23 GMT Age: 2081 Last-Modified: Wed 02 Sep 2026 22:23:30 GMT Cache-Control: public max-age=3000 with no response body "GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Thu 03 Sep 2026 01:21:41 GMT Expires: Thu 03 Sep 2026 02:11:41 GMT Age: 263 Last-Modified: Mon 31 Aug 2026 08:08:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Thu 03 Sep 2026 01:04:07 GMT Expires: Thu 03 Sep 2026 01:54:07 GMT Age: 1317 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /we1/8GJyPhuLa-4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 02 Sep 2026 22:23:30 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Thu 03 Sep 2026 00:51:23 GMT Expires: Thu 03 Sep 2026 01:41:23 GMT Age: 2130 Last-Modified: Wed 02 Sep 2026 22:23:30 GMT Cache-Control: public max-age=3000 with no response body "GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Thu 03 Sep 2026 01:21:41 GMT Expires: Thu 03 Sep 2026 02:11:41 GMT Age: 312 Last-Modified: Mon 31 Aug 2026 08:08:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Thu 03 Sep 2026 01:04:07 GMT Expires: Thu 03 Sep 2026 01:54:07 GMT Age: 1366 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /we1/8GJyPhuLa-4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 02 Sep 2026 22:23:30 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Thu 03 Sep 2026 00:51:23 GMT Expires: Thu 03 Sep 2026 01:41:23 GMT Age: 2184 Last-Modified: Wed 02 Sep 2026 22:23:30 GMT Cache-Control: public max-age=3000 with no response body "GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Thu 03 Sep 2026 01:21:41 GMT Expires: Thu 03 Sep 2026 02:11:41 GMT Age: 366 Last-Modified: Mon 31 Aug 2026 08:08:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Thu 03 Sep 2026 01:04:07 GMT Expires: Thu 03 Sep 2026 01:54:07 GMT Age: 1420 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body61:T3330,"875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "MSIMG32.DLL" at base 6d220000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "KERNEL32.DLL" at base 77a80000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "USER32" at base 764d0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "KERNEL32" at base 77a80000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "NTDLL.DLL" at base 77b60000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74870000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "DWMAPI.DLL" at base 742d0000 "fTObFt.exe" loaded module "SECUR32.DLL" at base 75790000 "fTObFt.exe" loaded module "RPCRT4.DLL" at base 778b0000 "fTObFt.exe" loaded module "SHELL32.DLL" at base 765a0000 "fTObFt.exe" loaded module "OLE32.DLL" at base 760c0000 "fTObFt.exe" loaded module "ADVAPI32.DLL" at base 76220000 "fTObFt.exe" loaded module "PROFAPI.DLL" at base 75a80000 "fTObFt.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 70510000 "fTObFt.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75c10000 "fTObFt.exe" loaded module "WS2_32.DLL" at base 773f0000 "fTObFt.exe" loaded module "WINHTTP.DLL" at base 71ee0000 "fTObFt.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75430000 "fTObFt.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 75420000 "fTObFt.exe" loaded module "IPHLPAPI.DLL" at base 73dc0000 "fTObFt.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72530000 "fTObFt.exe" loaded module "OLEAUT32.DLL" at base 77960000 "fTObFt.exe" loaded module "DNSAPI.DLL" at base 752f0000 "fTObFt.exe" loaded module "CRYPTBASE.DLL" at base 75960000 "fTObFt.exe" loaded module "CLBCATQ.DLL" at base 77220000 "fTObFt.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6e0e0000 "fTObFt.exe" loaded module "DHCPCSVC6.DLL" at base 73cd0000 "fTObFt.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74f90000 "fTObFt.exe" loaded module "DHCPCSVC.DLL" at base 73bf0000 "fTObFt.exe" loaded module "RASADHLP.DLL" at base 712f0000 "fTObFt.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 773d0000 "fTObFt.exe" loaded module "URLMON.DLL" at base 77430000 "fTObFt.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 773d0000 "fTObFt.exe" loaded module "CRYPTSP.DLL" at base 75470000 "fTObFt.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75200000 "fTObFt.exe" loaded module "RPCRTREMOTE.DLL" at base 75a00000 "fTObFt.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73d30000 "fTObFt.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6d7a0000 "fTObFt.exe" loaded module "COMCTL32.DLL" at base 74900000 "fTObFt.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 773f0000 "fTObFt.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 77960000 "fTObFt.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75910000 "fTObFt.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 75e10000 "fTObFt.exe" loaded module "PROPSYS.DLL" at base 74600000 "fTObFt.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74600000 "fTObFt.exe" loaded module "NTMARTA.DLL" at base 74ed0000 "fTObFt.exe" loaded module "APPHELP.DLL" at base 75910000 "fTObFt.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6e090000 "fTObFt.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 765a0000 "fTObFt.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77a80000 "fTObFt.exe" loaded module "SETUPAPI.DLL" at base 762d0000 "fTObFt.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77430000 "fTObFt.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75d50000 "ntvdm.exe" loaded module "NTVDMD.DLL" at base 6ddd0000 "ntvdm.exe" loaded module "VDMREDIR.DLL" at base 6d750000 "ntvdm.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74870000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6a0c0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "WS2_32.DLL" at base 773f0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "WINHTTP.DLL" at base 71ee0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "IPHLPAPI.DLL" at base 73dc0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 75430000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 75420000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72530000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "DNSAPI.DLL" at base 752f0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "RPCRT4.DLL" at base 778b0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "CRYPTBASE.DLL" at base 75960000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "CRYPT32.DLL" at base 75c20000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74f90000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "DHCPCSVC6.DLL" at base 73cd0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "CLBCATQ.DLL" at base 77220000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6e0e0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "OLE32.DLL" at base 760c0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "RASADHLP.DLL" at base 712f0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "DHCPCSVC.DLL" at base 73bf0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 773d0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "USERENV.DLL" at base 75b80000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "ADVAPI32.DLL" at base 76220000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "CRYPTSP.DLL" at base 75470000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75200000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 773d0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "URLMON.DLL" at base 77430000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "SECUR32.DLL" at base 75790000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "RPCRTREMOTE.DLL" at base 75a00000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "OLEAUT32.DLL" at base 77960000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6d7a0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 77960000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 75e10000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73d30000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "COMCTL32.DLL" at base 74900000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 773f0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "CREDSSP.DLL" at base 75100000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 75270000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "NCRYPT.DLL" at base 755a0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75140000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "WINTRUST.DLL" at