26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 37:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Khalesi Sample f181aafa4cc9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f181aafa4cc9…. Malware family: Trojan.Khalesi. Threat score 100/100. 19/29 AV engines flagged this file. 15 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f181aafa4cc93117631f2376cb3543d7f4f6c0570cf95cb8bb526e99ab56f095","keywords":["Malicious","Trojan.Khalesi","malware analysis","sandbox report","threat intelligence","f181aafa4cc93117631f2376cb3543d7f4f6c0570cf95cb8bb526e99ab56f095"],"about":{"@type":"SoftwareApplication","name":"paddle.jpg.exe","applicationCategory":["peexe","executable"],"identifier":"f181aafa4cc93117631f2376cb3543d7f4f6c0570cf95cb8bb526e99ab56f095","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Khalesi","antivirusDetections":{"malicious":19,"total":29},"behavioralIndicators":{"malicious":15,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T888,"explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "HELPLINK"; Value: "00000000010000005A00000068007400740070003A002F002F007700770077002E00610064006F00620065002E0063006F006D002F0067006F002F0066006C0061007300680070006C0061007900650072005F0073007500700070006F00720074002F000000") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "URLINFOABOUT"; Value: "00000000010000002A00000068007400740070003A002F002F007700770077002E00610064006F00620065002E0063006F006D000000") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "URLINFOABOUT"; Value: "00000000010000004800000068007400740070003A002F002F007700770077002E006100750074006F00690074007300630072006900700074002E0063006F006D002F006100750074006F006900740033000000") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA0") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA1")28:T7c1,"explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")29:T723,"explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")2a:T1760,Process "csrss.exe" (UID: 00025738-00000316) was launched with modified environment variables: "TMP, PROCESSOR_REVISION, USERNAME, PROCESSOR_LEVEL, PROCESSOR_IDENTIFIER, TEMP" Process "csrss.exe" (UID: 00025738-00000316) was launched with missing environment variables: "ALLUSERSPROFILE, MpConfig_ProductUserAppDataPath, ProgramData, HOMEPATH, PUBLIC, PROMPT, LOGONSERVER, LOCALAPPDATA, USERDOMAIN, COMPUTERNAME, MpConfig_ProductAppDataPath, MpConfig_ProductPath, USERPROFILE, CommonProgramFiles, ProgramFiles, HOMEDRIVE, MpConfig_ProductCodeName, APPDATA, MpConfig_ReportingGUID" Process "services.exe" (UID: 00025938-00000452) was launched with modified environment variables: "Path" Process "lsass.exe" (UID: 00025988-00000460) was launched with new environment variables: "ALLUSERSPROFILE="C:\ProgramData", ProgramData="C:\ProgramData", COMPUTERNAME="YhXdFEtE3X", PUBLIC="C:\Users\Public", CommonProgramFiles="C:\Program Files\Common Files", ProgramFiles="C:\Program Files", USERPROFILE="C:\Windows\system32\config\systemprofile"" Process "lsass.exe" (UID: 00025988-00000460) was launched with modified environment variables: "PROCESSOR_REVISION, PROCESSOR_LEVEL, Path, PROCESSOR_IDENTIFIER" Process "lsm.exe" (UID: 00026038-00000468) was launched with modified environment variables: "TMP, USERNAME, USERPROFILE, TEMP" Process "lsm.exe" (UID: 00026038-00000468) was launched with missing environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA" Process "svchost.exe" (UID: 00026088-00000572) was launched with new environment variables: "LOCALAPPDATA="C:\Windows\system32\config\systemprofile\AppData\Local", USERDOMAIN="YhXdFEtE3", APPDATA="C:\Windows\system32\config\systemprofile\AppData\Roaming"" Process "svchost.exe" (UID: 00026088-00000572) was launched with modified environment variables: "USERNAME" Process "svchost.exe" (UID: 00026140-00000688) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERPROFILE, TEMP, APPDATA" Process "svchost.exe" (UID: 00026190-00000744) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERDOMAIN, USERPROFILE, TEMP, APPDATA" Process "svchost.exe" (UID: 00026251-00000864) was launched with new environment variables: "LOCALAPPDATA="C:\Windows\system32\config\systemprofile\AppData\Local", USERDOMAIN="YhXdFEtE3", APPDATA="C:\Windows\system32\config\systemprofile\AppData\Roaming"" Process "svchost.exe" (UID: 00026251-00000864) was launched with modified environment variables: "USERNAME" Process "svchost.exe" (UID: 00026307-00000892) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERPROFILE, TEMP, APPDATA" Process "svchost.exe" (UID: 00026357-00001004) was launched with modified environment variables: "LOCALAPPDATA, TMP, Path, USERPROFILE, TEMP, APPDATA" Process "svchost.exe" (UID: 00026357-00001004) was launched with missing environment variables: "LOGONSERVER, HOMEPATH, SESSIONNAME, HOMEDRIVE" Process "svchost.exe" (UID: 00026407-00001068) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERDOMAIN, USERPROFILE, TEMP, APPDATA" Process "svchost.exe" (UID: 00026507-00001252) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERPROFILE, TEMP, APPDATA" Process "svchost.exe" (UID: 00026507-00001252) was launched with missing environment variables: "LOGONSERVER, HOMEPATH, HOMEDRIVE" Process "taskhost.exe" (UID: 00026557-00001332) was launched with new environment variables: "LOGONSERVER="\\PSPUBWS-PC", HOMEPATH="\Users\nAEETpp", HOMEDRIVE="C:"" Process "taskhost.exe" (UID: 00026557-00001332) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERDOMAIN, Path, USERPROFILE, TEMP, APPDATA" Process "explorer.exe" (UID: 00026707-00001468) was launched with new environment variables: "LOGONSERVER="\\PSPUBWS-PC", HOMEPATH="\Users\nAEETpp", SESSIONNAME="Console", HOMEDRIVE="C:"" Process "explorer.exe" (UID: 00026707-00001468) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERDOMAIN, Path, USERPROFILE, TEMP, APPDATA" Process "mscorsvw.exe" (UID: 00026857-00002484) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERDOMAIN, Path, USERPROFILE, TEMP, APPDATA" Process "mscorsvw.exe" (UID: 00026857-00002484) was launched with missing environment variables: "PROMPT, MpConfig_ProductUserAppDataPath, LOGONSERVER, HOMEPATH, MpConfig_ProductAppDataPath, MpConfig_ProductPath, HOMEDRIVE, MpConfig_ProductCodeName, MpConfig_ReportingGUID" Process "conhost.exe" (UID: 00027007-00002344) was launched with modified environment variables: "TMP, PROCESSOR_REVISION, USERNAME, PROCESSOR_LEVEL, PROCESSOR_IDENTIFIER, TEMP" Process "conhost.exe" (UID: 00027007-00002344) was launched with missing environment variables: "ALLUSERSPROFILE, LOCALAPPDATA, ProgramData, USERDOMAIN, COMPUTERNAME, PUBLIC, USERPROFILE, APPDATA" Process "WmiPrvSE.exe" (UID: 00027157-00003956) was launched with modified environment variables: "LOCALAPPDATA, TMP, USERDOMAIN, USERPROFILE, TEMP, APPDATA" Process "wuauclt.exe" (UID: 00027647-00004044) was launched with new environment variables: "ALLUSERSPROFILE="C:\ProgramData", MpConfig_ProductUserAppDataPath="C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows Defender", ProgramData="C:\ProgramData", HOMEPATH="\Users\nAEETpp", PUBLIC="C:\Users\Public", PROMPT="$P$G", LOGONSERVER="\\PSPUBWS-PC", LOCALAPPDATA="C:\Users\nAEETpp\AppData\Local", USERDOMAIN="YhXdFEtE3X", COMPUTERNAME="YhXdFEtE3X", MpConfig_ProductAppDataPath="C:\ProgramData\Microsoft\Windows Defender", MpConfig_ProductPath="C:\Program Files\Windows Defender", HOMEDRIVE="C:", USERPROFILE="C:\Users\nAEETpp", MpConfig_ProductCodeName="AntiSpyware", APPDATA="C:\Users\nAEETpp\AppData\Roaming", MpConfig_ReportingGUID="D9765A22-4A32-46A9-92CB-043F61DC4FA2"" Process "wuauclt.exe" (UID: 00027647-00004044) was launched with modified environment variables: "TMP, PROCESSOR_REVISION, USERNAME, PROCESSOR_LEVEL, PROCESSOR_IDENTIFIER, TEMP"2b:T47a,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "" touched file "C:\Windows\Fonts\StaticCache.dat" "explorer.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "explorer.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "explorer.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "explorer.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "explorer.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies\index.dat" "explorer.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History\History.IE5\index.dat" "lsass.exe" touched file "C:\Windows\System32\en-US\vaultsvc.dll.mui" "lsass.exe" touched file "C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred" "lsass.exe" touched file "C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\ed1c2e14-1607-40ad-8a56-e1fdf4a18232" "svchost.exe" touched file "C:\Windows\Prefetch\EXPLORER.EXE-A80E4F97.pf"2c:T1b34,Heuristic match: "EEVA.............................................#..............PS" Heuristic match: ".......................................RU" Heuristic match: "GGX!................................PR" Heuristic match: ")....................................SU" Heuristic match: ";........................SU" Heuristic match: "g~M+^S.Bt" Pattern match: "www.bing.com" Pattern match: "http://www.msn.com/fr-fr/?ocid=BHEA000" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=40C" Pattern match: "http://+_d.domain+/,u=sj_cook.get(_UR,D),f=sj_cook.get(SRCHS,PC),t=a(),e=h(),o=c();l()||(u=2*e+o,sj_cook.set(_UR,D,u,1,/))}();var" Pattern match: "https://support.microsoft.com/kb/3035490" Pattern match: "mscrl.microsoft.com/pki/mscorp/crl/msitwww2.crl" Pattern match: "crl.microsoft.com/pki/mscorp/crl/msitwww2.crl0p" Pattern match: "www.microsoft.com/pki/mscorp/msitwww2.crt0" Pattern match: "http://ocsp.msocsp.com0=" Pattern match: "http://www.microsoft.com/pki/mscorp/cps" Pattern match: "http://cybertrust.omniroot.com/repository.cfm0" Pattern match: "http://ocsp.omniroot.com/baltimoreroot0" Pattern match: "cdp1.public-trust.com/CRL/Omniroot2025.crl0" Pattern match: "http://www.microsoft.com/downloads/details.aspx?FamilyID=c17ba869-9671-4330-a63e-1fd44e0e2505" Pattern match: "www.microsoft.com" Pattern match: "http://schemas.microsoft.com/CMSvNext" Pattern match: "assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.26.1/css/mwf-west-european-default.min.css" Pattern match: "http://c.s-microsoft.com/en-us/CMSImages/windows_symbol_clr_56x56.png?version=3db565f2-d75c-d989-182d-07edaedef3c8" Pattern match: "https://statics-uhf-eus.akamaized.net/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/66-41abaf/ad-ec92c6/98-847609/e9-c399ba/8e-9c6412/cc-c21898/9c-3df1cf?ver=2.0" Pattern match: "http://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.9.1.min.js" Pattern match: "mem.gfx.ms/meversion?partner=MSDLC&market=en-us" Pattern