Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006100.00000000.135252.031D0000.00000004.mdmp") Found URL "https://con.lnvoicesharepdf.digital/con.lnvoicesharepdf.digitalsubcac:\windows\system32cserverregistererberoswindows" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "https://api.telegram.org/bot" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "https://con.lnvoicesharepdf.digital/bin/screenconnect.clientsetup.msi?e=access&y=guest" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "https://api.telegram.org/bot8907791006:aafevxzckqkmy9e-g4nbnph0t3pke9tzqdm/sendmessage?chat_id=5149407774&text=victim" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "https://api.telegram.org/bot8907791006:aafevxzckqkmy9e-g4nbnph0t3pke9tzqdmcalrpccal0calrpccalrpcpmapperypatheridnab0calrpchttps://con.lnvoicesharepdf.digital/bin/screenconnect.clientsetup.msi?e=access&y=guestchat_id=66779b67xc:\windows\system32\winhttpcom.dll006:aafevxzckqkmy9e-g4nbnph0t3pke9tzqdm/sendmessage?chat_id=5149407774c:\windows\system32\winhttpcom.dll006:aafevxzckqkmy9e-g4nbnph0t3pke9tzqdm/sendmessage?chat_id=5149407774&text=https://con.lnvoicesharepdf.digital/bin/screenconnect.clientsetup.msi?e=access&y=guest:\ushyper-v" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "https://lii.telegram.org/api.telegram.orgapi.telegram.orgssspchannelcalrpcredsspcalrpcloudappmappercalrpcpmapperegotiatesasspirpcpmappersasspirpctsvcsirpccalrpcerberosredssp.dllpmapperpmapperku2udigestnsresolverscript.exehttps://api.telegram.org/bot8907791006:aafevxzckqkmy9e-g4nbnph0t3pke9tzqdm/sendmessage?chat_id=5149407774&text=victim%20click%20the%20virus%20." - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/product3lsskssm_qu(_qu(n/y][" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "https://api.telegram.org/bot8907791006:aafevxzckqkmy9e-g4nbnph0t3pke9tzqdm/sendmessage?chat_id=5149407774&text=victim%20click%20the%20virus%20." - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "https://con.lnvoicesharepdf.digital/bin/screenconnect.clientsetup.msi?e=access&y=guesttls-server-end-point:cess&y=guests-'@y-!@e-5@k-?@q-9@w-c@]-m@c-w@i-q@o-[@5-e@;-o@!-i@'-s@adddurii_.(@2.e@%.r@@]^x@,>[07" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czc" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%y2.5.29.1bhv*8tpa2.5.4.3s0fvgice" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris'" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lus1!0the" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006356.00000000.134306.8AFE0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006356.00000000.134306.8D6A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006356.00000000.134306.8D6A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006356.00000000.134306.8D6A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006356.00000000.134306.8D6A0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006356.00000000.134306.8D6A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006356.00000000.134306.8D6A0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006356.00000000.134306.8D6A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!emgrtimr0" - Source: "00000000-00006356.00000000.134306.8D6A0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006356.00000001.135416.3E062000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/productp7xsipputsigneddatamsgpsputsignaturep-chmsisipismytypeoffileesdsipputsignaturelmemisfilesupportednameputsigneddatamsguserdomain_roamingprofile=desktop-fvvf82aisfilesupportednamelocalappdata=c:\users\hapubws\appdata\localappdata=c:\users\hapubws\appdata\roamingesdsipismyfiletypelmemprogramfiles(x86)=c:\program" - Source: "00000000-00006356.00000001.135416.8AFE0000.00000004.mdmp") Found URL "https://api.telegram.org/bot" - Source: "00000000-00006356.00000001.135416.8B00F000.00000004.mdmp") Found URL "https://con.lnvoicesharepdf.digital/bin/screenconnect.clientsetup.msi?e=access&y=guest" - Source: "00000000-00006356.00000001.135416.8B00F000.00000004.mdmp") Found URL "https://api.telegram.org/bot8907791006:aafevxzckqkmy9e-g4nbnph0t3pke9tzqdm/sendmessage?chat_id=5149407774&text=done" - Source: "00000000-00006356.00000001.135416.8B00F000.00000004.mdmp") Found URL "https://con.lnvoicesharepdf.digital/bin/screenconnect.clientsetup.msi?e=access&y=guest:\ushyper-v" - Source: "00000000-00006356.00000001.135416.8B00F000.00000004.mdmp") Found URL "https://api.telegram.org/bot8907791006:aafevxzckqkmy9e-g4nbnph0t3pke9tzqdm/sendmessage?chat_id=5149407774&text=victim%20click%20the%20virus%20." - Source: "00000000-00006356.00000001.135416.8B00F000.00000004.mdmp") Found URL "https://con.lnvoicesharepdf.digital/bin/screenconnect.clientsetup.msi?e=access&y=guesttls-server-end-point:cess&y=guests-'@y-!@e-5@k-?@q-9@w-c@]-m@c-w@i-q@o-[@5-e@;-o@!-i@'-s@adddurii_.(@2.e@%.r@@]^x@,>[07" - Source: "00000000-00006356.00000001.135416.8B00F000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006356.00000001.135416.8B00F000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=bz6kvau5qbfbst1pcjm3ugiyxzxqbpxxkllexnmn1cshtnclm79gnjfixhxwbs6alngo5%2bwsbdtx7tf%2bcdq15tlypagp7%2bfcvhh%2fvk7vqug4q50raixukomlg%2f1ovxr3dchwvvvfuxztijkltbk%3d" - Source: "00000000-00006356.00000001.135416.8B00F000.00000004.mdmp") Found URL "https://api.telegram.org/bot8907791006:aafevxzckqkmy9e-g4nbnph0t3pke9tzqdm/sendmessage?chat_id=5149407774&text=done%20installing%20gee.svp" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;+>%y2.5.29.1lmemlmemlmemahwv2.5.4.3s0fvgice" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris'" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lus1!0the" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006356.00000001.135416.8B086000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006356.00000001.135416.8D6A0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006356.00000001.135416.8D6A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006356.00000001.135416.8D6A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006356.00000001.135416.8D6A0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006356.00000001.135416.8D6A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006356.00000001.135416.8D6A0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006356.00000001.135416.8D6A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!timr0" - Source: "00000000-00006356.00000001.135416.8D6A0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=bz6kvau5qbfbst1pcjm3ugiyxzxqbpxxkllexnmn1cshtnclm79gnjfixhxwbs6alngo5%2bwsbdtx7tf%2bcdq15tlypagp7%2bfcvhh%2fvk7vqug4q50raixukomlg%2f1ovxr3dchwvvvfuxztijkltbk%3d" - Source: "00000000-00006356.00000001.135416.8D6D4000.00000004.mdmp") Found URL "https://api.telegram.org/bot8907791006:aafevxzckqkmy9e-g4nbnph0t3pke9tzqdm:" - Source: "00000000-00006356.00000001.135416.8FB50000.00000004.mdmp") Found URL "https://api.telegram.org/bot8907791006:aafevxzckqkmy9e-g4nbnph0t3pke9tzqdm/sendmessage?chat_id=5149407774&text=done%20installing%20gee.hkn@pce" - Source: "00000000-00006356.00000001.135416.8FB50000.00000004.mdmp")