base 75d70000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "GPAPI.DLL" at base 75040000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 773d0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 773d0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "USER32.DLL" at base 764d0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 72180000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "CRYPTNET.DLL" at base 72180000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "SENSAPI.DLL" at base 6cfa0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "SHLWAPI.DLL" at base 76470000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "SSPICLI.DLL" at base 758f0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "NSI.DLL" at base 75e00000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "CFGMGR32.DLL" at base 75ab0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "PROFAPI.DLL" at base 75a80000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 773d0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75c20000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "PSAPI.DLL" at base 77cc0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "SHELL32.DLL" at base 765a0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75910000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 74070000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "XMLLITE.DLL" at base 742a0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "PROPSYS.DLL" at base 74600000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74600000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "NTMARTA.DLL" at base 74ed0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 77430000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75d50000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77a80000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "SETUPAPI.DLL" at base 762d0000 "icacls.exe" loaded module "NTMARTA.DLL" at base 74ed0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "SENSAPI.DLL" at base 74aa0000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 70510000 "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75c10000 "fTObFt.exe" loaded module "KERNEL32.DLL" at base 77a80000 "fTObFt.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74870000 "cmd.exe" loaded module "ADVAPI32.DLL" at base 76220000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6a0c000062:Tbe0,"875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1" was detected as "Microsoft Visual C/C++" and name: "Compiler" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1" was detected as "Microsoft Linker" and name: "Linker" "tor-gencert.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "tor-gencert.exe" was detected as "Microsoft Linker" and name: "Linker" "SciTE.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "SciTE.exe" was detected as "Microsoft Linker" and name: "Linker" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" was detected as "Microsoft Linker" and name: "Linker" "7zFM.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7zFM.exe" was detected as "Microsoft Linker" and name: "Linker" "7zG.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7zG.exe" was detected as "Microsoft Linker" and name: "Linker" "KMSSS.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "KMSSS.exe" was detected as "Microsoft Linker" and name: "Linker" "7z.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7z.exe" was detected as "Microsoft Linker" and name: "Linker" "gswin32.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "gswin32.exe" was detected as "Microsoft Linker" and name: "Linker" "gswin32c.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "gswin32c.exe" was detected as "Microsoft Linker" and name: "Linker" "HimTrayIcon.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "HimTrayIcon.exe" was detected as "Microsoft Linker" and name: "Linker" "devcon.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "devcon.exe" was detected as "Microsoft Linker" and name: "Linker" "gbb.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "gbb.exe" was detected as "Microsoft Linker" and name: "Linker" "Uninstall.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Uninstall.exe" was detected as "Microsoft Linker" and name: "Linker" "FakeClient.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "FakeClient.exe" was detected as "Microsoft Linker" and name: "Linker" "MyProg.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "MyProg.exe" was detected as "Microsoft Linker" and name: "Linker" "fTObFt.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "fTObFt.exe" was detected as "Microsoft Linker" and name: "Linker" "HJIMESV.EXE" was detected as "Microsoft Visual C/C++" and name: "Compiler" "HJIMESV.EXE" was detected as "Microsoft Linker" and name: "Linker" "DISMHOST.EXE.6A995B5D.bin" was detected as "Microsoft Visual C/C++" and name: "Compiler" "DISMHOST.EXE.6A995B5D.bin" was detected as "Microsoft Linker" and name: "Linker"63:T5a6,"fTObFt.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "fTObFt.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "fTObFt.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "fTObFt.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "fTObFt.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "fTObFt.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "fTObFt.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "fTObFt.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\TREATAS") "fTObFt.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\TREATAS") "fTObFt.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\LOCALSERVER32") "fTObFt.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" touched "TaskScheduler class" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}")64:T5dc,"875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1" has an executable section named ".text" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1" has an executable section named "Z*"uv", "tor-gencert.exe" has an executable section named ".text", "tor-gencert.exe" has an executable section named "Y|u", "SciTE.exe" has an executable section named ".text", "SciTE.exe" has an executable section named "[ur", "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" has an executable section named ".text", "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" has an executable section named "Z*"uv" "7zFM.exe" has an executable section named ".text" "7zFM.exe" has an executable section named "qu" "7zG.exe" has an executable section named ".text" "7zG.exe" has an executable section named "yuK" "KMSSS.exe" has an executable section named ".text" "KMSSS.exe" has an executable section named ",uR" "7z.exe" has an executable section named ".text" "7z.exe" has an executable section named "uu" "gswin32.exe" has an executable section named ".text" "gswin32.exe" has an executable section named "huN" "gswin32c.exe" has an executable section named ".text" "gswin32c.exe" has an executable section named "$hu" "HimTrayIcon.exe" has an executable section named ".text" "HimTrayIcon.exe" has an executable section named "[{u" "devcon.exe" has an executable section named ".text" "devcon.exe" has an executable section named "'0u"65:T5e0,"875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1" has an writable section named ".data" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1" has an writable section named "Z*"uv", "tor-gencert.exe" has an writable section named ".data", "tor-gencert.exe" has an writable section named ".tls", "tor-gencert.exe" has an writable section named "Y|u", "SciTE.exe" has an writable section named ".data", "SciTE.exe" has an writable section named "[ur", "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" has an writable section named ".data", "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" has an writable section named "Z*"uv" "7zFM.exe" has an writable section named ".data" "7zFM.exe" has an writable section named ".sxdata" "7zFM.exe" has an writable section named "qu" "7zG.exe" has an writable section named ".data" "7zG.exe" has an writable section named ".sxdata" "7zG.exe" has an writable section named "yuK" "KMSSS.exe" has an writable section named ".data" "KMSSS.exe" has an writable section named ",uR" "7z.exe" has an writable section named ".data" "7z.exe" has an writable section named ".sxdata" "7z.exe" has an writable section named "uu" "gswin32.exe" has an writable section named ".data" "gswin32.exe" has an writable section named "huN" "gswin32c.exe" has an writable section named ".data" "gswin32c.exe" has an writable section named "$hu" "HimTrayIcon.exe" has an writable section named ".data"66:T37a6,"875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x16c,xor eax, eax,push ebx,push esi,push edi,mov dword ptr [ebp - 0x24], eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x14], eax,mov dword ptr [ebp - 8], eax,mov dword ptr [ebp - 0xc], eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x48], 0x624f5466,mov dword ptr [ebp - 0x44], 0x652e7446,mov dword ptr [ebp - 0x40], 0x6578,mov dword ptr [ebp - 0x3c], 0,call 0x505044,pop eax,add eax, 0x225,mov dword ptr [ebp - 4], eax,mov eax, dword ptr fs:[0x30],mov dword ptr [ebp - 0x28], eax,mov eax, dword ptr [ebp - 4],mov dword ptr [eax], 0xe904c483,mov eax, dword ptr [ebp - 4]," "tor-gencert.