match: "https://az725175.vo.msecnd.net/scripts/jsll-4.js" Pattern match: "support.microsoft.com/gp/howtoscript" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/REZlo1?ver=5722" Pattern match: "http://schema.org/Organization" Pattern match: "https://products.office.com/en-us/home" Pattern match: "https://www.microsoft.com/en-us/windows/windows-10-apps" Pattern match: "https://www.microsoft.com/accessories/en-us" Pattern match: "https://www.microsoft.com/en-us/store/games/windows?icid=TopNavWindowsGames" Pattern match: "https://www.microsoft.com/en-us/server-cloud/" Pattern match: "https://docs.microsoft.com/en-us/" Pattern match: "https://www.microsoft.com/en-us/store/b/gift-cards" Pattern match: "https://www.microsoft.com/services/api/v3/suggest" Pattern match: "https://www.microsoft.com/en-us/store/buy" Pattern match: "http://schema.org/Brand" Pattern match: "oft.com/en-us/download/developer-tools.aspx" Pattern match: "microsoftwindows.112.2o7.net/b/ss/msstores1-cmstest-prod/1/H.24.4/,e=" Pattern match: "microsoftwindows.112.2o7.net/b/ss/msstores1-cmstest-prod/1/H.24.4/,h=" Pattern match: "https://c.s-microsoft.com/en-us/CMSStyles/epb.css?version=43583927-EB99-F50D-EDC6-010FA1F6B5C6" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1CxoC?ver=16dd" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1CmPo?ver=f1b3" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1CmPg?ver=c433" Pattern match: "http://schema.org/SoftwareApplication" Pattern match: "http://schema.org/Offer" Pattern match: "http://download.microsoft.com/download/8/8/0/8808A472-6450-4723-9C87-977069714Ba" Pattern match: "http://go.microsoft.com/fwlink/?LinkID=150216&clcid=0x409" Pattern match: "http://download.microsoft.com/download/8/8/0/8808A472-6450-4723-9C87-977069714B27/ReleaseNotes_Win7RTMSDK.Htm" Pattern match: "http://msdn.microsoft.com/en-us/windowsserver/bb980924.aspx" Pattern match: "http://www.microsoft.com/downloads/details.aspx?FamilyId=30B7D554-7610-4114-8B78-55D52BA2EDC1&displaylang=en" Pattern match: "https://www.facebook.com/Microsoft" Pattern match: "https://twitter.com/microsoft" Pattern match: "https://www.microsoft.com/en-us/surface/devices/surface-book-2/overview" Pattern match: "https://support.microsoft.com/en-us" Pattern match: "https://azure.microsoft.com/" Pattern match: "https://www.visualstudio.com/" Pattern match: "https://news.microsoft.com/" Pattern match: "http://go.microsoft.com/fwlink/?LinkID=530144" Pattern match: "http://c.s-microsoft.com/en-us/CMSScripts/script.jsx?k=1bec8aa9-e409-b738-fad4-cd9ba3c4141e" Pattern match: "https://www.microsoft.com/en-us/download/xbox.aspx" Pattern match: "https://www.microsoft.com/en-us/store/d/product/8NKT9WTTRBJK" Pattern match: "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1CmPi?ver=af43" Pattern match: "http://www.microsoft.com/windows/windows-7/default.aspx" Pattern match: "https://www.fh" Pattern match: "acebook.com/Microsoft" Pattern match: "https://www.xbox.com/en-us/xbox-one-s?xr=shellnav" Pattern match: "https://account.microsoft.com/orders" Pattern match: "https://www.microsoft.com/en-us/education/products/office/default.aspx" Pattern match: "https://partner.microsoft.com/en-us/" Pattern match: "https://developer.microsoft.com/en-us/store/register" Pattern match: "ww.microsoft.com/en-us/accessibility/home" Pattern match: "https://support.microsoft.com/kb/2972107" Pattern match: "http://www.microsoft.com/systemcenter/en/us" Pattern match: "www.microsoft.com0" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://ss.symcb.com/ss.crl0W" Pattern