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x16c,xor eax, eax,push ebx,push esi,push edi,mov dword ptr [ebp - 0x24], eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x14], eax,mov dword ptr [ebp - 8], eax,mov dword ptr [ebp - 0xc], eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x48], 0x635a566a,mov dword ptr [ebp - 0x44], 0x652e6465,mov dword ptr [ebp - 0x40], 0x6578,mov dword ptr [ebp - 0x3c], 0,call 0x774044,pop eax,add eax, 0x225,mov dword ptr [ebp - 4], eax,mov eax, dword ptr fs:[0x30],mov dword ptr [ebp - 0x28], eax,mov eax, dword ptr [ebp - 4],mov dword ptr [eax], 0xe904c483,mov eax, dword ptr [ebp - 4]," "SciTE.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x16c,xor eax, eax,push ebx,push esi,push edi,mov dword ptr [ebp - 0x24], eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x14], eax,mov dword ptr [ebp - 8], eax,mov dword ptr [ebp - 0xc], eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x48], 0x72734b79,mov dword ptr [ebp - 0x44], 0x652e4e6d,mov dword ptr [ebp - 0x40], 0x6578,mov dword ptr [ebp - 0x3c], 0,call 0x538044,pop eax,add eax, 0x225,mov dword ptr [ebp - 4], eax,mov eax, dword ptr fs:[0x30],mov dword ptr [ebp - 0x28], eax,mov eax, dword ptr [ebp - 4],mov dword ptr [eax], 0xe904c483,mov eax, dword ptr [ebp - 4]," "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x16c,xor eax, eax,push ebx,push esi,push edi,mov dword ptr [ebp - 0x24], eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x14], eax,mov dword ptr [ebp - 8], eax,mov dword ptr [ebp - 0xc], eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x48], 0x624f5466,mov dword ptr [ebp - 0x44], 0x652e7446,mov dword ptr [ebp - 0x40], 0x6578,mov dword ptr [ebp - 0x3c], 0,call 0x505044,pop eax,add eax, 0x225,mov dword ptr [ebp - 4], eax,mov eax, dword ptr fs:[0x30],mov dword ptr [ebp - 0x28], eax,mov eax, dword ptr [ebp - 4],mov dword ptr [eax], 0xe904c483,mov eax, dword ptr [ebp - 4]," "7zFM.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x16c,xor eax, eax,push ebx,push esi,push edi,mov dword ptr [ebp - 0x24], eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x14], eax,mov dword ptr [ebp - 8], eax,mov dword ptr [ebp - 0xc], eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x48], 0x69744b59,mov dword ptr [ebp - 0x44], 0x78652e4a,mov dword ptr [ebp - 0x40], 0x65,mov dword ptr [ebp - 0x3c], 0,call 0x47d044,pop eax,add eax, 0x225,mov dword ptr [ebp - 4], eax,mov eax, dword ptr fs:[0x30],mov dword ptr [ebp - 0x28], eax,mov eax, dword ptr [ebp - 4],mov dword ptr [eax], 0xe904c483,mov eax, dword ptr [ebp - 4]," "7zG.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x16c,xor eax, eax,push ebx,push esi,push edi,mov dword ptr [ebp - 0x24], eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x14], eax,mov dword ptr [ebp - 8], eax,mov dword ptr [ebp - 0xc], eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x48], 0x6f486747,mov dword ptr [ebp - 0x44], 0x652e6871,mov dword ptr [ebp - 0x40], 0x6578,mov dword ptr [ebp - 0x3c], 0,call 0x457044,pop eax,add eax, 0x225,mov dword ptr [ebp - 4], eax,mov eax, dword ptr fs:[0x30],mov dword ptr [ebp - 0x28], eax,mov eax, dword ptr [ebp - 4],mov dword ptr [eax], 0xe904c483,mov eax, dword ptr [ebp - 4]," "KMSSS.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x16c,xor eax, eax,push ebx,push esi,push edi,mov dword ptr [ebp - 0x24], eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x14], eax,mov dword ptr [ebp - 8], eax,mov dword ptr [ebp - 0xc], eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x48], 0x726a4d45,mov dword ptr [ebp - 0x44], 0x652e4347,mov dword ptr [ebp - 0x40], 0x6578,mov dword ptr [ebp - 0x3c], 0,call 0x44f044,pop eax,add eax, 0x225,mov dword ptr [ebp - 4], eax,mov eax, dword ptr fs:[0x30],mov dword ptr [ebp - 0x28], eax,mov eax, dword ptr [ebp - 4],mov dword ptr [eax], 0xe904c483,mov eax, dword ptr [ebp - 4]," "7z.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x16c,xor eax, eax,push ebx,push esi,push edi,mov dword ptr [ebp - 0x24], eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x14], eax,mov dword ptr [ebp - 8], eax,mov dword ptr [ebp - 0xc], eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x48], 0x52574856,mov dword ptr [ebp - 0x44], 0x78652e68,mov dword ptr [ebp - 0x40], 0x65,mov dword ptr [ebp - 0x3c], 0,call 0x446044,pop eax,add eax, 0x225,mov dword ptr [ebp - 4], eax,mov eax, dword ptr fs:[0x30],mov dword ptr [ebp - 0x28], eax,mov eax, dword ptr [ebp - 4],mov dword ptr [eax], 0xe904c483,mov eax, dword ptr [ebp - 4]," "gswin32.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x16c,xor eax, eax,push ebx,push esi,push edi,mov dword ptr [ebp - 0x24], eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x14], eax,mov dword ptr [ebp - 8], eax,mov dword ptr [ebp - 0xc], eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x48], 0x4a6b476e,mov dword ptr [ebp - 0x44], 0x2e576a72,mov dword ptr [ebp - 0x40], 0x657865,mov dword ptr [ebp - 0x3c], 0,call 0x425044,pop eax,add eax, 0x225,mov dword ptr [ebp - 4], eax,mov eax, dword ptr fs:[0x30],mov dword ptr [ebp - 0x28], eax,mov eax, dword ptr [ebp - 4],mov dword ptr [eax], 0xe904c483,mov eax, dword ptr [ebp - 4]," "gswin32c.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x16c,xor eax, eax,push ebx,push esi,push edi,mov dword ptr [ebp - 0x24], eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x14], eax,mov dword ptr [ebp - 8], eax,mov dword ptr [ebp - 0xc], eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x48], 0x54715468,mov dword ptr [ebp - 0x44], 0x2e52664b,mov dword ptr [ebp - 0x40], 0x657865,mov dword ptr [ebp - 0x3c], 0,call 0x424044,pop eax,add eax, 0x225,mov dword ptr [ebp - 4], eax,mov eax, dword ptr fs:[0x30],mov dword ptr [ebp - 0x28], eax,mov eax, dword ptr [ebp - 4],mov dword ptr [eax], 0xe904c483,mov eax, dword ptr [ebp - 4]," "HimTrayIcon.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x16c,xor eax, eax,push ebx,push esi,push edi,mov dword ptr [ebp - 0x24], eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x14], eax,mov dword ptr [ebp - 8], eax,mov dword ptr [ebp - 0xc], eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x48], 0x5857556a,mov dword ptr [ebp - 0x44], 0x652e456d,mov dword ptr [ebp - 0x40], 0x6578,mov dword ptr [ebp - 0x3c], 0,call 0x422044,pop eax,add eax, 0x225,mov dword ptr [ebp - 4], eax,mov eax, dword ptr fs:[0x30],mov dword ptr [ebp - 0x28], eax,mov eax, dword ptr [ebp - 4],mov dword ptr [eax], 0xe904c483,mov eax, dword ptr [ebp - 4]," "devcon.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x16c,xor eax, eax,push ebx,push esi,push edi,mov dword ptr [ebp - 0x24], eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x14], eax,mov dword ptr [ebp - 8], eax,mov dword ptr [ebp - 0xc], eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x48], 0x71527742,mov dword ptr [ebp - 0x44], 0x652e544d,mov dword ptr [ebp - 0x40], 0x6578,mov dword ptr [ebp - 0x3c], 0,call 0x415044,pop eax,add eax, 0x225,mov dword ptr [ebp - 4], eax,mov eax, dword ptr fs:[0x30],mov dword ptr [ebp - 0x28], eax,mov eax, dword ptr [ebp - 4],mov dword ptr [eax], 0xe904c483,mov eax, dword ptr [ebp - 4]," "devcon.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x16c,xor eax, eax,push ebx,push esi,push edi,mov dword ptr [ebp - 0x24], eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x14], eax,mov dword ptr [ebp - 8], eax,mov dword ptr [ebp - 0xc], eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x48], 0x79704663,mov dword ptr [ebp - 0x44], 0x6578652e,mov dword ptr [ebp - 0x40], 0,mov dword ptr [ebp - 0x3c], 0,call 0x1015044,pop eax,add eax, 0x225,mov dword ptr [ebp - 4], eax,mov eax, dword ptr fs:[0x30],mov dword ptr [ebp - 0x28], eax,mov eax, dword ptr [ebp - 4],mov dword ptr [eax], 0xe904c483,mov eax, dword ptr [ebp - 4]," "gbb.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x16c,xor eax, eax,push ebx,push esi,push edi,mov dword ptr [ebp - 0x24], eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x14], eax,mov dword ptr [ebp - 8], eax,mov dword ptr [ebp - 0xc], eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x48], 0x50637358,mov dword ptr [ebp - 0x44], 0x2e654e78,mov dword ptr [ebp - 0x40], 0x657865,mov dword ptr [ebp - 0x3c], 0,call 0x413044,pop eax,add eax, 0x225,mov dword ptr [ebp - 4], eax,mov eax, dword ptr fs:[0x30],mov dword ptr [ebp - 0x28], eax,mov eax, dword ptr [ebp - 4],mov dword ptr [eax], 0xe904c483,mov eax, dword ptr [ebp - 4]," "Uninstall.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x16c,xor eax, eax,push ebx,push esi,push edi,mov dword ptr [ebp - 0x24], eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x14], eax,mov dword ptr [ebp - 8], eax,mov dword ptr [ebp - 0xc], eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x48], 0x696b684b,mov dword ptr [ebp - 0x44], 0x652e7a67,mov dword ptr [ebp - 0x40], 0x6578,mov dword ptr [ebp - 0x3c], 0,call 0x407044,pop eax,add eax, 0x225,mov dword ptr [ebp - 4], eax,mov eax, dword ptr fs:[0x30],mov dword ptr [ebp - 0x28], eax,mov eax, dword ptr [ebp - 4],mov dword ptr [eax], 0xe904c483,mov eax, dword ptr [ebp - 4]," "FakeClient.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x16c,xor eax, eax,push ebx,push esi,push edi,mov dword ptr [ebp - 0x24], eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x14], eax,mov dword ptr [ebp - 8], eax,mov dword ptr [ebp - 0xc], eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x48], 0x61514464,mov dword ptr [ebp - 0x44], 0x652e4367,mov dword ptr [ebp - 0x40], 0x6578,mov dword ptr [ebp - 0x3c], 0,call 0x406044,pop eax,add eax, 0x225,mov dword ptr [ebp - 4], eax,mov eax, dword ptr fs:[0x30],mov dword ptr [ebp - 0x28], eax,mov eax, dword ptr [ebp - 4],mov dword ptr [eax], 0xe904c483,mov eax, dword ptr [ebp - 4]," "MyProg.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x16c,xor eax, eax,push ebx,push esi,push edi,mov dword ptr [ebp - 0x24], eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x14], eax,mov dword ptr [ebp - 8], eax,mov dword ptr [ebp - 0xc], eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x48], 0x46526274,mov dword ptr [ebp - 0x44], 0x652e426c,mov dword ptr [ebp - 0x40], 0x6578,mov dword ptr [ebp - 0x3c], 0,call 0x1003044,pop eax,add eax, 0x225,mov dword ptr [ebp - 4], eax,mov eax, dword ptr fs:[0x30],mov dword ptr [ebp - 0x28], eax,mov eax, dword ptr [ebp - 4],mov dword ptr [eax], 0xe904c483,mov eax, dword ptr [ebp - 4]," "fTObFt.exe" file has an entrypoint instructions - "pushal ,call 0x40600a,jmp 0x459d64f7,push ebp,ret ,call 0x406014,jmp 0x406072,mov ebx, 0xffffffed,add ebx, ebp,sub ebx, 0x6000,cmp dword ptr [ebp + 0x488], 0,mov dword ptr [ebp + 0x488], ebx,jne 0x406400,lea eax, [ebp + 0x494],push eax,call dword ptr [ebp + 0xfa9],mov dword ptr [ebp + 0x48c], eax,mov esi, eax,lea edi, [ebp + 0x51],push edi,push esi,call dword ptr [ebp + 0xfa5],stosd dword ptr es:[edi], eax,mov al, 0,scasb al, byte ptr es:[edi],jne 0x406058,cmp byte ptr [edi], al,jne 0x40604d,lea eax, [ebp + 0x7a],jmp eax,push esi," "HJIMESV.EXE" file has an entrypoint instructions - "push ebp,mov ebp, esp,sub esp, 0x16c,xor eax, eax,push ebx,push esi,push edi,mov dword ptr [ebp - 0x24], eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x14], eax,mov dword ptr [ebp - 8], eax,mov dword ptr [ebp - 0xc], eax,mov dword ptr [ebp - 0x20], eax,mov dword ptr [ebp - 0x18], eax,mov dword ptr [ebp - 0x48], 0x4f754450,mov dword ptr [ebp - 0x44], 0x652e4b43,mov dword ptr [ebp - 0x40], 0x6578,mov dword ptr [ebp - 0x3c], 0,call 0x45c044,pop eax,add eax, 0x225,mov dword ptr [ebp - 4], eax,mov eax, dword ptr fs:[0x30],mov dword ptr [ebp - 0x28], eax,mov eax, dword ptr [ebp - 4],mov dword ptr [eax], 0xe904c483,mov eax, dword ptr [ebp - 4]," "DISMHOST.EXE.6A995B5D.bin" file has an entrypoint instructions - "call 0x100a7e6,jmp 0x10097f4,int3 ,int3 ,int3 ,int3 ,int3 ,push 0x14,push 0x1010878,call 0x1009d10,and dword ptr [ebp - 4], 0,dec dword ptr [ebp + 0x10],js 0x1009afc,mov ecx, dword ptr [ebp + 8],sub ecx, dword ptr [ebp + 0xc],mov dword ptr [ebp + 8], ecx,call dword ptr [ebp + 0x14],jmp 0x1009abc,mov eax, dword ptr [ebp - 0x14],mov dword ptr [ebp - 0x1c], eax,mov eax, dword ptr [ebp - 0x1c],mov eax, dword ptr [eax],mov dword ptr [ebp - 0x20], eax,mov eax, dword ptr [ebp - 0x20],cmp dword ptr [eax], 0xe06d7363,je 0x1009af3,mov dword ptr [ebp - 0x24], 0,mov eax, dword ptr [ebp - 0x24],ret ,call dword ptr [0x1001210],mov esp, dword ptr [ebp - 0x18],"67:T1f60,Process "ntvdm.exe" (UID: 00000000-00005812) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "ntvdm.exe" (UID: 00000000-00005812) was launched with modified environment variables: "Path, NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00004356) was launched with modified environment variables: "Path" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00003244) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00003244) was launched with missing environment variables: "USERDNSDOMAIN" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00003264) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00003264) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00002796) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00002796) was launched with missing environment variables: "USERDNSDOMAIN" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00001952) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00001952) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00003968) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00003968) was launched with missing environment variables: "USERDNSDOMAIN" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00003356) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00003356) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00003892) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00003892) was launched with missing environment variables: "USERDNSDOMAIN" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00003408) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00003408) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00003764) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00003764) was launched with missing environment variables: "USERDNSDOMAIN" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00001512) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00001512) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00002084) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00002084) was launched with missing environment variables: "USERDNSDOMAIN" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00004704) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00004704) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00001708) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00001708) was launched with missing environment variables: "USERDNSDOMAIN" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00004908) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00004908) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00004952) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00004952) was launched with missing environment variables: "USERDNSDOMAIN" Process "cmd.exe" (UID: 00000000-00005088) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "cmd.exe" (UID: 00000000-00005088) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00005288) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00005288) was launched with missing environment variables: "USERDNSDOMAIN" Process "cmd.exe" (UID: 00000000-00002156) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "cmd.exe" (UID: 00000000-00002156) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00004540) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00004540) was