match: "http://ss.symcd.com0&" Pattern match: "http://ss.symcb.com/ss.crt0" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa0" Heuristic match: "support.mozilla.org" Pattern match: "http://crl3.digicert.com/ssca-sha2-g1.crl0/" Pattern match: "http://crl4.digicert.com/ssca-sha2-g1.crl0L" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "http://ocsp.digicert.com0F" Pattern match: "http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt0" Pattern match: "www.digicert.com1" Pattern match: "http://ocsp.digicert.com0" Pattern match: "crl3.digicert.com/DigiCertGlobalRootCA.crl07" Pattern match: "crl4.digicert.com/DigiCertGlobalRootCA.crl0=" Heuristic match: "donate.xmrig.com" Heuristic match: ".nicehash.com" Heuristic match: "pool.minexmr.com" Heuristic match: "*-09140401.pf" Heuristic match: "*-D8414F97.pf" Heuristic match: "*-A606B53C.pf" Heuristic match: "*-724E99D9.pf" Heuristic match: "WMP11.AssocFile.AU"2d:T706,"" queried SystemProcessInformation at 00015343-00002244-00000105-45276924 "" queried SystemProcessInformation at 00015343-00002244-00000105-45298654 "" queried SystemProcessInformation at 00015343-00002244-00000105-45314686 "" queried SystemProcessInformation at 00015343-00002244-00000105-45331041 "" queried SystemProcessInformation at 00015343-00002244-00000105-45354779 "" queried SystemProcessInformation at 00015343-00002244-00000105-45383915 "" queried SystemProcessInformation at 00015343-00002244-00000105-45446357 "" queried SystemProcessInformation at 00015343-00002244-00000105-45478262 "" queried SystemProcessInformation at 00015343-00002244-00000105-45510016 "" queried SystemProcessInformation at 00015343-00002244-00000105-45542272 "" queried SystemProcessInformation at 00015343-00002244-00000105-45573823 "" queried SystemProcessInformation at 00015343-00002244-00000105-45603177 "" queried SystemProcessInformation at 00015343-00002244-00000105-45634591 "" queried SystemProcessInformation at 00015343-00002244-00000105-45666565 "" queried SystemProcessInformation at 00015343-00002244-00000105-45696395 "" queried SystemProcessInformation at 00015343-00002244-00000105-45729312 "" queried SystemProcessInformation at 00015343-00002244-00000105-45759810 "" queried SystemProcessInformation at 00015343-00002244-00000105-45791522 "" queried SystemProcessInformation at 00015343-00002244-00000105-45823450 "" queried SystemProcessInformation at 00015343-00002244-00000105-458550502e:T428,"explorer.exe" opened file "%COMMONPROGRAMFILES%\Ipswitch\WS_FTP\*.*" "explorer.exe" opened file "%APPDATA%\Ipswitch\WS_FTP\Sites\*.*" "explorer.exe" opened file "%ALLUSERSPROFILE%\Ipswitch\WS_FTP\Sites\*.*" "explorer.exe" opened file "%LOCALAPPDATA%\Ipswitch\WS_FTP\Sites\*.*" "explorer.exe" opened file "%APPDATA%\SmartFTP\Favorites.dat" "explorer.exe" opened file "%APPDATA%\SmartFTP\Client 2.0\Favorites\Favorites.dat" "explorer.exe" opened file "%APPDATA%\SmartFTP\History.dat" "explorer.exe" opened file "%ALLUSERSPROFILE%\SmartFTP\Favorites.dat" "explorer.exe" opened file "%ALLUSERSPROFILE%\SmartFTP\Client 2.0\Favorites\Favorites.dat" "explorer.exe" opened file "%ALLUSERSPROFILE%\SmartFTP\History.dat" "explorer.exe" opened file "%LOCALAPPDATA%\SmartFTP\Favorites.dat" "explorer.exe" opened file "%LOCALAPPDATA%\SmartFTP\Client 2.0\Favorites\Favorites.dat" "explorer.exe" opened file "%LOCALAPPDATA%\SmartFTP\History.dat" "explorer.exe" opened file "%APPDATA%\TurboFTP\addrbk.dat" "explorer.exe" opened file "%APPDATA%\FTPRush\RushSite.xml"2f:Tbce,"14">Software