launched with missing environment variables: "USERDNSDOMAIN" Process "cmd.exe" (UID: 00000000-00003672) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "cmd.exe" (UID: 00000000-00003672) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00003536) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00003536) was launched with missing environment variables: "USERDNSDOMAIN" Process "cmd.exe" (UID: 00000000-00004048) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "cmd.exe" (UID: 00000000-00004048) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00003760) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00003760) was launched with missing environment variables: "USERDNSDOMAIN"68:Tdce,Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005872-00000C2B-228542861] Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00004356-00000C2B-234984229] Observed system executable string:"%WINDIR%\system32\cryptnet.dll" [Source: 00000000-00004356-00000C2B-236450966] Observed system executable string:"%WINDIR%\system32\CRYPT32.dll" [Source: 00000000-00004356-00000C2B-245084471] Observed system executable string:"C:\Windows\system32\kernel32.dll" [Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\KERNELBASE.dll" [Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\RPCRT4.dll" [Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\MPR.dll" [Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\WININET.dll" [Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\msvcrt.dll" [Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll" [Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\user32.DLL" [Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\GDI32.dll" [Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\LPK.dll" [Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\USP10.dll" [Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll" [Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\shlwapi.DLL" [Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll" [Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" [Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll" [Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll" [Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll" [Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll" [Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll" [Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\iertutil.dll" [Source: 00000000-00003356.00000001.83238.001B0000.00000004.mdmp]69:Tc7a,Spawned process "fTObFt.exe" (UID: 00000000-00005956) Spawned process "ntvdm.exe" with commandline "-i1" (UID: 00000000-00005812) Spawned process "ntvdm.exe" with commandline "-i2" (UID: 00000000-00001280) Spawned process "ntvdm.exe" with commandline "-i3" (UID: 00000000-00001192) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00004356) Spawned process "icacls.exe" with commandline "icacls "%LOCALAPPDATA%\\4e9c9c1e-50f3-4861-8c8d-fa7990428991" /d ..." (UID: 00000000-00002188) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Admin IsNotAutoStart IsNotTask" (UID: 00000000-00003420) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00003244) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Admin IsNotAutoStart IsNotTask" (UID: 00000000-00003264) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00003012) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00002796) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00001952) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00003968) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00003356) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00003892) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00003408) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00003764) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00001512) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00002084) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00004704) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00001708) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00004908) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00004952) Spawned process "cmd.exe" with commandline "/c ""%TEMP%\\248a6f69.bat" "" (UID: 00000000-00005088) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00005248)6a:Tc7a,Spawned process "fTObFt.exe" (UID: 00000000-00005956) Spawned process "ntvdm.exe" with commandline "-i1" (UID: 00000000-00005812) Spawned process "ntvdm.exe" with commandline "-i2" (UID: 00000000-00001280) Spawned process "ntvdm.exe" with commandline "-i3" (UID: 00000000-00001192) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (UID: 00000000-00004356) Spawned process "icacls.exe" with commandline "icacls "%LOCALAPPDATA%\\4e9c9c1e-50f3-4861-8c8d-fa7990428991" /d ..." (UID: 00000000-00002188) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Admin IsNotAutoStart IsNotTask" (UID: 00000000-00003420) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00003244) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Admin IsNotAutoStart IsNotTask" (UID: 00000000-00003264) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00003012) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00002796) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00001952) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00003968) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00003356) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00003892) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00003408) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00003764) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00001512) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00002084) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00004704) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00001708) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00004908) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00004952) Spawned process "cmd.exe" with commandline "/c ""%TEMP%\\248a6f69.bat" "" (UID: 00000000-00005088) Spawned process "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" with commandline "--Task" (UID: 00000000-00005248)6b:T64e,"875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "tor-gencert.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "SciTE.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "7zFM.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "7zG.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "KMSSS.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "7z.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "gswin32.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "gswin32c.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "HimTrayIcon.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "devcon.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "gbb.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "Uninstall.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "FakeClient.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MyProg.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "fTObFt.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "HJIMESV.EXE" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "DISMHOST.EXE.6A995B5D.bin" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE6c:T669,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") file/memory contains long string with (Indicator: "LoadLibrary"; File: "fTObFt.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")6d:T1b43,"tor-gencert.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 (stripped to external PDB) 8 sections"- Location: [C:\TorService\tor\tor-gencert.exe]- [targetUID: 00000000-00005956] "SciTE.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\AutoIt3\SciTE\SciTE.exe]- [targetUID: 00000000-00005956] "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 4 sections"- Location: [%LOCALAPPDATA%\4e9c9c1e-50f3-4861-8c8d-fa7990428991\875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe]- [targetUID: 00000000-00003760] "7zFM.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\7-Zip\7zFM.exe]- [targetUID: 00000000-00005956] "7zG.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\7-Zip\7zG.exe]- [targetUID: 00000000-00005956] "KMSSS.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\KMSAutoS\bin\KMSSS.exe]- [targetUID: 00000000-00005956] "7z.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 6 sections"- Location: [%PROGRAMFILES%\7-Zip\7z.exe]- [targetUID: 00000000-00005956] "gswin32.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\HNC\Common80\ImgFilters\GS\gs8.71\bin\gswin32.exe]- [targetUID: 00000000-00005956] "gswin32c.exe" has type "PE32 executable for MS Windows 5.00 (console) Intel i386 5 sections"- [targetUID: 00000000-00005956] "HimTrayIcon.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 6 sections"- Location: [%PROGRAMFILES%\HNC\Common80\HimTrayIcon.exe]- [targetUID: 00000000-00005956] "devcon.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\KMSAutoS\bin\driver\x86TAP2\devcon.exe]- [targetUID: 00000000-00005956] "devcon.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\KMSAutoS\bin\driver\x86TAP1\devcon.exe]- [targetUID: 00000000-00005956] "gbb.exe" has type "PE32 executable for MS Windows 5.00 (console) Intel i386 5 sections"- Location: [%PROGRAMFILES%\HNC\Common80\ImgFilters\GS\gs8.71\bin\gbb.exe]- [targetUID: 00000000-00005956] "Uninstall.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\7-Zip\Uninstall.exe]- [targetUID: 00000000-00005956] "FakeClient.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\KMSAutoS\bin\driver\x86WDV\FakeClient.exe]- [targetUID: 00000000-00005956] "MyProg.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 3 sections"- Location: [%PROGRAMFILES%\AutoIt3\Examples\Helpfile\Extras\MyProg.exe]- [targetUID: 00000000-00005956] "fTObFt.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 6 sections"- Location: [%TEMP%\fTObFt.exe]- [targetUID: 00000000-00005480] "4eed3304.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\4eed3304.bat]- [targetUID: 00000000-00004048] "62823255.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\62823255.bat]- [targetUID: 00000000-00005480] "3d7c6d63.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\3d7c6d63.bat]- [targetUID: 00000000-00003396] "248a6f69.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\248a6f69.bat]- [targetUID: 00000000-00005956] "1eaa308e.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\1eaa308e.bat]- [targetUID: 00000000-00003904] "HJIMESV.EXE" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\HNC\Common80\him\HJIMESV.EXE]- [targetUID: 00000000-00005956] "dism.log" has type "Unicode text UTF-8 (with BOM) text with very long lines (312) with CRLF line terminators"- [targetUID: N/A] "DISMHOST.EXE.6A995B5D.bin" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4987 bytes 1 file at 0x2c last modified Sep 04 2025 20:23:24 +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00004356] "8B2B9A00839EED1DFDCCC3BFC2F5DF12" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12]- [targetUID: 00000000-00003012] "B46811C17859FFB409CF0E904A4AA8F8" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8]- [targetUID: 00000000-00003012] "geo_1_.json" has type "Unknown"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00004356] "70825F0EABF2526E540CA0F7C268D189" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\70825F0EABF2526E540CA0F7C268D189]- [targetUID: 00000000-00003012] "70825F0EABF2526E540CA0F7C268D189" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\70825F0EABF2526E540CA0F7C268D189]- [targetUID: 00000000-00003012] "scs8FFF.tmp" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "8B2B9A00839EED1DFDCCC3BFC2F5DF12" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12]- [targetUID: 00000000-00003012] "B46811C17859FFB409CF0E904A4AA8F8" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8]- [targetUID: 00000000-00003012] "scs9878.tmp" has type "DOS batch file ASCII text with CRLF line terminators"- [targetUID: N/A] "k1_1_.rar" has type "Unknown"- [targetUID: N/A] "026C2111.exe" has type "very short file (no magic)"- Location: [%TEMP%\026C2111.exe]- [targetUID: 00000000-00005956] "1FC421E4.exe" has type "very short file (no magic)"- Location: [%TEMP%\1FC421E4.exe]- [targetUID: 00000000-00005956] "75193782.exe" has type "very short file (no magic)"- Location: [%TEMP%\75193782.exe]- [targetUID: 00000000-00005956] "scs9877.tmp" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "scs9414.tmp" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "scs900F.tmp" has type "DOS batch file ASCII text with CRLF line terminators"- [targetUID: N/A] "scs9415.tmp" has type "DOS batch file ASCII text with CRLF line terminators"- [targetUID: N/A] "k3_1_.rar" has type "Unknown"- [targetUID: N/A] "k2_1_.rar" has type "Unknown"- [targetUID: N/A]6e:Ta6e,"875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "")6f:Te93,"875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "875EF5B3053D4D322471A9A9C0A7EA0B44C75178ADD2BB43AC4619EC78209CF1"; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED"; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPCOMPAT"; Key: "DISABLEENGINE"; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: "DISABLELOCALOVERRIDE"; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "fTObFt.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "")70:T6d8,"875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" reads file "c:\users\%osuser%\appdata\local\temp\ftobft.exe" "fTObFt.exe" reads file "c:\users\%osuser%\appdata\local\temp\ftobft.exe" "fTObFt.exe" reads file "c:\users\%osuser%\appdata\local\microsoft\windows\temporary internet files\content.ie5\2uxtwtjr\k1[1].rar" "fTObFt.exe" reads file "c:\users\%osuser%\appdata\local\temp\1fc421e4.exe" "fTObFt.exe" reads file "c:\users\%osuser%\appdata\local\microsoft\windows\temporary internet files\content.ie5\ckdncxys\k2[1].rar" "fTObFt.exe" reads file "c:\users\%osuser%\appdata\local\temp\75193782.exe" "fTObFt.exe" reads file "c:\users\%osuser%\appdata\local\microsoft\windows\temporary internet files\content.ie5\37nu00gp\k3[1].rar" "fTObFt.exe" reads file "c:\users\%osuser%\appdata\local\temp\026c2111.exe" "fTObFt.exe" reads file "c:\users\%osuser%\appdata\local\temp\248a6f69.bat" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" reads file "c:\875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" reads file "c:\windows\system32\icacls.exe" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\8b2b9a00839eed1dfdccc3bfc2f5df12" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\8b2b9a00839eed1dfdccc3bfc2f5df12"71:T492,Found reference to API "RegisterTaskDefinition. Err: %X" (Indicator: "RegisterTask"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "RegisterTaskDefinition. Err: %X" (Indicator: "RegisterTaskDefinition"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "RegisterTaskDefinition. Err: %X" (Indicator: "RegisterTask"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "RegisterTaskDefinition. Err: %X" (Indicator: "RegisterTaskDefinition"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "RegisterTaskDefinition. Err: %X" (Indicator: "RegisterTask"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "RegisterTaskDefinition. Err: %X" (Indicator: "RegisterTaskDefinition"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")72:T4a4,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Able to retrieve information set for devices (API string) Matched sigs: Reference to an external IP address lookup service identified Matched sigs: Able to identify sandbox environment running process Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Makes a code branch decision directly after an API that is environment aware73:Tb4b,"875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Temp\fTObFt.exe" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\FLTLIB.DLL" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\MSVCP140.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\VCRUNTIME140.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\ucrtbase.DLL" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll"74:Tac9,"fTObFt.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "fTObFt.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "fTObFt.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "fTObFt.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "fTObFt.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR\k1[1].rar" "fTObFt.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\k2[1].rar" "fTObFt.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\k3[1].rar" "fTObFt.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "fTObFt.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "fTObFt.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "fTObFt.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "fTObFt.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "fTObFt.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UXTWTJR\k1[1].rar" "fTObFt.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\CKDNCXYS\k2[1].rar" "fTObFt.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\37NU00GP\k3[1].rar" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies"75:Tcf7,"875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\FLTLIB.DLL" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\MSVCP140.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\ucrtbase.DLL" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"76:T5ae,"875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\apfHQ" "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" trying to access non-existent file "C:\APFHQ" "fTObFt.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\fTObFt.exe.Local\" "fTObFt.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\1FC421E4.pif" "fTObFt.exe" trying to access non-existent file "C:\1FC421E4.pif" "fTObFt.exe" trying to access non-existent file "C:\Windows\system32\1FC421E4.pif" "fTObFt.exe" trying to access non-existent file "C:\Windows\system\1FC421E4.pif" "fTObFt.exe" trying to access non-existent file "C:\Windows\1FC421E4.pif" "fTObFt.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath\1FC421E4.pif" "fTObFt.exe" trying to access non-existent file "C:\Windows\System32\Wbem\1FC421E4.pif" "fTObFt.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\1FC421E4.pif" "fTObFt.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\75193782.pif" "fTObFt.exe" trying to access non-existent file "C:\75193782.pif" "fTObFt.exe" trying to access non-existent file "C:\Windows\system32\75193782.pif" "fTObFt.exe" trying to access non-existent file "C:\Windows\system\75193782.pif" "fTObFt.exe" trying to access non-existent file "C:\Windows\75193782.pif"77:T448,"875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1.exe" writes file "c:\users\%osuser%\appdata\local\temp\ftobft.exe" "fTObFt.exe" writes file "c:\program files\7-zip\7z.exe" "fTObFt.exe" writes file "c:\program files\7-zip\7zfm.exe" "fTObFt.exe" writes file "c:\program files\7-zip\7zg.exe" "fTObFt.exe" writes file "c:\program files\7-zip\uninstall.exe" "fTObFt.exe" writes file "c:\program files\autoit3\examples\helpfile\extras\myprog.exe" "fTObFt.exe" writes file "c:\program files\autoit3\scite\scite.exe" "fTObFt.exe" writes file "c:\program files\hnc\common80\him\hjimesv.exe" "fTObFt.exe" writes file "c:\program files\hnc\common80\himtrayicon.exe" "fTObFt.exe" writes file "c:\program files\hnc\common80\imgfilters\gs\gs8.71\bin\gbb.exe" "fTObFt.exe" writes file "c:\program files\hnc\common80\imgfilters\gs\gs8.71\bin\gswin32.exe" "fTObFt.exe" writes file "c:\program files\hnc\common80\imgfilters\gs\gs8.71\bin\gswin32c.exe" "fTObFt.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\temporary internet files\content.ie5\2uxtwtjr\k1[1].rar"78:T865,file/memory contains long string with (Indicator: "WNetAddConnection"; File: "7zFM.exe") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "WNetOpenEnumW" (Indicator: "WNetOpenEnum"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResource"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "WNetAddConnection2W" (Indicator: "WNetAddConnection"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "WNetGetResourceParentW" (Indicator: "WNetGetResourceParent"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "WNetGetResourceInformationW" (Indicator: "WNetGetResourceInformation"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "WNetOpenEnumW" (Indicator: "WNetOpenEnum"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResource"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "WNetOpenEnumW" (Indicator: "WNetOpenEnum"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResource"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")79:T1055,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00005956-00000C2C-225135061") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00005956-00000C2C-225135198") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004356-00000C2C-239814395") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004356-00000C2C-242078071") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00004356-00000C2C-242078290") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004356-00000C2C-242078290") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004356-00000C2C-242078290") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00004356-00000C2C-243533988") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004356-00000C2C-243533988") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00004356-00000C2C-243739170") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00004356-00000C2C-243739537") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")7a:T4b5,Found reference to API "WNetCloseEnum" (Indicator: "NetCloseEnum"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "WNetEnumResourceW" (Indicator: "NetEnumResource"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "WNetAddConnection2W" (Indicator: "NetAddConnection"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "WNetCloseEnum" (Indicator: "NetCloseEnum"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "WNetEnumResourceW" (Indicator: "NetEnumResource"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "WNetCloseEnum" (Indicator: "NetCloseEnum"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "WNetEnumResourceW" (Indicator: "NetEnumResource"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")7b:Ta65,Found string "C:\Build-OpenSSL-VC-32/lib/engines" (Indicator: "openssl-"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/private" (Indicator: "openssl-"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl" (Indicator: "openssl-"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/certs" (Indicator: "openssl-"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/cert.pem" (Indicator: "openssl-"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/lib/engines" (Indicator: "openssl-"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/private" (Indicator: "openssl-"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl" (Indicator: "openssl-"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/certs" (Indicator: "openssl-"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/cert.pem" (Indicator: "openssl-"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/lib/engines" (Indicator: "openssl-"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/private" (Indicator: "openssl-"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl" (Indicator: "openssl-"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/certs" (Indicator: "openssl-"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found string "C:\Build-OpenSSL-VC-32/ssl/cert.pem" (Indicator: "openssl-"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")7c:T824,Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00001952.00000000.80899.00400000.00000040.mdmp, 00000000-00001952.00000001.82622.00400000.00000040.mdmp")7d:T100c,Found reference to API "WSAstartup" (Indicator: "wsastartup"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "BIO_gethostbyname" (Indicator: "gethostbyname"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "WSASTARTUP" (Indicator: "wsastartup"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "error setting nbio on accept socket" (Indicator: " accept "; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "gethostbyname addr is not af inet" (Indicator: "gethostbyname"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "nbio connect error" (Indicator: " connect "; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "no accept port specified" (Indicator: " accept "; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "unable to bind socket" (Indicator: " bind "; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "unable to listen socket" (Indicator: " listen "; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "could not bind to the requested symbol name" (Indicator: " bind "; File: "00000000-00004356.00000001.79507.00400000.00000040.mdmp") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "875ef5b3053d4d322471a9a9c0a7ea0b44c75178add2bb43ac4619ec78209cf1") Found reference to API "WSAstartup" (Indicator: "wsastartup"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "BIO_gethostbyname" (Indicator: "gethostbyname"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "WSASTARTUP" (Indicator: "wsastartup"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "error setting nbio on accept socket" (Indicator: " accept "; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "gethostbyname addr is not af inet" (Indicator: "gethostbyname"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "nbio connect error" (Indicator: " connect "; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "no accept port specified" (Indicator: " accept "; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "unable to bind socket" (Indicator: " bind "; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "unable to listen socket" (Indicator: " listen "; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00001512.00000000.83255.00400000.00000040.mdmp, 00000000-00001512.00000001.83981.00400000.00000040.mdmp")7e:T2488,"GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua" "HTTP/1.1 200 OKDate: Thu, 03 Sep 2026 01:25:36 GMTContent-Type: application/jsonTransfer-Encoding: chunkedConnection: keep-alivestrict-transport-security: max-age=63072000; preloadx-frame-options: SAMEORIGINx-content-type-options: nosniffx-xss-protection: 1; mode=block; report=...access-control-allow-origin: *access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETEaccess-control-allow-headers: X-Accept-Charset,X-Accept,Content-TypeServer: cloudflarecf-cache-status: DYNAMICServer-Timing: cfCacheStatus;desc="DYNAMIC"Server-Timing: cfEdge;dur=12,cfOrigin;dur=447Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=2Bgq%2B%2BzHbChQUMOvqZMCqL9kdGwoqVt6E63qxCVoF21oLB0tRZ2QvMr0DHoHzAZzIVJxwe5DZ9iRt%2FakQVKCKSeIM4qd5WjqtbpDDosYud%2FFxn7gh4%2FaZdM7lUFA"}]}Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}CF-RAY: a350f626be41ff0f-PDXalt-svc: h3=":443"; ma=8640021a{"ip":"64.124.12.162","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"California","region_rus":"\u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u044f","region_ua":"\u041a\u0430\u043b\u0456\u0444\u043e\u0440\u043d\u0456\u044f","city":"Santa clara","city_rus":"\u0421\u0430\u043d\u04", "HTTP/1.1 429 Too Many RequestsDate: Thu 03 Sep 2026 01:25:45 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-alivestrict-transport-security: max-age=63072000; preloadx-frame-options: SAMEORIGINx-content-type-options: nosniffx-xss-protection: 1; mode=block; report=...access-control-allow-origin: *access-control-allow-methods: POST GET PUT OPTIONS PATCH DELETEaccess-control-allow-headers: X-Accept-Charset X-Accept Content-TypeServer: cloudflarecf-cache-status: DYNAMICServer-Timing: cfCacheStatus;desc="DYNAMIC"Server-Timing: cfEdge;dur=10 cfOrigin;dur=534Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=5OrejrGFvTVJ3hvktwYirjUiIn%2BKqWsRmeHBnMmxoCM0jyzSd3t2y5cZdwfl4Ahn4%2BJrrYW%2FVcBzmAV1Wpnypftiq6Z5I1eogI1ec6W6Wcj1BgQGo1AkobjhDRC9"}]}Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800}CF-RAY: a350f65c9e173d49-PDXalt-svc: h3=":443"; ma=86400500

The limit of returned objects has been reached. For more information please contact by email [email p", "HTTP/1.1 429 Too Many RequestsDate: Thu 03 Sep 2026 01:26:14 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-alivestrict-transport-security: max-age=63072000; preloadx-frame-options: SAMEORIGINx-content-type-options: nosniffx-xss-protection: 1; mode=block; report=...access-control-allow-origin: *access-control-allow-methods: POST GET PUT OPTIONS PATCH DELETEaccess-control-allow-headers: X-Accept-Charset X-Accept Content-TypeServer: cloudflarecf-cache-status: DYNAMICServer-Timing: cfCacheStatus;desc="DYNAMIC"Server-Timing: cfEdge;dur=12 cfOrigin;dur=426Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=45dZS8cPbfLjZNbNQ2nDkLYoLItXYx34bKkHvecc79PzSEyLaJNOx%2FVD41b6UkgD24hyZB%2B%2Bu%2B%2Fp%2B6we%2BDLGKf%2FLbfVOFi9ZcASUJmHdk079nBCcfB86Yc1RHN%2Bh"}]}Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800}CF-RAY: a350f7106e7878ff-SJCalt-svc: h3=":443"; ma=86400500

The limit of returned objects has been reached. For more information please contact by email [", "HTTP/1.1 429 Too Many RequestsDate: Thu 03 Sep 2026 01:26:25 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-alivestrict-transport-security: max-age=63072000; preloadx-frame-options: SAMEORIGINx-content-type-options: nosniffx-xss-protection: 1; mode=block; report=...access-control-allow-origin: *access-control-allow-methods: POST GET PUT OPTIONS PATCH DELETEaccess-control-allow-headers: X-Accept-Charset X-Accept Content-TypeServer: cloudflarecf-cache-status: DYNAMICServer-Timing: cfCacheStatus;desc="DYNAMIC"Server-Timing: cfEdge;dur=9 cfOrigin;dur=486Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=3schq4jx%2BWLUcxieAMftY%2FtR8Bd3AB0nKnn3sbz4SbeERSS4VHO0sbM%2Bub9TvSdK2bsFYRhKEGSQwf9iZNAbsPghtarGaSPzPfKtIoAHBJHnUsvfAASEh0B9zMZx"}]}Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800}CF-RAY: a350f758b9c71509-PDXalt-svc: h3=":443"; ma=86400500

The limit of returned objects has been reached. For more information please contact by email [email pr", "HTTP/1.1 429 Too Many RequestsDate: Thu 03 Sep 2026 01:27:24 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-alivestrict-transport-security: max-age=63072000; preloadx-frame-options: SAMEORIGINx-content-type-options: nosniffx-xss-protection: 1; mode=block; report=...access-control-allow-origin: *access-control-allow-methods: POST GET PUT OPTIONS PATCH DELETEaccess-control-allow-headers: X-Accept-Charset X-Accept Content-TypeServer: cloudflarecf-cache-status: DYNAMICServer-Timing: cfCacheStatus;desc="DYNAMIC"Server-Timing: cfEdge;dur=15 cfOrigin;dur=412Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=gf5VEphLsDmEYnngbkKN1Mb%2BPUQi7zjBx5qzHYXf46i1Yu4PfeGtiNoUjiyQ9noi1EIIkXeD17PbCUE6%2B2%2FYPXelsrPu048PHEFkF3DD6320qXOxtZulmPSQTzSP"}]}Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800}CF-RAY: a350f8c49d8dc38b-SJCalt-svc: h3=":443"; ma=86400500

The limit of returned objects has been reached. For more information please contact by email [email p", "HTTP/1.1 429 Too Many RequestsDate: Thu 03 Sep 2026 01:27:47 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-alivestrict-transport-security: max-age=63072000; preloadx-frame-options: SAMEORIGINx-content-type-options: nosniffx-xss-protection: 1; mode=block; report=...access-control-allow-origin: *access-control-allow-methods: POST GET PUT OPTIONS PATCH DELETEaccess-control-allow-headers: X-Accept-Charset X-Accept Content-TypeServer: cloudflarecf-cache-status: DYNAMICServer-Timing: cfCacheStatus;desc="DYNAMIC"Server-Timing: cfEdge;dur=7 cfOrigin;dur=465Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ZbuwYYI8mX95XxxxsUv7WDcY7eS3iMeW1d9v0%2F%2BN0B%2FpC1vAz7njtLpIGrj0h5ZjPO85YyzbWB9f%2FUDbAREixj0aW9gkaBDxYpD4Y6ZH1v5Gcox11PL7939OpEH4"}]}Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800}CF-RAY: a350f959fffcb338-PDXalt-svc: h3=":443"; ma=86400500

The limit of returned objects has been reached. For more information please contact by email [email ", "HTTP/1.1 429 Too Many RequestsDate: Thu 03 Sep 2026 01:28:03 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: keep-alivestrict-transport-security: max-age=63072000; preloadx-frame-options: SAMEORIGINx-content-type-options: nosniffx-xss-protection: 1; mode=block; report=...access-control-allow-origin: *access-control-allow-methods: POST GET PUT OPTIONS PATCH DELETEaccess-control-allow-headers: X-Accept-Charset X-Accept Content-TypeServer: cloudflarecf-cache-status: DYNAMICServer-Timing: cfCacheStatus;desc="DYNAMIC"Server-Timing: cfEdge;dur=21 cfOrigin;dur=398Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=PIQng%2FDsMs1xPZZtWMybOmrLKAPvUB7e0F0quuu0LLFbWlwmkfdJ7RtGW%2BUeqd22Qf8yIWZUYnhImQ7QkoancE%2BZPudfK0z6ZtVlk7SH5OV9cAyLnPzhRX%2FoeQ%2FL"}]}Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800}CF-RAY: a350f9bd3a391692-SJCalt-svc: h3=":443"; ma=86400500